USN-3553-1: Ruby vulnerabilities
USN-3553-1: Ruby vulnerabilities Ubuntu Security Notice USN-3553-1 31st January, 2018 ruby2.3 vulnerabilities A security issue affects these releases of Ubuntu and its derivatives: Ubuntu 17.10 Ubuntu 16.04 LTS Summary Several security issues were fixed in Ruby. Software description ruby2.3 – Interpreter of object-oriented scripting language Ruby Details It was discovered that Ruby failed to validate specification names.An attacker could possibly use a maliciously crafted gem to potentiallyoverwrite any file on the filesystem. (CVE-2017-0901) It was discovered that Ruby was vulnerable to a DNS hijacking vulnerability.An attacker could use this to possibly force the RubyGems client to downloadand install gems from a server that the attacker controls. (CVE-2017-0902) It was discovered that Ruby incorrectly handled certain YAML files. An attacker coulduse this to possibly execute arbitrary code. (CVE-2017-0903) Update instructions The problem can be corrected by updating your system to the [ more… ]
