openSUSE Security Update: ruby: update to fix XML and JSON security problems ______________________________________________________________________________ Announcement ID: openSUSE-SU-2013:0603-1 Rating: moderate References: #803342 #808137 Cross-References: CVE-2013-0269 CVE-2013-1821 Affected Products: openSUSE 12.3 openSUSE 12.2 openSUSE 12.1 ______________________________________________________________________________ An update that fixes two vulnerabilities is now available. Description: Ruby 1.8 was updated to fix a XML entity expansion denial of service attack (CVE-2013-1821) Ruby 1.9 was updated to 1.9.3 p392, fixing the same security issues and also: - update json intree to 1.5.5: Denial of Service and Unsafe Object Creation Vulnerability in JSON CVE-2013-0269 - limit entity expansion text limit to 10kB CVE-2013-1821 - get rid of a SEGV when calling rb_iter_break() from some extention libraries. - some warning suppressed and smaller fixes Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 12.3: zypper in -t patch openSUSE-2013-298 - openSUSE 12.2: zypper in -t patch openSUSE-2013-298 - openSUSE 12.1: zypper in -t patch openSUSE-2013-298 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 12.3 (i586 x86_64): ruby-1.9.3-15.2.1 ruby-devel-1.9.3-15.2.1 ruby19-1.9.3.p392-1.5.2 ruby19-debuginfo-1.9.3.p392-1.5.2 ruby19-debugsource-1.9.3.p392-1.5.2 ruby19-devel-1.9.3.p392-1.5.2 ruby19-devel-extra-1.9.3.p392-1.5.2 ruby19-tk-1.9.3.p392-1.5.2 ruby19-tk-debuginfo-1.9.3.p392-1.5.2 - openSUSE 12.3 (noarch): ruby19-doc-ri-1.9.3.p392-1.5.2 - openSUSE 12.2 (i586 x86_64): ruby-1.9.3-2.4.1 ruby-common-1.9.3-2.4.1 ruby-devel-1.9.3-2.4.1 ruby19-1.9.3.p392-3.22.1 ruby19-debuginfo-1.9.3.p392-3.22.1 ruby19-debugsource-1.9.3.p392-3.22.1 ruby19-devel-1.9.3.p392-3.22.1 ruby19-devel-extra-1.9.3.p392-3.22.1 ruby19-tk-1.9.3.p392-3.22.1 ruby19-tk-debuginfo-1.9.3.p392-3.22.1 - openSUSE 12.2 (noarch): ruby19-doc-ri-1.9.3.p392-3.22.1 - openSUSE 12.1 (i586 x86_64): ruby-1.8.7.p357-2.10.1 ruby-debuginfo-1.8.7.p357-2.10.1 ruby-debugsource-1.8.7.p357-2.10.1 ruby-devel-1.8.7.p357-2.10.1 ruby-examples-1.8.7.p357-2.10.1 ruby-test-suite-1.8.7.p357-2.10.1 ruby-tk-1.8.7.p357-2.10.1 ruby-tk-debuginfo-1.8.7.p357-2.10.1 - openSUSE 12.1 (noarch): ruby-doc-html-1.8.7.p357-2.10.1 ruby-doc-ri-1.8.7.p357-2.10.1 References: http://support.novell.com/security/cve/CVE-2013-0269.html http://support.novell.com/security/cve/CVE-2013-1821.html https://bugzilla.novell.com/803342 https://bugzilla.novell.com/808137