Mailinglist Archive: opensuse-updates (111 mails)

< Previous Next >
openSUSE-SU-2013:0603-1: moderate: ruby: update to fix XML and JSON security problems
openSUSE Security Update: ruby: update to fix XML and JSON security problems
______________________________________________________________________________

Announcement ID: openSUSE-SU-2013:0603-1
Rating: moderate
References: #803342 #808137
Cross-References: CVE-2013-0269 CVE-2013-1821
Affected Products:
openSUSE 12.3
openSUSE 12.2
openSUSE 12.1
______________________________________________________________________________

An update that fixes two vulnerabilities is now available.

Description:


Ruby 1.8 was updated to fix a XML entity expansion denial
of service attack (CVE-2013-1821)

Ruby 1.9 was updated to 1.9.3 p392, fixing the same
security issues and also:
- update json intree to 1.5.5: Denial of Service and
Unsafe Object Creation Vulnerability in JSON
CVE-2013-0269
- limit entity expansion text limit to 10kB CVE-2013-1821
- get rid of a SEGV when calling rb_iter_break() from
some extention libraries.
- some warning suppressed and smaller fixes


Patch Instructions:

To install this openSUSE Security Update use YaST online_update.
Alternatively you can run the command listed for your product:

- openSUSE 12.3:

zypper in -t patch openSUSE-2013-298

- openSUSE 12.2:

zypper in -t patch openSUSE-2013-298

- openSUSE 12.1:

zypper in -t patch openSUSE-2013-298

To bring your system up-to-date, use "zypper patch".


Package List:

- openSUSE 12.3 (i586 x86_64):

ruby-1.9.3-15.2.1
ruby-devel-1.9.3-15.2.1
ruby19-1.9.3.p392-1.5.2
ruby19-debuginfo-1.9.3.p392-1.5.2
ruby19-debugsource-1.9.3.p392-1.5.2
ruby19-devel-1.9.3.p392-1.5.2
ruby19-devel-extra-1.9.3.p392-1.5.2
ruby19-tk-1.9.3.p392-1.5.2
ruby19-tk-debuginfo-1.9.3.p392-1.5.2

- openSUSE 12.3 (noarch):

ruby19-doc-ri-1.9.3.p392-1.5.2

- openSUSE 12.2 (i586 x86_64):

ruby-1.9.3-2.4.1
ruby-common-1.9.3-2.4.1
ruby-devel-1.9.3-2.4.1
ruby19-1.9.3.p392-3.22.1
ruby19-debuginfo-1.9.3.p392-3.22.1
ruby19-debugsource-1.9.3.p392-3.22.1
ruby19-devel-1.9.3.p392-3.22.1
ruby19-devel-extra-1.9.3.p392-3.22.1
ruby19-tk-1.9.3.p392-3.22.1
ruby19-tk-debuginfo-1.9.3.p392-3.22.1

- openSUSE 12.2 (noarch):

ruby19-doc-ri-1.9.3.p392-3.22.1

- openSUSE 12.1 (i586 x86_64):

ruby-1.8.7.p357-2.10.1
ruby-debuginfo-1.8.7.p357-2.10.1
ruby-debugsource-1.8.7.p357-2.10.1
ruby-devel-1.8.7.p357-2.10.1
ruby-examples-1.8.7.p357-2.10.1
ruby-test-suite-1.8.7.p357-2.10.1
ruby-tk-1.8.7.p357-2.10.1
ruby-tk-debuginfo-1.8.7.p357-2.10.1

- openSUSE 12.1 (noarch):

ruby-doc-html-1.8.7.p357-2.10.1
ruby-doc-ri-1.8.7.p357-2.10.1


References:

http://support.novell.com/security/cve/CVE-2013-0269.html
http://support.novell.com/security/cve/CVE-2013-1821.html
https://bugzilla.novell.com/803342
https://bugzilla.novell.com/808137


< Previous Next >
This Thread
  • No further messages