Overly broad permissions can turn one compromised account into a much larger security problem. Learn how to reduce unnecessary access, review privileges, and apply least privilege across modern Linux systems. Review Linux Privileges×

Alerts This Week
Warning Icon 1 544
Alerts This Week
Warning Icon 1 544

Ubuntu 14.04 LTS USN-3621-2: Critical Ruby Regression Issues

ubuntu
Calendar Grey April 13, 2018
Scroller Ubuntu
Vulnerabilities identified in Ubuntu's Ruby framework may result in operational setbacks. Here are the upgrade guidelines for ruby1.9.1 and ruby2.0 that must be followed.
USN-3621-1 caused a regression in Ruby.

Summary

USN-3621-1 caused a regression in Ruby.

Software Description:

- ruby1.9.1: Object-oriented scripting language

- ruby2.0: Object-oriented scripting language

Details:

USN-3621-1 fixed vulnerabilities in Ruby. The update caused an issue

due to an incomplete patch for CVE-2018-1000074. This update reverts

the problematic patch pending further investigation.

We apologize for the inconvenience.

Original advisory details:

 It was discovered that Ruby incorrectly handled certain inputs. An

 attacker could possibly use this to access sensitive information.

 (CVE-2018-1000073)

 It was discovered that Ruby incorrectly handled certain files. An

 attacker could possibly use this to execute arbitrary code. 

 (CVE-2018-1000074)

 It was discovered that Ruby incorrectly handled certain files. An

 attacker could possibly use this to cause a denial of service. 

 (CVE-2018-1000075)

 It was discovered that Ruby incorrectly handled certain crypto

 sign...

Read the Full Advisory

Topics%20covered

Topics Covered

security advisory software update code execution DoS Ubuntu regression Ruby

Update Instructions

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 14.04 LTS:
  libruby1.9.1                    1.9.3.484-2ubuntu1.10
  libruby2.0                      2.0.0.484-1ubuntu2.8
  ruby1.9.1                       1.9.3.484-2ubuntu1.10
  ruby1.9.3                       1.9.3.484-2ubuntu1.10
  ruby2.0                         2.0.0.484-1ubuntu2.8

In general, a standard system update will make all the necessary
changes.

References

  https://ubuntu.com/security/notices/USN-3621-2

  https://ubuntu.com/security/notices/USN-3621-1

  CVE-2018-1000074

Severity
critical
Lowest
Low
Medium
High
Critical

April 13, 2018

Topics%20covered

Topics Covered

security advisory software update code execution DoS Ubuntu regression Ruby

Package Information

  https://launchpad.net/ubuntu/+source/ruby1.9.1/1.9.3.484-2ubuntu1.10
  https://launchpad.net/ubuntu/+source/ruby2.0/2.0.0.484-1ubuntu2.8

Get the latest News and Insights

Get the latest Linux and open source security news straight to your inbox.