Ubuntu alert USN-3621-1 (ruby1.9.1, ruby2.0, ruby2.3)
| From: | "Leonidas S. Barbosa" <leo.barbosa@canonical.com> | |
| To: | ubuntu-security-announce@lists.ubuntu.com | |
| Subject: | [USN-3621-1] Ruby vulnerabilities | |
| Date: | Thu, 05 Apr 2018 13:48:38 -0300 | |
| Message-ID: | <1522946918.5157.8.camel@canonical.com> |
========================================================================== Ubuntu Security Notice USN-3621-1 April 05, 2018 ruby1.9.1, ruby2.0, ruby2.3 vulnerabilities ========================================================================== A security issue affects these releases of Ubuntu and its derivatives: - Ubuntu 17.10 - Ubuntu 16.04 LTS - Ubuntu 14.04 LTS Summary: Several security issues were fixed in Ruby. Software Description: - ruby2.3: Object-oriented scripting language - ruby1.9.1: Object-oriented scripting language - ruby2.0: Object-oriented scripting language Details: It was discovered that Ruby incorrectly handled certain inputs. An attacker could possibly use this to access sensitive information. (CVE-2018-1000073) It was discovered that Ruby incorrectly handled certain files. An attacker could possibly use this to execute arbitrary code. (CVE-2018-1000074) It was discovered that Ruby incorrectly handled certain files. An attacker could possibly use this to cause a denial of service. (CVE-2018-1000075) It was discovered that Ruby incorrectly handled certain crypto signatures. An attacker could possibly use this to execute arbitrary code. (CVE-2018-1000076) It was discovered that Ruby incorrectly handled certain inputs. An attacker could possibly use this to execute arbitrary code. (CVE-2018-1000077, CVE-2018-1000078, CVE-2018-1000079) Update instructions: The problem can be corrected by updating your system to the following package versions: Ubuntu 17.10: libruby2.3 2.3.3-1ubuntu1.4 ruby2.3 2.3.3-1ubuntu1.4 Ubuntu 16.04 LTS: libruby2.3 2.3.1-2~16.04.7 ruby2.3 2.3.1-2~16.04.7 Ubuntu 14.04 LTS: libruby1.9.1 1.9.3.484-2ubuntu1.8 libruby2.0 2.0.0.484-1ubuntu2.6 ruby1.9.1 1.9.3.484-2ubuntu1.8 ruby1.9.3 1.9.3.484-2ubuntu1.8 ruby2.0 2.0.0.484-1ubuntu2.6 In general, a standard system update will make all the necessary changes. References: https://usn.ubuntu.com/usn/usn-3621-1 CVE-2018-1000073, CVE-2018-1000074, CVE-2018-1000075, CVE-2018- 1000076, CVE-2018-1000077, CVE-2018-1000078, CVE-2018-1000079 Package Information: https://launchpad.net/ubuntu/+source/ruby2.3/2.3.3-1ubunt... https://launchpad.net/ubuntu/+source/ruby2.3/2.3.1-2~16.04.7 https://launchpad.net/ubuntu/+source/ruby1.9.1/1.9.3.484-... https://launchpad.net/ubuntu/+source/ruby2.0/2.0.0.484-1u...-- ubuntu-security-announce mailing list ubuntu-security-announce@lists.ubuntu.com Modify settings or unsubscribe at: https://lists.ubuntu.com/mailman/listinfo/ubuntu-security...