Mageia alert MGASA-2013-0092 (ruby)

From:
    	     
 
Mageia Updates <buildsystem-daemon@mageia.org> 
To:
    	     
 
updates-announce@ml.mageia.org 
Subject:
    	     
 
[updates-announce] MGASA-2013-0092: ruby-1.8.7.p358-1.2.mga2
 (2/core) 
Date:
    	     
 
Sat, 16 Mar 2013 01:50:22 +0100
Message-ID:
    	     
 
<20130316005022.GA11187@valstar.mageia.org>

MGASA-2013-0092

Date:	March 15rd, 2013
Affected releases:	2
Media:	Core

Description:
Updated ruby packages fix security vulnerability:

It was discovered that Ruby's REXML library did not properly restrict
XML entity expansion. An attacker could use this flaw to cause a denial 
of service by tricking a Ruby application using REXML to read text nodes
from specially-crafted XML content, which will result in REXML consuming
large amounts of system memory (CVE-2013-1821).

Updated Packages:
i586:
ruby-tk-1.8.7.p358-1.2.mga2.i586
ruby-doc-1.8.7.p358-1.2.mga2.noarch
ruby-1.8.7.p358-1.2.mga2.i586
ruby-devel-1.8.7.p358-1.2.mga2.i586

x86_64:
ruby-tk-1.8.7.p358-1.2.mga2.x86_64
ruby-doc-1.8.7.p358-1.2.mga2.noarch
ruby-1.8.7.p358-1.2.mga2.x86_64
ruby-devel-1.8.7.p358-1.2.mga2.x86_64

SRPMS:
ruby-1.8.7.p358-1.2.mga2

References:
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-1821
http://www.ruby-lang.org/en/news/2013/02/22/rexml-dos-201...
https://rhn.redhat.com/errata/RHSA-2013-0612.html
https://bugs.mageia.org/show_bug.cgi?id=9300
https://wiki.mageia.org/en/Support/Advisories/MGASA-2013-...