USN-3621-1: Ruby vulnerabilities
5 April 2018
Several security issues were fixed in Ruby.
Releases
Packages
- ruby1.9.1 - Object-oriented scripting language
- ruby2.0 - Object-oriented scripting language
- ruby2.3 - Object-oriented scripting language
Details
It was discovered that Ruby incorrectly handled certain inputs. An attacker
could possibly use this to access sensitive information. (CVE-2018-1000073)
It was discovered that Ruby incorrectly handled certain files. An attacker
could possibly use this to execute arbitrary code. (CVE-2018-1000074)
It was discovered that Ruby incorrectly handled certain files. An attacker
could possibly use this to cause a denial of service. (CVE-2018-1000075)
It was discovered that Ruby incorrectly handled certain crypto signatures.
An attacker could possibly use this to execute arbitrary code. (CVE-2018-1000076)
It was discovered that Ruby incorrectly handled certain inputs. An attacker
could possibly use this to execute arbitrary code. (CVE-2018-1000077,
CVE-2018-1000078, CVE-2018-1000079)
Update instructions
The problem can be corrected by updating your system to the following package versions:
Ubuntu 17.10
Ubuntu 16.04
Ubuntu 14.04
-
libruby1.9.1
-
1.9.3.484-2ubuntu1.8
-
libruby2.0
-
2.0.0.484-1ubuntu2.6
-
ruby1.9.1
-
1.9.3.484-2ubuntu1.8
-
ruby1.9.3
-
1.9.3.484-2ubuntu1.8
-
ruby2.0
-
2.0.0.484-1ubuntu2.6
In general, a standard system update will make all the necessary changes.
Related notices
- USN-3621-2: ruby2.0-tcltk, ruby2.0-doc, ruby1.9.3, ruby1.9.1, libtcltk-ruby1.9.1, ruby1.9.1-dev, ruby1.9.1-full, ri1.9.1, libruby2.0, ruby2.0-dev, ruby2.0, ruby1.9.1-examples, libruby1.9.1
- USN-3685-1: ruby2.0-tcltk, ruby2.0-doc, ruby1.9.3, libruby2.3, ruby2.3-tcltk, ruby1.9.1, libtcltk-ruby1.9.1, ruby1.9.1-dev, ruby1.9.1-full, ri1.9.1, libruby2.0, ruby2.3-doc, ruby2.0-dev, ruby2.3-dev, ruby2.0, ruby2.3, ruby1.9.1-examples, libruby1.9.1