[ GLSA 201412-27 ] Ruby: Denial of Service

[GLSA]

Gentoo Linux Security Advisory

Title: Ruby: Denial of Service (GLSA 201412-27)
Severity: normal
Exploitable: local, remote
Date: December 13, 2014
Bug(s): #355439, #369141, #396301, #437366, #442580, #458776, #492282, #527084, #529216
ID: 201412-27

Synopsis

Multiple vulnerabilities have been found in Ruby, allowing
context-dependent attackers to cause a Denial of Service condition.


Background

Ruby is an object-oriented scripting language.

Affected Packages

Package: dev-lang/ruby
Vulnerable: < 2.0.0_p598
Unaffected: >= 1.9.3_p551 < 1.9.4
Unaffected: >= 2.0.0_p598
Architectures: All supported architectures


Description

Multiple vulnerabilities have been discovered in Ruby. Please review the
CVE identifiers referenced below for details.


Impact

A context-dependent attacker could possibly execute arbitrary code with
the privileges of the process, cause a Denial of Service condition, or
bypass security restrictions.


Workaround

There is no known workaround at this time.

Resolution

All Ruby 1.9 users should upgrade to the latest version: