Ubuntu 14.10 USN-2412-1 Moderate: Ruby Resource Consumption Risk

ubuntu

November 20, 2014

Ruby could be made to consume resources.

Summary

Ruby could be made to consume resources.

Software Description:

- ruby2.0: Object-oriented scripting language

- ruby2.1: Object-oriented scripting language

- ruby1.9.1: Object-oriented scripting language

- ruby1.8: Object-oriented scripting language

Details:

Tomas Hoger discovered that Ruby incorrectly handled XML entity expansion.

An attacker could use this flaw to cause Ruby to consume large amounts of

resources, resulting in a denial of service.

Topics Covered

security advisory denial of service security issue software update ubuntu ruby resource consumption

Update Instructions

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 14.10:
  libruby2.0                      2.0.0.484+really457-3ubuntu1.2
  libruby2.1                      2.1.2-2ubuntu1.2
  ruby2.0                         2.0.0.484+really457-3ubuntu1.2
  ruby2.1                         2.1.2-2ubuntu1.2

Ubuntu 14.04 LTS:
  libruby1.9.1                    1.9.3.484-2ubuntu1.2
  libruby2.0                      2.0.0.484-1ubuntu2.2
  ruby1.9.1                       1.9.3.484-2ubuntu1.2
  ruby2.0                         2.0.0.484-1ubuntu2.2

Ubuntu 12.04 LTS:
  libruby1.8                      1.8.7.352-2ubuntu1.6
  libruby1.9.1                    1.9.3.0-1ubuntu2.10
  ruby1.8                         1.8.7.352-2ubuntu1.6
  ruby1.9.1                       1.9.3.0-1ubuntu2.10

In general, a standard system update will make all the necessary changes.