-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 - ------------------------------------------------------------------------- Debian Security Advisory DSA-2738-1 security@xxxxxxxxxx http://www.debian.org/security/ Thijs Kinkhorst August 18, 2013 http://www.debian.org/security/faq - ------------------------------------------------------------------------- Package : ruby1.9.1 Vulnerability : several Problem type : remote Debian-specific: no CVE ID : CVE-2013-1821 CVE-2013-4073 Debian Bug : 702525 714543 Several vulnerabilities have been discovered in the interpreter for the Ruby language, which may lead to denial of service and other security problems. The Common Vulnerabilities and Exposures project identifies the following problems: CVE-2013-1821 Ben Murphy discovered that unrestricted entity expansion in REXML can lead to a Denial of Service by consuming all host memory. CVE-2013-4073 William (B.J.) Snow Orvis discovered a vulnerability in the hostname checking in Ruby's SSL client that could allow man-in-the-middle attackers to spoof SSL servers via valid certificate issued by a trusted certification authority. For the oldstable distribution (squeeze), these problems have been fixed in version 1.9.2.0-2+deb6u1. For the stable distribution (wheezy), these problems have been fixed in version 1.9.3.194-8.1+deb7u1. For the unstable distribution (sid), these problems have been fixed in version 1.9.3.194-8.2. We recommend that you upgrade your ruby1.9.1 packages. Further information about Debian Security Advisories, how to apply these updates to your system and frequently asked questions can be found at: http://www.debian.org/security/ Mailing list: debian-security-announce@xxxxxxxxxxxxxxxx -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.12 (GNU/Linux) iQEcBAEBAgAGBQJSENmEAAoJEFb2GnlAHawE/LUH/jK+Uvl5xY1vfvSbWOMnSQvm ridGMLtMkJEv8l7t+UFU8RUH+avbFfNN0sC7oapLDqUWbWLWty5iO60f8MjcXVwA wuGdDrvJWIqRChf8HG7I0sQm+htKGbDW5WgwzXb1TpHJUUaKFDDWI5Bk5LqsAUMb xRSnCVE4QQ8rWFHj1sqCMHGTg3QmNSZWlzTfTo0giB9GosNDCa62vgat4pkSjRG6 YHLXsWbEq+noXf1RtGr3ZrxduVzkD1yGdtO8GEoDMzwyhecySBHpABt+HbmjmoYu yI9UHupCaC3CbimhBFcwQtG7m41T0eEUMjHud2XMdelO0FVi6chO6cweXDxJi8I= =OKd7 -----END PGP SIGNATURE-----
