diff options
| author | Stanislav Sedov <stas@FreeBSD.org> | 2008-08-16 07:05:02 +0000 |
|---|---|---|
| committer | Stanislav Sedov <stas@FreeBSD.org> | 2008-08-16 07:05:02 +0000 |
| commit | a3a299464794006e870d4427be0bd87a93adfbd4 (patch) | |
| tree | d4dd90a42ad1c50a6439c4131bee9090077b4c23 /security | |
| parent | 5f43865fa95b2b5f8d1cd0a556ddf2c3c39963d1 (diff) | |
| download | ports-a3a299464794006e870d4427be0bd87a93adfbd4.tar.gz ports-a3a299464794006e870d4427be0bd87a93adfbd4.zip | |
Notes
Diffstat (limited to 'security')
| -rw-r--r-- | security/vuxml/vuln.xml | 100 |
1 files changed, 100 insertions, 0 deletions
diff --git a/security/vuxml/vuln.xml b/security/vuxml/vuln.xml index a4c159d33ab1..fec2fe525a57 100644 --- a/security/vuxml/vuln.xml +++ b/security/vuxml/vuln.xml @@ -34,6 +34,106 @@ Note: Please add new entries to the beginning of this file. --> <vuxml xmlns="http://www.vuxml.org/apps/vuxml-1"> + <vuln vid="c329712a-6b5b-11dd-9d79-001fc61c2a55"> + <topic>ruby -- multiple vulnerabilities in safe level</topic> + <affects> + <package> + <name>ruby</name> + <name>ruby+pthreads</name> + <name>ruby+pthreads+oniguruma</name> + <name>ruby+oniguruma</name> + <range><ge>1.8.*,1</ge><lt>1.8.6.287,1</lt></range> + <range><ge>1.9.*,1</ge></range> + </package> + </affects> + <description> + <body xmlns="http://www.w3.org/1999/xhtml"> + <p>The official ruby site reports:</p> + <blockquote cite="http://www.ruby-lang.org/en/news/2008/08/08/multiple-vulnerabilities-in-ruby/"> + <p>Several vulnerabilities in safe level have been discovereds:.</p> + <ul> + <li>untrace_var is permitted at safe level 4;</li> + <li>$PROGRAM_NAME may be modified at safe level 4;</li> + <li>insecure methods may be called at safe level 1-3;</li> + <li>syslog operations are permitted at safe level 4;</li> + <li>dl doesn't check taintness, so it could allow attackers + to call dangerous functions.</li> + </ul> + </blockquote> + </body> + </description> + <references> + <url>http://www.ruby-lang.org/en/news/2008/08/08/multiple-vulnerabilities-in-ruby/</url> + </references> + <dates> + <discovery>2008-08-08</discovery> + <entry>2008-08-16</entry> + </dates> + </vuln> + + <vuln vid="f7ba20aa-6b5a-11dd-9d79-001fc61c2a55"> + <topic>ruby -- DoS vulnerability in WEBrick</topic> + <affects> + <package> + <name>ruby</name> + <name>ruby+pthreads</name> + <name>ruby+pthreads+oniguruma</name> + <name>ruby+oniguruma</name> + <range><ge>1.8.*,1</ge><lt>1.8.6.111_5,1</lt></range> + <range><ge>1.9.*,1</ge></range> + </package> + </affects> + <description> + <body xmlns="http://www.w3.org/1999/xhtml"> + <p>The official ruby site reports:</p> + <blockquote cite="http://www.ruby-lang.org/en/news/2008/08/08/multiple-vulnerabilities-in-ruby/"> + <p>WEBrick::HTTP::DefaultFileHandler is faulty of exponential time + taking requests due to a backtracking regular expression in + WEBrick::HTTPUtils.split_header_value.</p> + </blockquote> + </body> + </description> + <references> + <url>http://www.ruby-lang.org/en/news/2008/08/08/multiple-vulnerabilities-in-ruby/</url> + </references> + <dates> + <discovery>2008-08-08</discovery> + <entry>2008-08-16</entry> + </dates> + </vuln> + + <vuln vid="959d384d-6b59-11dd-9d79-001fc61c2a55"> + <topic>ruby -- DNS spoofing vulnerability</topic> + <affects> + <package> + <name>ruby</name> + <name>ruby+pthreads</name> + <name>ruby+pthreads+oniguruma</name> + <name>ruby+oniguruma</name> + <range><ge>1.8.*,1</ge><lt>1.8.6.111_5,1</lt></range> + <range><ge>1.9.*,1</ge></range> + </package> + </affects> + <description> + <body xmlns="http://www.w3.org/1999/xhtml"> + <p>The official ruby site reports:</p> + <blockquote cite="http://www.ruby-lang.org/en/news/2008/08/08/multiple-vulnerabilities-in-ruby/"> + <p>resolv.rb allow remote attackers to spoof DNS answers. This risk + can be reduced by randomness of DNS transaction IDs and source + ports.</p> + </blockquote> + </body> + </description> + <references> + <cvename>CVE-2008-1447</cvename> + <url>http://www.ruby-lang.org/en/news/2008/08/08/multiple-vulnerabilities-in-ruby/</url> + </references> + <dates> + <discovery>2008-08-08</discovery> + <entry>2008-08-16</entry> + </dates> + </vuln> + <vuln vid="1d96305d-6ae6-11dd-91d5-000c29d47fd7"> <topic>Bugzilla -- Directory Traversal in importxml.pl</topic> <affects> |