Scientific Linux alert SL-ruby-20130116 (ruby)

From:
    	     
 
Pat Riehecky <riehecky@fnal.gov> 
To:
    	     
 
"SCIENTIFIC-LINUX-ERRATA@LISTSERV.FNAL.GOV"
	<SCIENTIFIC-LINUX-ERRATA@LISTSERV.FNAL.GOV> 
Subject:
    	     
 
Security ERRATA Moderate: ruby on SL5.x i386/x86_64 
Date:
    	     
 
Wed, 16 Jan 2013 16:10:24 -0600
Message-ID:
    	     
 
<50F72550.7010600@fnal.gov>
Archive-link:
    	     
 
Article, Thread
              
Synopsis:          Moderate: ruby security and bug fix update
Issue Date:        2013-01-08
CVE Numbers:       CVE-2012-4481
                    CVE-2012-4522
--

It was found that certain methods did not sanitize file names before passing
them to lower layer routines in Ruby. If a Ruby application created 
files with
names based on untrusted input, it could result in the creation of files 
with
different names than expected. (CVE-2012-4522)

It was found that the SLSA-2011:0909 update did not correctly fix the
CVE-2011-1005 issue, a flaw in the method for translating an exception 
message
into a string in the Exception class. A remote attacker could use this 
flaw to
bypass safe level 4 restrictions, allowing untrusted (tainted) code to 
modify
arbitrary, trusted (untainted) strings, which safe level 4 restrictions 
would
otherwise prevent. (CVE-2012-4481)

This update also fixes the following bug:

* Prior to this update, the "rb_syck_mktime" option could, under certain
circumstances, terminate with a segmentation fault when installing libraries
with certain gems. This update modifies the underlying code so that Ruby 
gems
can be installed as expected.
--

SL5
   x86_64
     ruby-1.8.5-27.el5.x86_64.rpm
     ruby-debuginfo-1.8.5-27.el5.i386.rpm
     ruby-debuginfo-1.8.5-27.el5.x86_64.rpm
     ruby-docs-1.8.5-27.el5.x86_64.rpm
     ruby-irb-1.8.5-27.el5.x86_64.rpm
     ruby-libs-1.8.5-27.el5.i386.rpm
     ruby-libs-1.8.5-27.el5.x86_64.rpm
     ruby-rdoc-1.8.5-27.el5.x86_64.rpm
     ruby-ri-1.8.5-27.el5.x86_64.rpm
     ruby-tcltk-1.8.5-27.el5.x86_64.rpm
     ruby-devel-1.8.5-27.el5.i386.rpm
     ruby-devel-1.8.5-27.el5.x86_64.rpm
     ruby-mode-1.8.5-27.el5.x86_64.rpm
   i386
     ruby-1.8.5-27.el5.i386.rpm
     ruby-debuginfo-1.8.5-27.el5.i386.rpm
     ruby-docs-1.8.5-27.el5.i386.rpm
     ruby-irb-1.8.5-27.el5.i386.rpm
     ruby-libs-1.8.5-27.el5.i386.rpm
     ruby-rdoc-1.8.5-27.el5.i386.rpm
     ruby-ri-1.8.5-27.el5.i386.rpm
     ruby-tcltk-1.8.5-27.el5.i386.rpm
     ruby-devel-1.8.5-27.el5.i386.rpm
     ruby-mode-1.8.5-27.el5.i386.rpm

- Scientific Linux Development Team