Advisories » MGASA-2014-0472

Updated ruby packages fix security vulnerabilities

Publication date: 21 Nov 2014
Modification date: 21 Nov 2014
Type: security
Affected Mageia releases : 3 , 4
CVE: CVE-2014-4975 , CVE-2014-8090

Description

Will Wood discovered that Ruby incorrectly handled the encodes() function.
An attacker could possibly use this issue to cause Ruby to crash, resulting
in a denial of service, or possibly execute arbitrary code. The default
compiler options for affected releases should reduce the vulnerability to a
denial of service (CVE-2014-4975).

Due to an incomplete fix for CVE-2014-8080, 100% CPU utilization can occur as
a result of recursive expansion with an empty String. When reading text nodes
from an XML document, the REXML parser in Ruby can be coerced into allocating
extremely large string objects which can consume all of the memory on a
machine, causing a denial of service (CVE-2014-8090).
                

References

• https://bugs.mageia.org/show_bug.cgi?id=14532
• https://www.ruby-lang.org/en/news/2014/11/13/rexml-dos-cve-2014-8090/
• https://www.ruby-lang.org/en/news/2014/11/13/ruby-1-9-3-p551-is-released/
• https://www.ruby-lang.org/en/news/2014/11/13/ruby-2-0-0-p598-is-released/
• http://www.ubuntu.com/usn/usn-2397-1/
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-4975
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-8090

SRPMS

3/core

• ruby-1.9.3.p551-1.mga3

4/core

• ruby-2.0.0.p598-1.mga4