USN-7091-1: Ruby vulnerabilities
It was discovered that Ruby incorrectly handled parsing of an XML document that has specific XML characters in an attribute value using REXML gem. An attacker could use this issue to cause Ruby to crash, resulting in a denial of service. This issue only affected in Ubuntu 22.04 LTS and Ubuntu 24.04 LTS. (CVE-2024-35176, CVE-2024-39908, CVE-2024-41123) It was discovered that Ruby incorrectly handled parsing of an XML document that has many entity expansions with SAX2 or pull parser API. An attacker could use this issue to cause Ruby to crash, resulting in a denial of service. (CVE-2024-41946) It was discovered that Ruby incorrectly handled parsing of an XML document that has many digits in a hex numeric character reference. An attacker could use this issue to cause Ruby to crash, resulting in a denial of service. (CVE-2024-49761)
Affected Software
Event History
Child vulnerabilities
Contains the following vulnerabilities.
Frequently Asked Questions
What is the severity of USN-7091-1?
The severity of USN-7091-1 is categorized as a denial of service vulnerability affecting Ruby in specific Ubuntu versions.
How do I fix USN-7091-1?
To fix USN-7091-1, update the Ruby packages to the recommended versions for your Ubuntu installation.
What versions of Ubuntu are affected by USN-7091-1?
USN-7091-1 affects Ubuntu 22.04 LTS and Ubuntu 24.04 LTS.
What component of Ruby is affected by USN-7091-1?
USN-7091-1 affects the REXML gem used in Ruby for XML document parsing.
Can USN-7091-1 lead to a complete system compromise?
USN-7091-1 specifically leads to denial of service, not a complete system compromise.