MGASA-2013-0092
| Date: | March 15rd, 2013 |
| Affected releases: | 2 |
| Media: | Core |
Description:
Updated ruby packages fix security vulnerability:
It was discovered that Ruby's REXML library did not properly restrict XML
entity expansion. An attacker could use this flaw to cause a denial of
service by tricking a Ruby application using REXML to read text nodes from
specially-crafted XML content, which will result in REXML consuming large
amounts of system memory (CVE-2013-1821).
Updated Packages:
i586:
ruby-tk-1.8.7.p358-1.2.mga2.i586
ruby-doc-1.8.7.p358-1.2.mga2.noarch
ruby-1.8.7.p358-1.2.mga2.i586
ruby-devel-1.8.7.p358-1.2.mga2.i586
x86_64:
ruby-tk-1.8.7.p358-1.2.mga2.x86_64
ruby-doc-1.8.7.p358-1.2.mga2.noarch
ruby-1.8.7.p358-1.2.mga2.x86_64
ruby-devel-1.8.7.p358-1.2.mga2.x86_64
SRPMS:
ruby-1.8.7.p358-1.2.mga2
References:
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-1821
http://www.ruby-lang.org/en/news/2013/02/22/rexml-dos-2013-02-22/
https://rhn.redhat.com/errata/RHSA-2013-0612.html
https://bugs.mageia.org/show_bug.cgi?id=9300
