Advisories » MGASA-2014-0003

Updated ruby package fixes security vulnerability

Publication date: 06 Jan 2014
Modification date: 06 Jan 2014
Type: security
Affected Mageia releases : 3
CVE: CVE-2013-4164

Description

Charlie Somerville discovered that Ruby incorrectly handled floating point
number conversion. An attacker could possibly use this issue with an
application that converts text to floating point numbers to cause the
application to crash, resulting in a denial of service, or possibly
execute arbitrary code (CVE-2013-4164).
                

References

• https://bugs.mageia.org/show_bug.cgi?id=11734
• https://www.ruby-lang.org/en/news/2013/11/22/heap-overflow-in-floating-point-parsing-cve-2013-4164/
• https://www.ruby-lang.org/en/news/2013/11/22/ruby-1-9-3-p484-is-released/
• http://www.ubuntu.com/usn/usn-2035-1
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-4164

SRPMS

3/core

• ruby-1.9.3.p484-1.mga3