Ubuntu 12.10 USN-1780-1 Critical: Ruby Denial Of Service

ubuntu

March 25, 2013

Ruby could be made to hang if it received specially crafted input.

Summary

Ruby could be made to hang if it received specially crafted input.

Software Description:

- ruby1.8: Object-oriented scripting language

- ruby1.9.1: Object-oriented scripting language

Details:

Ben Murphy discovered that the Ruby REXML library incorrectly handled XML

entity expansion. An attacker could use this flaw to cause Ruby to consume

large amounts of memory, resulting in a denial of service.

Topics Covered

security advisory denial of service ubuntu ruby input exploitation

Update Instructions

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 12.10:
  libruby1.8                      1.8.7.358-4ubuntu0.2
  libruby1.9.1                    1.9.3.194-1ubuntu1.4
  ruby1.8                         1.8.7.358-4ubuntu0.2
  ruby1.9.1                       1.9.3.194-1ubuntu1.4

Ubuntu 12.04 LTS:
  libruby1.8                      1.8.7.352-2ubuntu1.2
  libruby1.9.1                    1.9.3.0-1ubuntu2.6
  ruby1.8                         1.8.7.352-2ubuntu1.2
  ruby1.9.1                       1.9.3.0-1ubuntu2.6

Ubuntu 11.10:
  libruby1.8                      1.8.7.352-2ubuntu0.3
  ruby1.8                         1.8.7.352-2ubuntu0.3

Ubuntu 10.04 LTS:
  libruby1.8                      1.8.7.249-2ubuntu0.3
  ruby1.8                         1.8.7.249-2ubuntu0.3

In general, a standard system update will make all the necessary changes.