USN-3439-1: Ruby vulnerabilities
First published: Thu Oct 05 2017(Updated: )
It was discovered that Ruby incorrectly handled certain inputs. An attacker could use this to cause a buffer overrun. (CVE-2017-0898) Yusuke Endoh discovered that Ruby incorrectly handled certain files. An attacker could use this to execute terminal escape sequences. (CVE-2017-0899) Yusuke Endoh discovered that Ruby incorrectly handled certain inputs. An attacker could use this to cause a denial of service. (CVE-2017-0900) It was discovered that Ruby incorrectly handled certain files. An attacker could use this to overwrite any file on the filesystem. (CVE-2017-0901) It was discovered that Ruby incorrectly handled certain inputs. An attacker could use this to execute arbitrary code. (CVE-2017-10784) It was discovered that Ruby incorrectly handled certain inputs. An attacker could use this to cause a denial of service. (CVE-2017-14033) It was discovered that Ruby incorrectly handled certain files. An attacker could use this to expose sensitive information. (CVE-2017-14064)
| Affected Software | Affected Version | How to fix |
|---|---|---|
| All of | ||
| ubuntu/libruby1.9.1 | <1.9.3.484-2ubuntu1.5 | 1.9.3.484-2ubuntu1.5 |
| Ubuntu gir1.2-packagekitglib-1.0 | =14.04 | |
| All of | ||
| ubuntu/ruby1.9.1 | <1.9.3.484-2ubuntu1.5 | 1.9.3.484-2ubuntu1.5 |
| Ubuntu gir1.2-packagekitglib-1.0 | =14.04 | |
| All of | ||
| ubuntu/ruby1.9.3 | <1.9.3.484-2ubuntu1.5 | 1.9.3.484-2ubuntu1.5 |
| Ubuntu gir1.2-packagekitglib-1.0 | =14.04 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://ubuntu.com/security/CVE-2017-0898
- https://ubuntu.com/security/CVE-2017-0899
- https://ubuntu.com/security/CVE-2017-0900
- https://ubuntu.com/security/CVE-2017-0901
- https://ubuntu.com/security/CVE-2017-10784
- https://ubuntu.com/security/CVE-2017-14033
- https://ubuntu.com/security/CVE-2017-14064
- https://ubuntu.com/security/notices/USN-3685-1
- https://ubuntu.com/security/notices/USN-3553-1
- https://ubuntu.com/security/notices/USN-3528-1
- https://launchpad.net/ubuntu/+source/ruby1.9.1/1.9.3.484-2ubuntu1.5
- https://ubuntu.com/security/notices/USN-3439-1 (Advisory)
Child vulnerabilities
(Contains the following vulnerabilities)
Frequently Asked Questions
What is the severity of CVE-2017-0898?
The severity of CVE-2017-0898 is high.
What is the severity of CVE-2017-0899?
The severity of CVE-2017-0899 is high.
How do I fix the Ruby vulnerability (CVE-2017-0898)?
To fix the Ruby vulnerability (CVE-2017-0898), you should update to version 1.9.3.484-2ubuntu1.5 of libruby1.9.1.
How do I fix the Ruby vulnerability (CVE-2017-0899)?
To fix the Ruby vulnerability (CVE-2017-0899), you should update to version 1.9.3.484-2ubuntu1.5 of ruby1.9.1.
Where can I find more information about the Ruby vulnerabilities?
You can find more information about the Ruby vulnerabilities at the following links: [CVE-2017-0898](https://ubuntu.com/security/CVE-2017-0898), [CVE-2017-0899](https://ubuntu.com/security/CVE-2017-0899), [CVE-2017-0900](https://ubuntu.com/security/CVE-2017-0900).
- agent/references
- agent/severity
- agent/type
- agent/last-modified-date
- agent/first-publish-date
- agent/weakness
- agent/title
- agent/description
- agent/event
- agent/trending
- agent/source
- agent/softwarecombine
- agent/tags
- collector/usn
- source/Ubuntu
- agent/software-canonical-lookup
- agent/software-canonical-lookup-request
- package-manager/ubuntu
- vendor/ubuntu
- canonical/ubuntu gir1.2-packagekitglib-1.0
- version/ubuntu gir1.2-packagekitglib-1.0/14.04