USN-621-1: Ruby vulnerabilities

Packages

ruby1.8 -

Details

Drew Yao discovered several vulnerabilities in Ruby which lead to integer
overflows. If a user or automated system were tricked into running a
malicious script, an attacker could cause a denial of service or execute
arbitrary code with the privileges of the user invoking the program.
(CVE-2008-2662, CVE-2008-2663, CVE-2008-2725, CVE-2008-2726)

Drew Yao discovered that Ruby did not sanitize its input when using ALLOCA.
If a user or automated system were tricked into running a malicious script,
an attacker could cause a denial of service via memory corruption.
(CVE-2008-2664)

Drew Yao discovered several vulnerabilities in Ruby which lead to integer
overflows. If a user or automated system were tricked into running a
malicious script, an attacker could cause a denial of service or execute
arbitrary code with the privileges of the user invoking the program.
(CVE-2008-2662, CVE-2008-2663, CVE-2008-2725, CVE-2008-2726)

Drew Yao discovered that Ruby did not sanitize its input when using ALLOCA.
If a user or automated system were tricked into running a malicious script,
an attacker could cause a denial of service via memory corruption.
(CVE-2008-2664)

Update instructions

In general, a standard system upgrade is sufficient to effect the necessary changes.

Learn more about how to get the fixes.

Ubuntu Release	Package Version
8.04 hardy	ruby1.8 – 1.8.6.111-2ubuntu1.1
8.04 hardy	libruby1.8 – 1.8.6.111-2ubuntu1.1
7.10 gutsy	ruby1.8 – 1.8.6.36-1ubuntu3.2
7.10 gutsy	libruby1.8 – 1.8.6.36-1ubuntu3.2
7.04 feisty	ruby1.8 – 1.8.5-4ubuntu2.2
7.04 feisty	libruby1.8 – 1.8.5-4ubuntu2.2
6.06 dapper	ruby1.8 – 1.8.4-1ubuntu1.5
6.06 dapper	libruby1.8 – 1.8.4-1ubuntu1.5

Reduce your security exposure

Ubuntu Pro provides ten-year security coverage to 25,000+ packages in Main and Universe repositories, and it is free for up to five machines.

Get Ubuntu Pro

Packages

Details

Update instructions

Reduce your security exposure

References