| Descripción: | Summary:
The remote host is missing an update for the 'ruby'
package(s) announced via the referenced advisory.
Vulnerability Insight:
Multiple vulnerabilities have been identified and fixed in ruby:
Cross-site scripting (XSS) vulnerability in the WEBrick HTTP server
in Ruby allows remote attackers to inject arbitrary web script or HTML
via a crafted URI that triggers a UTF-7 error page (CVE-2010-0541).
The FileUtils.remove_entry_secure method in Ruby allows local users
to delete arbitrary files via a symlink attack (CVE-2011-1004).
The safe-level feature in Ruby allows context-dependent attackers
to modify strings via the Exception#to_s method, as demonstrated by
changing an intended pathname (CVE-2011-1005).
The VpMemAlloc function in bigdecimal.c in the BigDecimal class in
Ruby does not properly allocate memory, which allows context-dependent
attackers to execute arbitrary code or cause a denial of service
(application crash) via vectors involving creation of a large
BigDecimal value within a 64-bit process, related to an integer
truncation issue. (CVE-2011-0188).
Packages for 2009.0 are provided as of the Extended Maintenance
Program. The updated packages have been patched to correct this issue.
Affected Software/OS:
ruby on Mandriva Linux 2009.0,
Mandriva Linux 2009.0/X86_64,
Mandriva Linux 2010.1,
Mandriva Linux 2010.1/X86_64,
Mandriva Enterprise Server 5,
Mandriva Enterprise Server 5/X86_64
Solution:
Please Install the Updated Packages.
CVSS Score:
6.8
CVSS Vector:
AV:N/AC:M/Au:N/C:P/I:P/A:P
|
