Executive Summary
Summary | |
---|---|
Title | ruby2.3 security update |
Informations | |||
---|---|---|---|
Name | DSA-4031 | First vendor Publication | 2017-11-11 |
Vendor | Debian | Last vendor Modification | 2017-11-11 |
Severity (Vendor) | N/A | Revision | 1 |
Security-Database Scoring CVSS v3
Cvss vector : N/A | |||
---|---|---|---|
Overall CVSS Score | NA | ||
Base Score | NA | Environmental Score | NA |
impact SubScore | NA | Temporal Score | NA |
Exploitabality Sub Score | NA | ||
Calculate full CVSS 3.0 Vectors scores |
Security-Database Scoring CVSS v2
Cvss vector : (AV:N/AC:M/Au:N/C:C/I:C/A:C) | |||
---|---|---|---|
Cvss Base Score | 9.3 | Attack Range | Network |
Cvss Impact Score | 10 | Attack Complexity | Medium |
Cvss Expoit Score | 8.6 | Authentication | None Required |
Calculate full CVSS 2.0 Vectors scores |
Detail
Several vulnerabilities have been discovered in the interpreter for the Ruby language. The Common Vulnerabilities and Exposures project identifies the following problems: CVE-2017-0898 aerodudrizzt reported a buffer underrun vulnerability in the sprintf method of the Kernel module resulting in heap memory corruption or information disclosure from the heap. CVE-2017-0903 Max Justicz reported that RubyGems is prone to an unsafe object deserialization vulnerability. When parsed by an application which processes gems, a specially crafted YAML formatted gem specification can lead to remote code execution. CVE-2017-10784 Yusuke Endoh discovered an escape sequence injection vulnerability in the Basic authentication of WEBrick. An attacker can take advantage of this flaw to inject malicious escape sequences to the WEBrick log and potentially execute control characters on the victim's terminal emulator when reading logs. CVE-2017-14033 asac reported a buffer underrun vulnerability in the OpenSSL extension. A remote attacker can take advantage of this flaw to cause the Ruby interpreter to crash leading to a denial of service. For the stable distribution (stretch), these problems have been fixed in version 2.3.3-1+deb9u2. We recommend that you upgrade your ruby2.3 packages. |
Original Source
Url : http://www.debian.org/security/2017/dsa-4031 |
CWE : Common Weakness Enumeration
% | Id | Name |
---|---|---|
25 % | CWE-502 | Deserialization of Untrusted Data |
25 % | CWE-287 | Improper Authentication |
25 % | CWE-134 | Uncontrolled Format String (CWE/SANS Top 25) |
25 % | CWE-119 | Failure to Constrain Operations within the Bounds of a Memory Buffer |
CPE : Common Platform Enumeration
Nessus® Vulnerability Scanner
Date | Description |
---|---|
2018-10-31 | Name : The remote host is missing a macOS or Mac OS X security update that fixes mul... File : macosx_SecUpd2018-005.nasl - Type : ACT_GATHER_INFO |
2018-09-18 | Name : The remote EulerOS Virtualization host is missing multiple security updates. File : EulerOS_SA-2018-1248.nasl - Type : ACT_GATHER_INFO |
2018-08-17 | Name : The remote PhotonOS host is missing multiple security updates. File : PhotonOS_PHSA-2017-0037.nasl - Type : ACT_GATHER_INFO |
2018-07-17 | Name : The remote host is missing a macOS or Mac OS X security update that fixes mul... File : macosx_SecUpd2018-004.nasl - Type : ACT_GATHER_INFO |
2018-07-17 | Name : The remote host is missing a macOS update that fixes multiple security vulner... File : macos_10_13_6.nasl - Type : ACT_GATHER_INFO |
2018-07-16 | Name : The remote Debian host is missing a security update. File : debian_DLA-1421.nasl - Type : ACT_GATHER_INFO |
2018-03-27 | Name : The remote Amazon Linux AMI host is missing a security update. File : ala_ALAS-2018-978.nasl - Type : ACT_GATHER_INFO |
2018-03-20 | Name : The remote EulerOS host is missing multiple security updates. File : EulerOS_SA-2018-1067.nasl - Type : ACT_GATHER_INFO |
2018-03-20 | Name : The remote EulerOS host is missing multiple security updates. File : EulerOS_SA-2018-1066.nasl - Type : ACT_GATHER_INFO |
2018-03-12 | Name : The remote CentOS host is missing one or more security updates. File : centos_RHSA-2018-0378.nasl - Type : ACT_GATHER_INFO |
2018-01-24 | Name : The remote Fedora host is missing a security update. File : fedora_2018-75e780a7c2.nasl - Type : ACT_GATHER_INFO |
2018-01-15 | Name : The remote Fedora host is missing a security update. File : fedora_2017-4166994614.nasl - Type : ACT_GATHER_INFO |
2017-11-13 | Name : The remote Debian host is missing a security-related update. File : debian_DSA-4031.nasl - Type : ACT_GATHER_INFO |
2017-10-27 | Name : The remote Amazon Linux AMI host is missing a security update. File : ala_ALAS-2017-915.nasl - Type : ACT_GATHER_INFO |
2017-10-18 | Name : The remote Gentoo host is missing one or more security-related patches. File : gentoo_GLSA-201710-18.nasl - Type : ACT_GATHER_INFO |
2017-10-11 | Name : The remote FreeBSD host is missing one or more security-related updates. File : freebsd_pkg_2c8bd00dada211e782af8dbff7d75206.nasl - Type : ACT_GATHER_INFO |
2017-10-06 | Name : The remote Ubuntu host is missing one or more security-related patches. File : ubuntu_USN-3439-1.nasl - Type : ACT_GATHER_INFO |
2017-10-03 | Name : The remote Amazon Linux AMI host is missing a security update. File : ala_ALAS-2017-906.nasl - Type : ACT_GATHER_INFO |
2017-09-27 | Name : The remote Debian host is missing a security update. File : debian_DLA-1114.nasl - Type : ACT_GATHER_INFO |
2017-09-27 | Name : The remote Debian host is missing a security update. File : debian_DLA-1113.nasl - Type : ACT_GATHER_INFO |
2017-09-20 | Name : The remote FreeBSD host is missing one or more security-related updates. File : freebsd_pkg_95b013799d5211e7a25c471bafc3262f.nasl - Type : ACT_GATHER_INFO |
2017-09-19 | Name : The remote Slackware host is missing a security update. File : Slackware_SSA_2017-261-03.nasl - Type : ACT_GATHER_INFO |
Alert History
Date | Informations |
---|---|
2017-11-14 13:24:55 |
|
2017-11-11 17:23:30 |
|