WINDOWS CENTER: ubuntu-security-announce Digest, Vol 51, Issue 7

Send ubuntu-security-announce mailing list submissions to
ubuntu-security-announce@lists.ubuntu.com

To subscribe or unsubscribe via the World Wide Web, visit
https://lists.ubuntu.com/mailman/listinfo/ubuntu-security-announce
or, via email, send a message with subject or body 'help' to
ubuntu-security-announce-request@lists.ubuntu.com

You can reach the person managing the list at
ubuntu-security-announce-owner@lists.ubuntu.com

When replying, please edit your Subject line so it is more specific
than "Re: Contents of ubuntu-security-announce digest..."

Today's Topics:

1. [USN-691-1] Ruby vulnerability (Marc Deslauriers)

----------------------------------------------------------------------

Message: 1
Date: Tue, 16 Dec 2008 10:18:46 -0500
From: Marc Deslauriers <marc.deslauriers@canonical.com>
Subject: [USN-691-1] Ruby vulnerability
To: ubuntu-security-announce@lists.ubuntu.com
Cc: full-disclosure@lists.grok.org.uk, bugtraq@securityfocus.com
Message-ID: <1229440726.18614.12.camel@mdlinux.technorage.com>
Content-Type: text/plain; charset="us-ascii"

===========================================================
Ubuntu Security Notice USN-691-1 December 16, 2008
ruby1.9 vulnerability
CVE-2008-3443, CVE-2008-3790
===========================================================

A security issue affects the following Ubuntu releases:

Ubuntu 8.10

This advisory also applies to the corresponding versions of
Kubuntu, Edubuntu, and Xubuntu.

The problem can be corrected by upgrading your system to the
following package versions:

Ubuntu 8.10:
ruby1.9 1.9.0.2-7ubuntu1.1

In general, a standard system upgrade is sufficient to effect the
necessary changes.

Details follow:

Laurent Gaffie discovered that Ruby did not properly check for memory
allocation failures. If a user or automated system were tricked into
running a malicious script, an attacker could cause a denial of
service. (CVE-2008-3443)

This update also fixes a regression in the upstream patch previously
applied to fix CVE-2008-3790. The regression would cause parsing of
some XML documents to fail.

Updated packages for Ubuntu 8.10:

Source archives:

http://security.ubuntu.com/ubuntu/pool/main/r/ruby1.9/ruby1.9_1.9.0.2-7ubuntu1.1.diff.gz
Size/MD5: 49454 02828291d0b8db94d06dbc6be804b58b
http://security.ubuntu.com/ubuntu/pool/main/r/ruby1.9/ruby1.9_1.9.0.2-7ubuntu1.1.dsc
Size/MD5: 1771 5d3434eeadde20df96b78b4a959112f2
http://security.ubuntu.com/ubuntu/pool/main/r/ruby1.9/ruby1.9_1.9.0.2.orig.tar.gz
Size/MD5: 6407910 2a848b81ed1d6393b88eec8aa6173b75

Architecture independent packages:

http://security.ubuntu.com/ubuntu/pool/universe/r/ruby1.9/irb1.9_1.9.0.2-7ubuntu1.1_all.deb
Size/MD5: 57440 7c3c984736fd87485a9dfa0e8065afcc
http://security.ubuntu.com/ubuntu/pool/universe/r/ruby1.9/rdoc1.9_1.9.0.2-7ubuntu1.1_all.deb
Size/MD5: 112262 a2afb0c815463a14b51eff6199d10661
http://security.ubuntu.com/ubuntu/pool/universe/r/ruby1.9/ri1.9_1.9.0.2-7ubuntu1.1_all.deb
Size/MD5: 971786 57646618dddada4562990b3eb1c787b6
http://security.ubuntu.com/ubuntu/pool/universe/r/ruby1.9/ruby1.9-elisp_1.9.0.2-7ubuntu1.1_all.deb
Size/MD5: 31094 4e2ac93f161570ff11b5d39d5912bfce
http://security.ubuntu.com/ubuntu/pool/universe/r/ruby1.9/ruby1.9-examples_1.9.0.2-7ubuntu1.1_all.deb
Size/MD5: 64354 8a9aca7db601358141fd19d85ea45751

amd64 architecture (Athlon64, Opteron, EM64T Xeon):

i386 architecture (x86 compatible Intel/AMD):

lpia architecture (Low Power Intel Architecture):

powerpc architecture (Apple Macintosh G3/G4/G5):

sparc architecture (Sun SPARC/UltraSPARC):

-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: application/pgp-signature
Size: 197 bytes
Desc: This is a digitally signed message part
Url : https://lists.ubuntu.com/archives/ubuntu-security-announce/attachments/20081216/9f977a29/attachment-0001.pgp

------------------------------

--
ubuntu-security-announce mailing list
ubuntu-security-announce@lists.ubuntu.com
Modify settings or unsubscribe at: https://lists.ubuntu.com/mailman/listinfo/ubuntu-security-announce

End of ubuntu-security-announce Digest, Vol 51, Issue 7
*******************************************************

News

Wednesday, December 17, 2008

ubuntu-security-announce Digest, Vol 51, Issue 7

No comments:

WINDOWS CENTER

Blog Archive