UbuntuUpdates.org

Package "libruby1.9.1"

Name: libruby1.9.1

Description:

Libraries necessary to run Ruby 1.9.1

Latest version: 1.9.3.484-2ubuntu1.14
Release: trusty (14.04)
Level: security
Repository: main
Head package: ruby1.9.1
Homepage: http://www.ruby-lang.org/

Links


Download "libruby1.9.1"


Other versions of "libruby1.9.1" in Trusty

Repository Area Version
base main 1.9.3.484-2ubuntu1
updates main 1.9.3.484-2ubuntu1.14
PPA: Brightbox Ruby NG Experimental 1:1.9.3.551-557bbox8~trusty1

Changelog

Version: 1.9.3.484-2ubuntu1.14 2019-04-11 15:07:21 UTC

  ruby1.9.1 (1.9.3.484-2ubuntu1.14) trusty-security; urgency=medium

  * SECURITY UPDATE: Delete directory using symlink when decompressing tar,
    Escape sequence injection vulnerability in gem owner, Escape sequence
    injection vulnerability in API response handling, Arbitrary code exec,
    Escape sequence injection vulnerability in errors
    - debian/patches/CVE-2019-8320-25.patch: fix in
      lib/rubygems/command_manager.rb,
      lib/rubygems/commands/owner_command.rb,
      lib/rubygems/gemcutter_utilities.rb,
      lib/rubygems/installer.rb,
      lib/rubygems/package.rb,
      test/rubygems/test_gem_installer.rb,
      test/rubygems/test_gem_package.rb,
      test/rubygems/test_gem_text.rb.
    - CVE-2019-8320
    - CVE-2019-8321
    - CVE-2019-8322
    - CVE-2019-8323
    - CVE-2019-8324
    - CVE-2019-8325
  * Fixing expired certification that causes tests to fail
    - debian/patches/fixing_expired_SSL_certificates.patch: updating certs in
      test/net/imap/cacert.pen, test/net/imap/server.crt,
      test/net/imap/server.key.

 -- <email address hidden> (Leonidas S. Barbosa) Fri, 29 Mar 2019 14:46:36 -0300

Source diff to previous version
CVE-2019-8320 RESERVED
CVE-2019-8321 Escape sequence injection vulnerability in verbose
CVE-2019-8322 Escape sequence injection vulnerability in gem owner
CVE-2019-8323 Escape sequence injection vulnerability in API response handling
CVE-2019-8324 Installing a malicious gem may lead to arbitrary code execution
CVE-2019-8325 Escape sequence injection vulnerability in errors

Version: 1.9.3.484-2ubuntu1.13 2018-11-05 20:06:54 UTC

  ruby1.9.1 (1.9.3.484-2ubuntu1.13) trusty-security; urgency=medium

  * SECURITY UPDATE: Name equality check
    - debian/patches/CVE-2018-16395.patch: fix in
      ext/openssl/ossl_x509name.c.
    - CVE-2018-16395
  * SECURITY UPDATE: Tainted flags not propagted
    - debian/patches/CVE-2018-16396.patch: fix in
      pack.c, test/ruby/test_pack.rb.
    - CVE-2018-16396
  * Incresing maximum test failures to 39 since some tests that
    failed are related to timezone and tzdata changes.
    - debian/run-test-suites.bash.

 -- <email address hidden> (Leonidas S. Barbosa) Thu, 01 Nov 2018 08:35:26 -0300

Source diff to previous version
CVE-2018-16395 RESERVED
CVE-2018-16396 RESERVED

Version: 1.9.3.484-2ubuntu1.12 2018-06-14 14:07:51 UTC

  ruby1.9.1 (1.9.3.484-2ubuntu1.12) trusty-security; urgency=medium

  * SECURITY UPDATE: Response splitting attack
    - debian/patches/CVE-2017-17742*.patch: fix in webrick/httpresponse.rb,
      test/webrick/test_httpresponse.rb.
    - CVE-2017-17742
  * SECURITY UPDATE: Denial of service
    - debian/patches/CVE-2018-8777*.patch: fix in lib/webrick/httpresponse.rb,
      lib/webrick/httpservlet/filehandler.rb,
      test/webrick/test_filehandler.rb, test/webrick/test_httpresponse.rb.
    - CVE-2018-8777

 -- <email address hidden> (Leonidas S. Barbosa) Thu, 07 Jun 2018 09:15:34 -0300

Source diff to previous version
CVE-2017-17742 Ruby before 2.2.10, 2.3.x before 2.3.7, 2.4.x before 2.4.4, 2.5.x before 2.5.1, and 2.6.0-preview1 allows an HTTP Response Splitting attack. An attac
CVE-2018-8777 In Ruby before 2.2.10, 2.3.x before 2.3.7, 2.4.x before 2.4.4, 2.5.x before 2.5.1, and 2.6.0-preview1, an attacker can pass a large HTTP request with

Version: 1.9.3.484-2ubuntu1.11 2018-04-16 19:06:54 UTC

  ruby1.9.1 (1.9.3.484-2ubuntu1.11) trusty-security; urgency=medium

  * SECURITY UPDATE: Directory traversal vulnerability
    - debian/patches/CVE-2018-6914.patch: fix in lib/tmpdir.rb,
      test/test_tempfile.rb.
    - CVE-2018-6914
  * SECURITY UPDATE: Buffer under-read
    - debian/patches/CVE-2018-8778.patch: fix in pack.c,
      test/ruby/test_pack.rb.
    - CVE-2018-8778
  * SECURITY UPDATE: Unintended socket
    - debian/patches/CVE-2018-8779.patch: fix in ext/socket/unixsocket.c,
      test/socket/test_unix.rb.
    - CVE-2018-8779
  * SECURITY UPDATE: Directory traversal
    - debian/patches/CVE-2018-8780.patch: fix in dir.c,
      test/ruby/test_dir.rb.
    - CVE-2018-8780

 -- <email address hidden> (Leonidas S. Barbosa) Mon, 16 Apr 2018 10:52:29 -0300

Source diff to previous version
CVE-2018-6914 Directory traversal vulnerability in the Dir.mktmpdir method in the tmpdir library in Ruby before 2.2.10, 2.3.x before 2.3.7, 2.4.x before 2.4.4, 2.5
CVE-2018-8778 In Ruby before 2.2.10, 2.3.x before 2.3.7, 2.4.x before 2.4.4, 2.5.x before 2.5.1, and 2.6.0-preview1, an attacker controlling the unpacking format (
CVE-2018-8779 In Ruby before 2.2.10, 2.3.x before 2.3.7, 2.4.x before 2.4.4, 2.5.x before 2.5.1, and 2.6.0-preview1, the UNIXServer.open and UNIXSocket.open method
CVE-2018-8780 In Ruby before 2.2.10, 2.3.x before 2.3.7, 2.4.x before 2.4.4, 2.5.x before 2.5.1, and 2.6.0-preview1, the Dir.open, Dir.new, Dir.entries and Dir.emp

Version: 1.9.3.484-2ubuntu1.10 2018-04-13 18:06:45 UTC

  ruby1.9.1 (1.9.3.484-2ubuntu1.10) trusty-security; urgency=medium

  * SECURITY REGRESSION: The fix for CVE-2018-1000074 was incomplete
    and will be addressed in a future update.

 -- <email address hidden> (Leonidas S. Barbosa) Fri, 13 Apr 2018 09:53:54 -0300




About   -   Send Feedback to @ubuntu_updates