Ubuntu alert USN-4175-1 (ruby-nokogiri)
| From: | Eduardo Barretto <eduardo.barretto@canonical.com> | |
| To: | ubuntu-security-announce@lists.ubuntu.com | |
| Subject: | [USN-4175-1] Nokogiri vulnerability | |
| Date: | Tue, 05 Nov 2019 11:51:30 -0300 | |
| Message-ID: | <3b87ba518aa8c25deda32dceb027f216f42cd2ad.camel@canonical.com> |
========================================================================== Ubuntu Security Notice USN-4175-1 November 05, 2019 ruby-nokogiri vulnerability ========================================================================== A security issue affects these releases of Ubuntu and its derivatives: - Ubuntu 19.10 - Ubuntu 19.04 - Ubuntu 18.04 LTS - Ubuntu 16.04 LTS Summary: Nokogiri could be made to execute programs if it received specially crafted input. Software Description: - ruby-nokogiri: HTML, XML, SAX, and Reader parser for Ruby Details: It was discovered that Nokogiri incorrectly handled inputs. A remote attacker could possibly use this issue to execute arbitrary OS commands. Update instructions: The problem can be corrected by updating your system to the following package versions: Ubuntu 19.10: ruby-nokogiri 1.10.3+dfsg1-2ubuntu0.1 Ubuntu 19.04: ruby-nokogiri 1.10.0+dfsg1-2ubuntu0.1 Ubuntu 18.04 LTS: ruby-nokogiri 1.8.2-1ubuntu0.1 Ubuntu 16.04 LTS: ruby-nokogiri 1.6.7.2-3ubuntu0.1 In general, a standard system update will make all the necessary changes. References: https://usn.ubuntu.com/4175-1 CVE-2019-5477 Package Information: https://launchpad.net/ubuntu/+source/ruby-nokogiri/1.10.3... https://launchpad.net/ubuntu/+source/ruby-nokogiri/1.10.0... https://launchpad.net/ubuntu/+source/ruby-nokogiri/1.8.2-... https://launchpad.net/ubuntu/+source/ruby-nokogiri/1.6.7.... -- ubuntu-security-announce mailing list ubuntu-security-announce@lists.ubuntu.com Modify settings or unsubscribe at: https://lists.ubuntu.com/mailman/listinfo/ubuntu-security...