6.8 - RHSA-2009:1140

Executive Summary

This Alert is flagged as TOP 25 Common Weakness Enumeration from CWE/SANS. For more information, you can read this.

Summary
Title	ruby security update

Informations
Name	RHSA-2009:1140	First vendor Publication	2009-07-02
Vendor	RedHat	Last vendor Modification	2009-07-02
Severity (Vendor)	Moderate	Revision	02

Security-Database Scoring CVSS v3

Cvss vector : N/A
Overall CVSS Score	NA
Base Score	NA	Environmental Score	NA
impact SubScore	NA	Temporal Score	NA
Exploitabality Sub Score	NA

Calculate full CVSS 3.0 Vectors scores

Security-Database Scoring CVSS v2

Cvss vector : (AV:N/AC:M/Au:N/C:P/I:P/A:P)
Cvss Base Score	6.8	Attack Range	Network
Cvss Impact Score	6.4	Attack Complexity	Medium
Cvss Expoit Score	8.6	Authentication	None Required
Calculate full CVSS 2.0 Vectors scores

Detail

Problem Description:

Updated ruby packages that fix multiple security issues are now available for Red Hat Enterprise Linux 4 and 5.

This update has been rated as having moderate security impact by the Red Hat Security Response Team.

2. Relevant releases/architectures:

Red Hat Enterprise Linux AS version 4 - i386, ia64, ppc, s390, s390x, x86_64 Red Hat Enterprise Linux Desktop version 4 - i386, x86_64 Red Hat Enterprise Linux ES version 4 - i386, ia64, x86_64 Red Hat Enterprise Linux WS version 4 - i386, ia64, x86_64 Red Hat Enterprise Linux Desktop (v. 5 client) - i386, x86_64 RHEL Desktop Workstation (v. 5 client) - i386, x86_64 Red Hat Enterprise Linux (v. 5 server) - i386, ia64, ppc, s390x, x86_64

3. Description:

Ruby is an extensible, interpreted, object-oriented, scripting language. It has features to process text files and to do system management tasks.

A flaw was found in the way the Ruby POP module processed certain APOP authentication requests. By sending certain responses when the Ruby APOP module attempted to authenticate using APOP against a POP server, a remote attacker could, potentially, acquire certain portions of a user's authentication credentials. (CVE-2007-1558)

It was discovered that Ruby did not properly check the return value when verifying X.509 certificates. This could, potentially, allow a remote attacker to present an invalid X.509 certificate, and have Ruby treat it as valid. (CVE-2009-0642)

A flaw was found in the way Ruby converted BigDecimal objects to Float numbers. If an attacker were able to provide certain input for the BigDecimal object converter, they could crash an application using this class. (CVE-2009-1904)

All Ruby users should upgrade to these updated packages, which contain backported patches to resolve these issues.

4. Solution:

Before applying this update, make sure that all previously-released errata relevant to your system have been applied.

This update is available via Red Hat Network. Details on how to use the Red Hat Network to apply this update are available at http://kbase.redhat.com/faq/docs/DOC-11259

5. Bugs fixed (http://bugzilla.redhat.com/):

241191 - CVE-2007-1558 fetchmail/mutt/evolution/...: APOP password disclosure vulnerability 486183 - CVE-2009-0642 ruby: Incorrect checks for validity of X.509 certificates 504958 - CVE-2009-1904 ruby: DoS vulnerability in BigDecimal

Original Source

Url : https://rhn.redhat.com/errata/RHSA-2009-1140.html

CWE : Common Weakness Enumeration

%	Id	Name
50 %	CWE-287	Improper Authentication
50 %	CWE-189	Numeric Errors (CWE/SANS Top 25)

OVAL Definitions

Definition Id: oval:org.mitre.oval:def:11450

Oval ID:	oval:org.mitre.oval:def:11450
Title:	ext/openssl/ossl_ocsp.c in Ruby 1.8 and 1.9 does not properly check the return value from the OCSP_basic_verify function, which might allow remote attackers to successfully present an invalid X.509 certificate, possibly involving a revoked certificate.
Description:	ext/openssl/ossl_ocsp.c in Ruby 1.8 and 1.9 does not properly check the return value from the OCSP_basic_verify function, which might allow remote attackers to successfully present an invalid X.509 certificate, possibly involving a revoked certificate.
Family:	unix	Class:	vulnerability
Reference(s):	CVE-2009-0642	Version:	5
Platform(s):	Red Hat Enterprise Linux 4 CentOS Linux 4 Oracle Linux 4 Red Hat Enterprise Linux 5 CentOS Linux 5 Oracle Linux 5	Product(s):
Definition Synopsis:
OS Section: RHEL4, CentOS4, Oracle Linux 4 RHEL4, CentOS4 or Oracle Linux 4 The operating system installed on the system is Red Hat Enterprise Linux 4 AND CentOS Linux 4.x AND Oracle Linux 4.x AND Configuration section ruby-mode is earlier than 0:1.8.1-7.el4_8.3 AND ruby-docs is earlier than 0:1.8.1-7.el4_8.3 AND ruby-devel is earlier than 0:1.8.1-7.el4_8.3 AND ruby-tcltk is earlier than 0:1.8.1-7.el4_8.3 AND ruby is earlier than 0:1.8.1-7.el4_8.3 AND irb is earlier than 0:1.8.1-7.el4_8.3 AND ruby-libs is earlier than 0:1.8.1-7.el4_8.3 OR OS Section: RHEL5, CentOS5, Oracle Linux 5 RHEL5, CentOS5 or Oracle Linux 5 The operating system installed on the system is Red Hat Enterprise Linux 5 AND CentOS Linux 5.x AND Oracle Linux 5.x AND Configuration section ruby-ri is earlier than 0:1.8.5-5.el5_3.7 AND ruby-mode is earlier than 0:1.8.5-5.el5_3.7 AND ruby-docs is earlier than 0:1.8.5-5.el5_3.7 AND ruby-devel is earlier than 0:1.8.5-5.el5_3.7 AND ruby is earlier than 0:1.8.5-5.el5_3.7 AND ruby-libs is earlier than 0:1.8.5-5.el5_3.7 AND ruby-tcltk is earlier than 0:1.8.5-5.el5_3.7 AND ruby-irb is earlier than 0:1.8.5-5.el5_3.7 AND ruby-rdoc is earlier than 0:1.8.5-5.el5_3.7

Definition Id: oval:org.mitre.oval:def:13411

Oval ID:	oval:org.mitre.oval:def:13411
Title:	USN-805-1 -- ruby1.8, ruby1.9 vulnerabilities
Description:	It was discovered that Ruby did not properly validate certificates. An attacker could exploit this and present invalid or revoked X.509 certificates. It was discovered that Ruby did not properly handle string arguments that represent large numbers. An attacker could exploit this and cause a denial of service
Family:	unix	Class:	patch
Reference(s):	USN-805-1 CVE-2009-0642 CVE-2009-1904	Version:	5
Platform(s):	Ubuntu 8.04 Ubuntu 9.04 Ubuntu 6.06 Ubuntu 8.10	Product(s):	ruby1.8 ruby1.9
Definition Synopsis:
Release section Ubuntu 8.04 is installed AND Architecture section Architecture independent section Installed architecture is all AND Packages section rdoc1.8 DPKG is earlier than 1.8.6.111-2ubuntu1.3 AND ri1.8 DPKG is earlier than 1.8.6.111-2ubuntu1.3 AND ruby1.8-elisp DPKG is earlier than 1.8.6.111-2ubuntu1.3 AND ruby1.8-examples DPKG is earlier than 1.8.6.111-2ubuntu1.3 AND irb1.8 DPKG is earlier than 1.8.6.111-2ubuntu1.3 OR Architecture depended section Supported architectures section Installed architecture is amd64 AND Installed architecture is i386 AND Installed architecture is powerpc AND Installed architecture is sparc AND Installed architecture is lpia AND Packages section ruby1.8 DPKG is earlier than 1.8.6.111-2ubuntu1.3 AND libdbm-ruby1.8 DPKG is earlier than 1.8.6.111-2ubuntu1.3 AND libopenssl-ruby1.8 DPKG is earlier than 1.8.6.111-2ubuntu1.3 AND ruby1.8-dev DPKG is earlier than 1.8.6.111-2ubuntu1.3 AND libreadline-ruby1.8 DPKG is earlier than 1.8.6.111-2ubuntu1.3 AND libgdbm-ruby1.8 DPKG is earlier than 1.8.6.111-2ubuntu1.3 AND libtcltk-ruby1.8 DPKG is earlier than 1.8.6.111-2ubuntu1.3 AND libruby1.8-dbg DPKG is earlier than 1.8.6.111-2ubuntu1.3 AND libruby1.8 DPKG is earlier than 1.8.6.111-2ubuntu1.3 OR Release section Ubuntu 9.04 is installed AND Architecture section Architecture independent section Installed architecture is all AND Packages section rdoc1.8 DPKG is earlier than 1.8.7.72-3ubuntu0.1 AND rdoc1.9 DPKG is earlier than 1.9.0.2-9ubuntu1.1 AND ri1.9 DPKG is earlier than 1.9.0.2-9ubuntu1.1 AND ri1.8 DPKG is earlier than 1.8.7.72-3ubuntu0.1 AND ruby1.8-examples DPKG is earlier than 1.8.7.72-3ubuntu0.1 AND ruby1.9-elisp DPKG is earlier than 1.9.0.2-9ubuntu1.1 AND ruby1.9-examples DPKG is earlier than 1.9.0.2-9ubuntu1.1 AND ruby1.8-elisp DPKG is earlier than 1.8.7.72-3ubuntu0.1 AND irb1.8 DPKG is earlier than 1.8.7.72-3ubuntu0.1 AND irb1.9 DPKG is earlier than 1.9.0.2-9ubuntu1.1 OR Architecture depended section Supported architectures section Installed architecture is amd64 AND Installed architecture is i386 AND Installed architecture is powerpc AND Installed architecture is sparc AND Installed architecture is lpia AND Packages section libreadline-ruby1.8 DPKG is earlier than 1.8.7.72-3ubuntu0.1 AND libdbm-ruby1.8 DPKG is earlier than 1.8.7.72-3ubuntu0.1 AND ruby1.9-dev DPKG is earlier than 1.9.0.2-9ubuntu1.1 AND libopenssl-ruby1.9 DPKG is earlier than 1.9.0.2-9ubuntu1.1 AND libopenssl-ruby1.8 DPKG is earlier than 1.8.7.72-3ubuntu0.1 AND ruby1.8-dev DPKG is earlier than 1.8.7.72-3ubuntu0.1 AND libtcltk-ruby1.9 DPKG is earlier than 1.9.0.2-9ubuntu1.1 AND ruby1.8 DPKG is earlier than 1.8.7.72-3ubuntu0.1 AND libreadline-ruby1.9 DPKG is earlier than 1.9.0.2-9ubuntu1.1 AND ruby1.9 DPKG is earlier than 1.9.0.2-9ubuntu1.1 AND libruby1.9-dbg DPKG is earlier than 1.9.0.2-9ubuntu1.1 AND libgdbm-ruby1.9 DPKG is earlier than 1.9.0.2-9ubuntu1.1 AND libgdbm-ruby1.8 DPKG is earlier than 1.8.7.72-3ubuntu0.1 AND libtcltk-ruby1.8 DPKG is earlier than 1.8.7.72-3ubuntu0.1 AND libdbm-ruby1.9 DPKG is earlier than 1.9.0.2-9ubuntu1.1 AND libruby1.8-dbg DPKG is earlier than 1.8.7.72-3ubuntu0.1 AND libruby1.8 DPKG is earlier than 1.8.7.72-3ubuntu0.1 AND libruby1.9 DPKG is earlier than 1.9.0.2-9ubuntu1.1 OR Release section Ubuntu 6.06 is installed AND Architecture section Architecture independent section Installed architecture is all AND Packages section rdoc1.8 DPKG is earlier than 1.8.4-1ubuntu1.7 AND ri1.8 DPKG is earlier than 1.8.4-1ubuntu1.7 AND ruby1.8-elisp DPKG is earlier than 1.8.4-1ubuntu1.7 AND ruby1.8-examples DPKG is earlier than 1.8.4-1ubuntu1.7 AND irb1.8 DPKG is earlier than 1.8.4-1ubuntu1.7 OR Architecture depended section Supported architectures section Installed architecture is sparc AND Installed architecture is powerpc AND Installed architecture is amd64 AND Installed architecture is i386 AND Packages section libreadline-ruby1.8 DPKG is earlier than 1.8.4-1ubuntu1.7 AND libdbm-ruby1.8 DPKG is earlier than 1.8.4-1ubuntu1.7 AND libopenssl-ruby1.8 DPKG is earlier than 1.8.4-1ubuntu1.7 AND ruby1.8-dev DPKG is earlier than 1.8.4-1ubuntu1.7 AND ruby1.8 DPKG is earlier than 1.8.4-1ubuntu1.7 AND libgdbm-ruby1.8 DPKG is earlier than 1.8.4-1ubuntu1.7 AND libtcltk-ruby1.8 DPKG is earlier than 1.8.4-1ubuntu1.7 AND libruby1.8-dbg DPKG is earlier than 1.8.4-1ubuntu1.7 AND libruby1.8 DPKG is earlier than 1.8.4-1ubuntu1.7 OR Release section Ubuntu 8.10 is installed AND Architecture section Architecture independent section Installed architecture is all AND Packages section rdoc1.8 DPKG is earlier than 1.8.7.72-1ubuntu0.2 AND rdoc1.9 DPKG is earlier than 1.9.0.2-7ubuntu1.2 AND ri1.9 DPKG is earlier than 1.9.0.2-7ubuntu1.2 AND ri1.8 DPKG is earlier than 1.8.7.72-1ubuntu0.2 AND ruby1.8-examples DPKG is earlier than 1.8.7.72-1ubuntu0.2 AND ruby1.9-elisp DPKG is earlier than 1.9.0.2-7ubuntu1.2 AND ruby1.9-examples DPKG is earlier than 1.9.0.2-7ubuntu1.2 AND ruby1.8-elisp DPKG is earlier than 1.8.7.72-1ubuntu0.2 AND irb1.8 DPKG is earlier than 1.8.7.72-1ubuntu0.2 AND irb1.9 DPKG is earlier than 1.9.0.2-7ubuntu1.2 OR Architecture depended section Supported architectures section Installed architecture is amd64 AND Installed architecture is i386 AND Installed architecture is powerpc AND Installed architecture is sparc AND Installed architecture is lpia AND Packages section libreadline-ruby1.8 DPKG is earlier than 1.8.7.72-1ubuntu0.2 AND libdbm-ruby1.8 DPKG is earlier than 1.8.7.72-1ubuntu0.2 AND ruby1.9-dev DPKG is earlier than 1.9.0.2-7ubuntu1.2 AND libopenssl-ruby1.9 DPKG is earlier than 1.9.0.2-7ubuntu1.2 AND libopenssl-ruby1.8 DPKG is earlier than 1.8.7.72-1ubuntu0.2 AND ruby1.8-dev DPKG is earlier than 1.8.7.72-1ubuntu0.2 AND libtcltk-ruby1.9 DPKG is earlier than 1.9.0.2-7ubuntu1.2 AND ruby1.8 DPKG is earlier than 1.8.7.72-1ubuntu0.2 AND libreadline-ruby1.9 DPKG is earlier than 1.9.0.2-7ubuntu1.2 AND ruby1.9 DPKG is earlier than 1.9.0.2-7ubuntu1.2 AND libruby1.9-dbg DPKG is earlier than 1.9.0.2-7ubuntu1.2 AND libgdbm-ruby1.9 DPKG is earlier than 1.9.0.2-7ubuntu1.2 AND libgdbm-ruby1.8 DPKG is earlier than 1.8.7.72-1ubuntu0.2 AND libtcltk-ruby1.8 DPKG is earlier than 1.8.7.72-1ubuntu0.2 AND libdbm-ruby1.9 DPKG is earlier than 1.9.0.2-7ubuntu1.2 AND libruby1.8-dbg DPKG is earlier than 1.8.7.72-1ubuntu0.2 AND libruby1.8 DPKG is earlier than 1.8.7.72-1ubuntu0.2 AND libruby1.9 DPKG is earlier than 1.9.0.2-7ubuntu1.2

Definition Id: oval:org.mitre.oval:def:13540

Oval ID:	oval:org.mitre.oval:def:13540
Title:	DSA-1860-1 ruby1.8, ruby1.9 -- several
Description:	Several vulnerabilities have been discovered in Ruby. The Common Vulnerabilities and Exposures project identifies the following problems: CVE-2009-0642 The return value from the OCSP_basic_verify function was not checked properly, allowing continued use of a revoked certificate. CVE-2009-1904 An issue in parsing BigDecimal numbers can result in a denial-of-service condition. The following matrix identifies fixed versions: ruby1.8 ruby1.9 oldstable 1.8.5-4etch5 1.9.0+20060609-1etch5 stable 1.8.7.72-3lenny1 1.9.0.2-9lenny1 unstable 1.8.7.173-1 We recommend that you upgrade your Ruby packages.
Family:	unix	Class:	patch
Reference(s):	DSA-1860-1 CVE-2009-0642 CVE-2009-1904	Version:	5
Platform(s):	Debian GNU/Linux 5.0 Debian GNU/Linux 4.0	Product(s):	ruby1.8 ruby1.9
Definition Synopsis:
Release section Debian GNU/Linux 5.0 is installed AND Architecture section Architecture independent section Installed architecture is all AND Packages section rdoc1.8 DPKG is earlier than 1.8.7.72-3lenny1 AND rdoc1.9 DPKG is earlier than 1.9.0.2-9lenny1 AND ri1.9 DPKG is earlier than 1.9.0.2-9lenny1 AND ri1.8 DPKG is earlier than 1.8.7.72-3lenny1 AND ruby1.8-examples DPKG is earlier than 1.8.7.72-3lenny1 AND ruby1.9-elisp DPKG is earlier than 1.9.0.2-9lenny1 AND ruby1.9-examples DPKG is earlier than 1.9.0.2-9lenny1 AND ruby1.8-elisp DPKG is earlier than 1.8.7.72-3lenny1 AND irb1.8 DPKG is earlier than 1.8.7.72-3lenny1 AND irb1.9 DPKG is earlier than 1.9.0.2-9lenny1 AND libreadline-ruby1.8 DPKG is earlier than 1.8.7.72-3lenny1 AND libdbm-ruby1.8 DPKG is earlier than 1.8.7.72-3lenny1 AND ruby1.9-dev DPKG is earlier than 1.9.0.2-9lenny1 AND libopenssl-ruby1.9 DPKG is earlier than 1.9.0.2-9lenny1 AND libopenssl-ruby1.8 DPKG is earlier than 1.8.7.72-3lenny1 AND ruby1.8-dev DPKG is earlier than 1.8.7.72-3lenny1 AND libtcltk-ruby1.9 DPKG is earlier than 1.9.0.2-9lenny1 AND ruby1.8 DPKG is earlier than 1.8.7.72-3lenny1 AND libreadline-ruby1.9 DPKG is earlier than 1.9.0.2-9lenny1 AND ruby1.9 DPKG is earlier than 1.9.0.2-9lenny1 AND libruby1.9-dbg DPKG is earlier than 1.9.0.2-9lenny1 AND libtcltk-ruby1.8 DPKG is earlier than 1.8.7.72-3lenny1 AND libgdbm-ruby1.8 DPKG is earlier than 1.8.7.72-3lenny1 AND libgdbm-ruby1.9 DPKG is earlier than 1.9.0.2-9lenny1 AND libdbm-ruby1.9 DPKG is earlier than 1.9.0.2-9lenny1 AND libruby1.8-dbg DPKG is earlier than 1.8.7.72-3lenny1 AND libruby1.8 DPKG is earlier than 1.8.7.72-3lenny1 AND libruby1.9 DPKG is earlier than 1.9.0.2-9lenny1 OR Architecture depended section Installed architecture is hppa AND Packages section ruby1.8 DPKG is earlier than 1.8.7.72-3lenny1 AND libreadline-ruby1.8 DPKG is earlier than 1.8.7.72-3lenny1 AND libruby1.8 DPKG is earlier than 1.8.7.72-3lenny1 AND libdbm-ruby1.8 DPKG is earlier than 1.8.7.72-3lenny1 AND libgdbm-ruby1.8 DPKG is earlier than 1.8.7.72-3lenny1 AND libtcltk-ruby1.8 DPKG is earlier than 1.8.7.72-3lenny1 AND libopenssl-ruby1.8 DPKG is earlier than 1.8.7.72-3lenny1 AND libruby1.8-dbg DPKG is earlier than 1.8.7.72-3lenny1 AND ruby1.8-dev DPKG is earlier than 1.8.7.72-3lenny1 OR Release section Debian GNU/Linux 4.0 is installed. AND Architecture section Architecture independent section Installed architecture is all AND Packages section rdoc1.8 DPKG is earlier than 1.8.5-4etch5 AND rdoc1.9 DPKG is earlier than 1.9.0+20060609-1etch5 AND ri1.9 DPKG is earlier than 1.9.0+20060609-1etch5 AND ri1.8 DPKG is earlier than 1.8.5-4etch5 AND ruby1.8-examples DPKG is earlier than 1.8.5-4etch5 AND ruby1.9-elisp DPKG is earlier than 1.9.0+20060609-1etch5 AND ruby1.9-examples DPKG is earlier than 1.9.0+20060609-1etch5 AND ruby1.8-elisp DPKG is earlier than 1.8.5-4etch5 AND irb1.8 DPKG is earlier than 1.8.5-4etch5 AND irb1.9 DPKG is earlier than 1.9.0+20060609-1etch5 OR Architecture depended section Supported architectures section Installed architecture is s390 AND Installed architecture is amd64 AND Installed architecture is arm AND Installed architecture is i386 AND Installed architecture is mips AND Installed architecture is ia64 AND Installed architecture is alpha AND Installed architecture is powerpc AND Installed architecture is mipsel AND Packages section ruby1.8 DPKG is earlier than 1.8.5-4etch5 AND libdbm-ruby1.8 DPKG is earlier than 1.8.5-4etch5 AND libdbm-ruby1.9 DPKG is earlier than 1.9.0+20060609-1etch5 AND libopenssl-ruby1.9 DPKG is earlier than 1.9.0+20060609-1etch5 AND libopenssl-ruby1.8 DPKG is earlier than 1.8.5-4etch5 AND ruby1.8-dev DPKG is earlier than 1.8.5-4etch5 AND libtcltk-ruby1.9 DPKG is earlier than 1.9.0+20060609-1etch5 AND libreadline-ruby1.8 DPKG is earlier than 1.8.5-4etch5 AND libreadline-ruby1.9 DPKG is earlier than 1.9.0+20060609-1etch5 AND ruby1.9-dev DPKG is earlier than 1.9.0+20060609-1etch5 AND ruby1.9 DPKG is earlier than 1.9.0+20060609-1etch5 AND libruby1.9-dbg DPKG is earlier than 1.9.0+20060609-1etch5 AND libgdbm-ruby1.9 DPKG is earlier than 1.9.0+20060609-1etch5 AND libgdbm-ruby1.8 DPKG is earlier than 1.8.5-4etch5 AND libtcltk-ruby1.8 DPKG is earlier than 1.8.5-4etch5 AND libruby1.8-dbg DPKG is earlier than 1.8.5-4etch5 AND libruby1.8 DPKG is earlier than 1.8.5-4etch5 AND libruby1.9 DPKG is earlier than 1.9.0+20060609-1etch5 OR Architecture depended section Installed architecture is hppa AND Packages section libreadline-ruby1.9 DPKG is earlier than 1.9.0+20060609-1etch5 AND ruby1.9 DPKG is earlier than 1.9.0+20060609-1etch5 AND libruby1.9-dbg DPKG is earlier than 1.9.0+20060609-1etch5 AND libdbm-ruby1.9 DPKG is earlier than 1.9.0+20060609-1etch5 AND libtcltk-ruby1.9 DPKG is earlier than 1.9.0+20060609-1etch5 AND libgdbm-ruby1.9 DPKG is earlier than 1.9.0+20060609-1etch5 AND libopenssl-ruby1.9 DPKG is earlier than 1.9.0+20060609-1etch5 AND ruby1.9-dev DPKG is earlier than 1.9.0+20060609-1etch5 AND libruby1.9 DPKG is earlier than 1.9.0+20060609-1etch5

Definition Id: oval:org.mitre.oval:def:13671

Oval ID:	oval:org.mitre.oval:def:13671
Title:	USN-900-1 -- ruby1.9 vulnerabilities
Description:	Emmanouel Kellinis discovered that Ruby did not properly handle certain string operations. An attacker could exploit this issue and possibly execute arbitrary code with application privileges. Giovanni Pellerano, Alessandro Tanasi, and Francesco Ongaro discovered that Ruby did not properly sanitize data written to log files. An attacker could insert specially-crafted data into log files which could affect certain terminal emulators and cause arbitrary files to be overwritten, or even possibly execute arbitrary commands. It was discovered that Ruby did not properly handle string arguments that represent large numbers. An attacker could exploit this and cause a denial of service. This issue only affected Ubuntu 9.10
Family:	unix	Class:	patch
Reference(s):	USN-900-1 CVE-2009-4124 CVE-2009-4492 CVE-2009-1904	Version:	5
Platform(s):	Ubuntu 8.10 Ubuntu 9.10 Ubuntu 9.04	Product(s):	ruby1.9
Definition Synopsis:
Release section Ubuntu 8.10 is installed AND Architecture section Architecture independet section Installed architecture is all AND Packages section rdoc1.9 DPKG is earlier than 1.9.0.2-7ubuntu1.3 AND ri1.9 DPKG is earlier than 1.9.0.2-7ubuntu1.3 AND ruby1.9-elisp DPKG is earlier than 1.9.0.2-7ubuntu1.3 AND ruby1.9-examples DPKG is earlier than 1.9.0.2-7ubuntu1.3 AND irb1.9 DPKG is earlier than 1.9.0.2-7ubuntu1.3 OR Architecture depended section Supported architectures section Installed architecture is amd64 AND Installed architecture is i386 AND Installed architecture is powerpc AND Installed architecture is sparc AND Installed architecture is lpia AND Packages section ruby1.9 DPKG is earlier than 1.9.0.2-7ubuntu1.3 AND ruby1.9-dev DPKG is earlier than 1.9.0.2-7ubuntu1.3 AND libopenssl-ruby1.9 DPKG is earlier than 1.9.0.2-7ubuntu1.3 AND libdbm-ruby1.9 DPKG is earlier than 1.9.0.2-7ubuntu1.3 AND libreadline-ruby1.9 DPKG is earlier than 1.9.0.2-7ubuntu1.3 AND libruby1.9-dbg DPKG is earlier than 1.9.0.2-7ubuntu1.3 AND libtcltk-ruby1.9 DPKG is earlier than 1.9.0.2-7ubuntu1.3 AND libgdbm-ruby1.9 DPKG is earlier than 1.9.0.2-7ubuntu1.3 AND libruby1.9 DPKG is earlier than 1.9.0.2-7ubuntu1.3 OR Release section Ubuntu 9.10 is installed AND Architecture section Architecture independet section Installed architecture is all AND Packages section rdoc1.9 DPKG is earlier than 1.9.0.5-1ubuntu1.2 AND ri1.9 DPKG is earlier than 1.9.0.5-1ubuntu1.2 AND ruby1.9-elisp DPKG is earlier than 1.9.0.5-1ubuntu1.2 AND ruby1.9-examples DPKG is earlier than 1.9.0.5-1ubuntu1.2 AND irb1.9 DPKG is earlier than 1.9.0.5-1ubuntu1.2 OR Architecture depended section Supported architectures section Installed architecture is amd64 AND Installed architecture is i386 AND Installed architecture is powerpc AND Installed architecture is sparc AND Installed architecture is lpia AND Packages section ruby1.9 DPKG is earlier than 1.9.0.5-1ubuntu1.2 AND ruby1.9-dev DPKG is earlier than 1.9.0.5-1ubuntu1.2 AND libopenssl-ruby1.9 DPKG is earlier than 1.9.0.5-1ubuntu1.2 AND libdbm-ruby1.9 DPKG is earlier than 1.9.0.5-1ubuntu1.2 AND libreadline-ruby1.9 DPKG is earlier than 1.9.0.5-1ubuntu1.2 AND libruby1.9-dbg DPKG is earlier than 1.9.0.5-1ubuntu1.2 AND libtcltk-ruby1.9 DPKG is earlier than 1.9.0.5-1ubuntu1.2 AND libgdbm-ruby1.9 DPKG is earlier than 1.9.0.5-1ubuntu1.2 AND libruby1.9 DPKG is earlier than 1.9.0.5-1ubuntu1.2 OR Release section Ubuntu 9.04 is installed AND Architecture section Architecture independet section Installed architecture is all AND Packages section rdoc1.9 DPKG is earlier than 1.9.0.2-9ubuntu1.2 AND ri1.9 DPKG is earlier than 1.9.0.2-9ubuntu1.2 AND ruby1.9-elisp DPKG is earlier than 1.9.0.2-9ubuntu1.2 AND ruby1.9-examples DPKG is earlier than 1.9.0.2-9ubuntu1.2 AND irb1.9 DPKG is earlier than 1.9.0.2-9ubuntu1.2 OR Architecture depended section Supported architectures section Installed architecture is amd64 AND Installed architecture is i386 AND Installed architecture is powerpc AND Installed architecture is sparc AND Installed architecture is lpia AND Packages section ruby1.9 DPKG is earlier than 1.9.0.2-9ubuntu1.2 AND ruby1.9-dev DPKG is earlier than 1.9.0.2-9ubuntu1.2 AND libopenssl-ruby1.9 DPKG is earlier than 1.9.0.2-9ubuntu1.2 AND libdbm-ruby1.9 DPKG is earlier than 1.9.0.2-9ubuntu1.2 AND libreadline-ruby1.9 DPKG is earlier than 1.9.0.2-9ubuntu1.2 AND libruby1.9-dbg DPKG is earlier than 1.9.0.2-9ubuntu1.2 AND libtcltk-ruby1.9 DPKG is earlier than 1.9.0.2-9ubuntu1.2 AND libgdbm-ruby1.9 DPKG is earlier than 1.9.0.2-9ubuntu1.2 AND libruby1.9 DPKG is earlier than 1.9.0.2-9ubuntu1.2

Definition Id: oval:org.mitre.oval:def:22506

Oval ID:	oval:org.mitre.oval:def:22506
Title:	ELSA-2007:0385: fetchmail security update (Moderate)
Description:	The APOP protocol allows remote attackers to guess the first 3 characters of a password via man-in-the-middle (MITM) attacks that use crafted message IDs and MD5 collisions. NOTE: this design-level issue potentially affects all products that use APOP, including (1) Thunderbird 1.x before 1.5.0.12 and 2.x before 2.0.0.4, (2) Evolution, (3) mutt, (4) fetchmail before 6.3.8, (5) SeaMonkey 1.0.x before 1.0.9 and 1.1.x before 1.1.2, (6) Balsa 2.3.16 and earlier, (7) Mailfilter before 0.8.2, and possibly other products.
Family:	unix	Class:	patch
Reference(s):	ELSA-2007:0385-03 CVE-2007-1558	Version:	6
Platform(s):	Oracle Linux 5	Product(s):	fetchmail
Definition Synopsis:
Oracle Linux 5.x AND fetchmail is earlier than 0:6.3.6-1.0.1.el5

Definition Id: oval:org.mitre.oval:def:22650

Oval ID:	oval:org.mitre.oval:def:22650
Title:	ELSA-2007:0344: evolution-data-server security update (Moderate)
Description:	The APOP protocol allows remote attackers to guess the first 3 characters of a password via man-in-the-middle (MITM) attacks that use crafted message IDs and MD5 collisions. NOTE: this design-level issue potentially affects all products that use APOP, including (1) Thunderbird 1.x before 1.5.0.12 and 2.x before 2.0.0.4, (2) Evolution, (3) mutt, (4) fetchmail before 6.3.8, (5) SeaMonkey 1.0.x before 1.0.9 and 1.1.x before 1.1.2, (6) Balsa 2.3.16 and earlier, (7) Mailfilter before 0.8.2, and possibly other products.
Family:	unix	Class:	patch
Reference(s):	ELSA-2007:0344-01 CVE-2007-1558	Version:	6
Platform(s):	Oracle Linux 5	Product(s):	evolution-data-server
Definition Synopsis:
Oracle Linux 5.x rpm test evolution-data-server is earlier than 0:1.8.0-15.0.3.el5 AND evolution-data-server-devel is earlier than 0:1.8.0-15.0.3.el5

Definition Id: oval:org.mitre.oval:def:22900

Oval ID:	oval:org.mitre.oval:def:22900
Title:	ELSA-2009:1140: ruby security update (Moderate)
Description:	The BigDecimal library in Ruby 1.8.6 before p369 and 1.8.7 before p173 allows context-dependent attackers to cause a denial of service (application crash) via a string argument that represents a large number, as demonstrated by an attempted conversion to the Float data type.
Family:	unix	Class:	patch
Reference(s):	ELSA-2009:1140-02 CVE-2007-1558 CVE-2009-0642 CVE-2009-1904	Version:	17
Platform(s):	Oracle Linux 5	Product(s):	ruby
Definition Synopsis:
Oracle Linux 5.x rpm test ruby-ri is earlier than 0:1.8.5-5.el5_3.7 AND ruby-docs is earlier than 0:1.8.5-5.el5_3.7 AND ruby-mode is earlier than 0:1.8.5-5.el5_3.7 AND ruby-tcltk is earlier than 0:1.8.5-5.el5_3.7 AND ruby-libs is earlier than 0:1.8.5-5.el5_3.7 AND ruby-irb is earlier than 0:1.8.5-5.el5_3.7 AND ruby-rdoc is earlier than 0:1.8.5-5.el5_3.7 AND ruby is earlier than 0:1.8.5-5.el5_3.7 AND ruby-devel is earlier than 0:1.8.5-5.el5_3.7

Definition Id: oval:org.mitre.oval:def:29258

Oval ID:	oval:org.mitre.oval:def:29258
Title:	RHSA-2009:1140 -- ruby security update (Moderate)
Description:	Updated ruby packages that fix multiple security issues are now available for Red Hat Enterprise Linux 4 and 5. This update has been rated as having moderate security impact by the Red Hat Security Response Team. Ruby is an extensible, interpreted, object-oriented, scripting language. It has features to process text files and to do system management tasks.
Family:	unix	Class:	patch
Reference(s):	RHSA-2009:1140 CESA-2009:1140-CentOS 5 CVE-2007-1558 CVE-2009-0642 CVE-2009-1904	Version:	3
Platform(s):	Red Hat Enterprise Linux 5 Red Hat Enterprise Linux 4 CentOS Linux 5	Product(s):	ruby
Definition Synopsis:
Red Hat Enterprise Linux 5 and CentOS Linux 5 release section Operation system section The operating system installed on the system is Red Hat Enterprise Linux 5 AND The operating system installed on the system is CentOS Linux 5.x Packages match section ruby-devel is earlier than 0:1.8.5-5.el5_3.7 AND ruby-mode is earlier than 0:1.8.5-5.el5_3.7 AND ruby is earlier than 0:1.8.5-5.el5_3.7 AND ruby-docs is earlier than 0:1.8.5-5.el5_3.7 AND ruby-irb is earlier than 0:1.8.5-5.el5_3.7 AND ruby-libs is earlier than 0:1.8.5-5.el5_3.7 AND ruby-rdoc is earlier than 0:1.8.5-5.el5_3.7 AND ruby-ri is earlier than 0:1.8.5-5.el5_3.7 AND ruby-tcltk is earlier than 0:1.8.5-5.el5_3.7 AND Red Hat Enterprise Linux 4 release section The operating system installed on the system is Red Hat Enterprise Linux 4 Packages match section irb is earlier than 0:1.8.1-7.el4_8.3 AND ruby is earlier than 0:1.8.1-7.el4_8.3 AND ruby-devel is earlier than 0:1.8.1-7.el4_8.3 AND ruby-docs is earlier than 0:1.8.1-7.el4_8.3 AND ruby-libs is earlier than 0:1.8.1-7.el4_8.3 AND ruby-mode is earlier than 0:1.8.1-7.el4_8.3 AND ruby-tcltk is earlier than 0:1.8.1-7.el4_8.3

Definition Id: oval:org.mitre.oval:def:7853

Oval ID:	oval:org.mitre.oval:def:7853
Title:	DSA-1860 ruby1.8, ruby1.9 -- several vulnerabilities
Description:	Several vulnerabilities have been discovered in Ruby. The Common Vulnerabilities and Exposures project identifies the following problems: The return value from the OCSP_basic_verify function was not checked properly, allowing continued use of a revoked certificate. An issue in parsing BigDecimal numbers can result in a denial-of-service condition (crash). The following matrix identifies fixed versions: We recommend that you upgrade your Ruby packages.
Family:	unix	Class:	patch
Reference(s):	DSA-1860 CVE-2009-0642 CVE-2009-1904	Version:	3
Platform(s):	Debian GNU/Linux 5.0 Debian GNU/Linux 4.0	Product(s):	ruby1.8 ruby1.9
Definition Synopsis:
Release section Debian GNU/Linux 5.0 is installed AND Architecture section Architecture independent section Installed architecture is all AND Packages section rdoc1.8 is earlier than 1.8.7.72-3lenny1 AND rdoc1.9 is earlier than 1.9.0.2-9lenny1 AND ri1.9 is earlier than 1.9.0.2-9lenny1 AND ri1.8 is earlier than 1.8.7.72-3lenny1 AND ruby1.8-examples is earlier than 1.8.7.72-3lenny1 AND ruby1.9-examples is earlier than 1.9.0.2-9lenny1 AND ruby1.8-elisp is earlier than 1.8.7.72-3lenny1 AND ruby1.9-elisp is earlier than 1.9.0.2-9lenny1 AND irb1.8 is earlier than 1.8.7.72-3lenny1 AND irb1.9 is earlier than 1.9.0.2-9lenny1 OR Architecture dependent section Supported architectures section Installed architecture is s390 AND Installed architecture is amd64 AND Installed architecture is sparc AND Installed architecture is arm AND Installed architecture is i386 AND Installed architecture is armel AND Installed architecture is mips AND Installed architecture is ia64 AND Installed architecture is alpha AND Installed architecture is powerpc AND Installed architecture is mipsel AND Packages section ruby1.8 is earlier than 1.8.7.72-3lenny1 AND libdbm-ruby1.8 is earlier than 1.8.7.72-3lenny1 AND ruby1.9-dev is earlier than 1.9.0.2-9lenny1 AND libopenssl-ruby1.9 is earlier than 1.9.0.2-9lenny1 AND libopenssl-ruby1.8 is earlier than 1.8.7.72-3lenny1 AND ruby1.8-dev is earlier than 1.8.7.72-3lenny1 AND libtcltk-ruby1.9 is earlier than 1.9.0.2-9lenny1 AND libreadline-ruby1.8 is earlier than 1.8.7.72-3lenny1 AND libreadline-ruby1.9 is earlier than 1.9.0.2-9lenny1 AND ruby1.9 is earlier than 1.9.0.2-9lenny1 AND libruby1.9-dbg is earlier than 1.9.0.2-9lenny1 AND libtcltk-ruby1.8 is earlier than 1.8.7.72-3lenny1 AND libgdbm-ruby1.8 is earlier than 1.8.7.72-3lenny1 AND libgdbm-ruby1.9 is earlier than 1.9.0.2-9lenny1 AND libdbm-ruby1.9 is earlier than 1.9.0.2-9lenny1 AND libruby1.8-dbg is earlier than 1.8.7.72-3lenny1 AND libruby1.8 is earlier than 1.8.7.72-3lenny1 AND libruby1.9 is earlier than 1.9.0.2-9lenny1 OR Architecture dependent section Installed architecture is hppa AND Packages section libreadline-ruby1.8 is earlier than 1.8.7.72-3lenny1 AND libdbm-ruby1.8 is earlier than 1.8.7.72-3lenny1 AND libopenssl-ruby1.8 is earlier than 1.8.7.72-3lenny1 AND ruby1.8-dev is earlier than 1.8.7.72-3lenny1 AND ruby1.8 is earlier than 1.8.7.72-3lenny1 AND libgdbm-ruby1.8 is earlier than 1.8.7.72-3lenny1 AND libtcltk-ruby1.8 is earlier than 1.8.7.72-3lenny1 AND libruby1.8-dbg is earlier than 1.8.7.72-3lenny1 AND libruby1.8 is earlier than 1.8.7.72-3lenny1 OR Release section Debian GNU/Linux 4.0 is installed. AND Architecture section Architecture independent section Installed architecture is all AND Packages section rdoc1.8 is earlier than 1.8.5-4etch5 AND rdoc1.9 is earlier than 1.9.0+20060609-1etch5 AND ri1.9 is earlier than 1.9.0+20060609-1etch5 AND ri1.8 is earlier than 1.8.5-4etch5 AND ruby1.8-examples is earlier than 1.8.5-4etch5 AND ruby1.9-examples is earlier than 1.9.0+20060609-1etch5 AND ruby1.8-elisp is earlier than 1.8.5-4etch5 AND ruby1.9-elisp is earlier than 1.9.0+20060609-1etch5 AND irb1.8 is earlier than 1.8.5-4etch5 AND irb1.9 is earlier than 1.9.0+20060609-1etch5 OR Architecture dependent section Supported architectures section Installed architecture is s390 AND Installed architecture is amd64 AND Installed architecture is arm AND Installed architecture is i386 AND Installed architecture is mips AND Installed architecture is ia64 AND Installed architecture is alpha AND Installed architecture is powerpc AND Installed architecture is mipsel AND Packages section ruby1.8 is earlier than 1.8.5-4etch5 AND libdbm-ruby1.8 is earlier than 1.8.5-4etch5 AND libdbm-ruby1.9 is earlier than 1.9.0+20060609-1etch5 AND libopenssl-ruby1.9 is earlier than 1.9.0+20060609-1etch5 AND libopenssl-ruby1.8 is earlier than 1.8.5-4etch5 AND ruby1.8-dev is earlier than 1.8.5-4etch5 AND libtcltk-ruby1.9 is earlier than 1.9.0+20060609-1etch5 AND libreadline-ruby1.8 is earlier than 1.8.5-4etch5 AND libreadline-ruby1.9 is earlier than 1.9.0+20060609-1etch5 AND ruby1.9-dev is earlier than 1.9.0+20060609-1etch5 AND ruby1.9 is earlier than 1.9.0+20060609-1etch5 AND libruby1.9-dbg is earlier than 1.9.0+20060609-1etch5 AND libgdbm-ruby1.9 is earlier than 1.9.0+20060609-1etch5 AND libgdbm-ruby1.8 is earlier than 1.8.5-4etch5 AND libtcltk-ruby1.8 is earlier than 1.8.5-4etch5 AND libruby1.8-dbg is earlier than 1.8.5-4etch5 AND libruby1.8 is earlier than 1.8.5-4etch5 AND libruby1.9 is earlier than 1.9.0+20060609-1etch5 OR Architecture dependent section Installed architecture is hppa AND Packages section ruby1.9 is earlier than 1.9.0+20060609-1etch5 AND libdbm-ruby1.9 is earlier than 1.9.0+20060609-1etch5 AND libopenssl-ruby1.9 is earlier than 1.9.0+20060609-1etch5 AND ruby1.9-dev is earlier than 1.9.0+20060609-1etch5 AND libreadline-ruby1.9 is earlier than 1.9.0+20060609-1etch5 AND libruby1.9-dbg is earlier than 1.9.0+20060609-1etch5 AND libtcltk-ruby1.9 is earlier than 1.9.0+20060609-1etch5 AND libgdbm-ruby1.9 is earlier than 1.9.0+20060609-1etch5 AND libruby1.9 is earlier than 1.9.0+20060609-1etch5

Definition Id: oval:org.mitre.oval:def:9780

Oval ID:	oval:org.mitre.oval:def:9780
Title:	The BigDecimal library in Ruby 1.8.6 before p369 and 1.8.7 before p173 allows context-dependent attackers to cause a denial of service (application crash) via a string argument that represents a large number, as demonstrated by an attempted conversion to the Float data type.
Description:	The BigDecimal library in Ruby 1.8.6 before p369 and 1.8.7 before p173 allows context-dependent attackers to cause a denial of service (application crash) via a string argument that represents a large number, as demonstrated by an attempted conversion to the Float data type.
Family:	unix	Class:	vulnerability
Reference(s):	CVE-2009-1904	Version:	5
Platform(s):	Red Hat Enterprise Linux 4 CentOS Linux 4 Oracle Linux 4 Red Hat Enterprise Linux 5 CentOS Linux 5 Oracle Linux 5	Product(s):
Definition Synopsis:
OS Section: RHEL4, CentOS4, Oracle Linux 4 RHEL4, CentOS4 or Oracle Linux 4 The operating system installed on the system is Red Hat Enterprise Linux 4 AND CentOS Linux 4.x AND Oracle Linux 4.x AND Configuration section ruby-mode is earlier than 0:1.8.1-7.el4_8.3 AND ruby-docs is earlier than 0:1.8.1-7.el4_8.3 AND ruby-devel is earlier than 0:1.8.1-7.el4_8.3 AND ruby-tcltk is earlier than 0:1.8.1-7.el4_8.3 AND ruby is earlier than 0:1.8.1-7.el4_8.3 AND irb is earlier than 0:1.8.1-7.el4_8.3 AND ruby-libs is earlier than 0:1.8.1-7.el4_8.3 OR OS Section: RHEL5, CentOS5, Oracle Linux 5 RHEL5, CentOS5 or Oracle Linux 5 The operating system installed on the system is Red Hat Enterprise Linux 5 AND CentOS Linux 5.x AND Oracle Linux 5.x AND Configuration section ruby-ri is earlier than 0:1.8.5-5.el5_3.7 AND ruby-mode is earlier than 0:1.8.5-5.el5_3.7 AND ruby-docs is earlier than 0:1.8.5-5.el5_3.7 AND ruby-devel is earlier than 0:1.8.5-5.el5_3.7 AND ruby is earlier than 0:1.8.5-5.el5_3.7 AND ruby-libs is earlier than 0:1.8.5-5.el5_3.7 AND ruby-tcltk is earlier than 0:1.8.5-5.el5_3.7 AND ruby-irb is earlier than 0:1.8.5-5.el5_3.7 AND ruby-rdoc is earlier than 0:1.8.5-5.el5_3.7

Definition Id: oval:org.mitre.oval:def:9782

Oval ID:	oval:org.mitre.oval:def:9782
Title:	The APOP protocol allows remote attackers to guess the first 3 characters of a password via man-in-the-middle (MITM) attacks that use crafted message IDs and MD5 collisions. NOTE: this design-level issue potentially affects all products that use APOP, including (1) Thunderbird 1.x before 1.5.0.12 and 2.x before 2.0.0.4, (2) Evolution, (3) mutt, (4) fetchmail before 6.3.8, (5) SeaMonkey 1.0.x before 1.0.9 and 1.1.x before 1.1.2, (6) Balsa 2.3.16 and earlier, (7) Mailfilter before 0.8.2, and possibly other products.
Description:	The APOP protocol allows remote attackers to guess the first 3 characters of a password via man-in-the-middle (MITM) attacks that use crafted message IDs and MD5 collisions. NOTE: this design-level issue potentially affects all products that use APOP, including (1) Thunderbird 1.x before 1.5.0.12 and 2.x before 2.0.0.4, (2) Evolution, (3) mutt, (4) fetchmail before 6.3.8, (5) SeaMonkey 1.0.x before 1.0.9 and 1.1.x before 1.1.2, (6) Balsa 2.3.16 and earlier, (7) Mailfilter before 0.8.2, and possibly other products.
Family:	unix	Class:	vulnerability
Reference(s):	CVE-2007-1558	Version:	5
Platform(s):	Red Hat Enterprise Linux 3 CentOS Linux 3 Red Hat Enterprise Linux 4 CentOS Linux 4 Oracle Linux 4 Red Hat Enterprise Linux 5 CentOS Linux 5 Oracle Linux 5	Product(s):
Definition Synopsis:
OS Section: RHEL3, CentOS3 RHEL3 or CentOS3 The operating system installed on the system is Red Hat Enterprise Linux 3 AND CentOS Linux 3.x AND Configuration section seamonkey-nspr is earlier than 0:1.0.9-0.1.el3 AND seamonkey-js-debugger is earlier than 0:1.0.9-0.1.el3 AND seamonkey-nss-devel is earlier than 0:1.0.9-0.1.el3 AND seamonkey is earlier than 0:1.0.9-0.1.el3 AND seamonkey-nspr-devel is earlier than 0:1.0.9-0.1.el3 AND evolution is earlier than 0:1.4.5-20.el3 AND seamonkey-mail is earlier than 0:1.0.9-0.1.el3 AND fetchmail is earlier than 0:6.2.0-3.el3.4 AND mutt is earlier than 5:1.4.1-5.el3 AND seamonkey-chat is earlier than 0:1.0.9-0.1.el3 AND seamonkey-nss is earlier than 0:1.0.9-0.1.el3 AND seamonkey-devel is earlier than 0:1.0.9-0.1.el3 AND seamonkey-dom-inspector is earlier than 0:1.0.9-0.1.el3 AND evolution-devel is earlier than 0:1.4.5-20.el3 OR OS Section: RHEL4, CentOS4, Oracle Linux 4 RHEL4, CentOS4 or Oracle Linux 4 The operating system installed on the system is Red Hat Enterprise Linux 4 AND CentOS Linux 4.x AND Oracle Linux 4.x AND Configuration section seamonkey-js-debugger is earlier than 0:1.0.9-2.el4 AND seamonkey-nss-devel is earlier than 0:1.0.9-2.el4 AND irb is earlier than 0:1.8.1-7.el4_8.3 AND seamonkey-nss is earlier than 0:1.0.9-2.el4 AND devhelp-devel is earlier than 0:0.10-0.8.el4 AND ruby-docs is earlier than 0:1.8.1-7.el4_8.3 AND ruby-mode is earlier than 0:1.8.1-7.el4_8.3 AND seamonkey-nspr is earlier than 0:1.0.9-2.el4 AND ruby-devel is earlier than 0:1.8.1-7.el4_8.3 AND thunderbird is earlier than 0:1.5.0.12-0.1.el4 AND ruby is earlier than 0:1.8.1-7.el4_8.3 AND ruby-libs is earlier than 0:1.8.1-7.el4_8.3 AND seamonkey is earlier than 0:1.0.9-2.el4 AND seamonkey-nspr-devel is earlier than 0:1.0.9-2.el4 AND devhelp is earlier than 0:0.10-0.8.el4 AND evolution is earlier than 0:2.0.2-35.0.2.el4 AND seamonkey-mail is earlier than 0:1.0.9-2.el4 AND mutt is earlier than 5:1.4.1-12.0.3.el4 AND fetchmail is earlier than 0:6.2.5-6.0.1.el4 AND ruby-tcltk is earlier than 0:1.8.1-7.el4_8.3 AND seamonkey-chat is earlier than 0:1.0.9-2.el4 AND seamonkey-devel is earlier than 0:1.0.9-2.el4 AND seamonkey-dom-inspector is earlier than 0:1.0.9-2.el4 AND evolution-devel is earlier than 0:2.0.2-35.0.2.el4 OR OS Section: RHEL5, CentOS5, Oracle Linux 5 RHEL5, CentOS5 or Oracle Linux 5 The operating system installed on the system is Red Hat Enterprise Linux 5 AND CentOS Linux 5.x AND Oracle Linux 5.x AND Configuration section ruby-ri is earlier than 0:1.8.5-5.el5_3.7 AND ruby-mode is earlier than 0:1.8.5-5.el5_3.7 AND ruby-docs is earlier than 0:1.8.5-5.el5_3.7 AND ruby-devel is earlier than 0:1.8.5-5.el5_3.7 AND thunderbird is earlier than 0:1.5.0.12-1.el5 AND ruby is earlier than 0:1.8.5-5.el5_3.7 AND ruby-libs is earlier than 0:1.8.5-5.el5_3.7 AND evolution-data-server-devel is earlier than 0:1.8.0-15.0.3.el5 AND evolution-data-server is earlier than 0:1.8.0-15.0.3.el5 AND fetchmail is earlier than 0:6.3.6-1.0.1.el5 AND mutt is earlier than 5:1.4.2.2-3.0.2.el5 AND ruby-tcltk is earlier than 0:1.8.5-5.el5_3.7 AND ruby-rdoc is earlier than 0:1.8.5-5.el5_3.7 AND ruby-irb is earlier than 0:1.8.5-5.el5_3.7

CPE : Common Platform Enumeration

Type	Description	Count
Application	Apop Protocol cpe:2.3:a:apop_protocol:apop_protocol::::::::	1
Application	Ruby-Lang Ruby cpe:2.3:a:ruby-lang:ruby:1.9:::::::* cpe:2.3:a:ruby-lang:ruby:1.8.7:::::::* cpe:2.3:a:ruby-lang:ruby:1.8.6:::::::* cpe:2.3:a:ruby-lang:ruby:1.8:::::::*	4

OpenVAS Exploits

Date	Description
2011-08-09	Name : CentOS Update for ruby CESA-2009:1140 centos5 i386 File : nvt/gb_CESA-2009_1140_ruby_centos5_i386.nasl
2010-05-12	Name : Mac OS X 10.6.3 Update / Mac OS X Security Update 2010-002 File : nvt/macosx_upd_10_6_3_secupd_2010-002.nasl
2010-03-02	Name : Fedora Update for ruby FEDORA-2010-0533 File : nvt/gb_fedora_2010_0533_ruby_fc11.nasl
2010-02-19	Name : Ubuntu Update for ruby1.9 vulnerabilities USN-900-1 File : nvt/gb_ubuntu_USN_900_1.nasl
2009-12-14	Name : Fedora Core 10 FEDORA-2009-13066 (ruby) File : nvt/fcore_2009_13066.nasl
2009-12-10	Name : Mandriva Security Advisory MDVSA-2009:325 (ruby) File : nvt/mdksa_2009_325.nasl
2009-11-17	Name : Mac OS X Version File : nvt/macosx_version.nasl
2009-10-13	Name : SLES10: Security update for mutt File : nvt/sles10_mutt0.nasl
2009-10-11	Name : SLES11: Security update for ruby File : nvt/sles11_ruby.nasl
2009-10-10	Name : SLES9: Security update for ruby File : nvt/sles9p5053737.nasl
2009-10-10	Name : SLES9: Security update for Mozilla suite File : nvt/sles9p5016317.nasl
2009-08-17	Name : Debian Security Advisory DSA 1860-1 (ruby1.8, ruby1.9) File : nvt/deb_1860_1.nasl
2009-08-17	Name : Mandrake Security Advisory MDVSA-2009:193 (ruby) File : nvt/mdksa_2009_193.nasl
2009-08-17	Name : Mandrake Security Advisory MDVSA-2009:177 (ruby) File : nvt/mdksa_2009_177.nasl
2009-07-29	Name : Ubuntu USN-805-1 (ruby1.9) File : nvt/ubuntu_805_1.nasl
2009-07-29	Name : Mandrake Security Advisory MDVSA-2009:160 (ruby) File : nvt/mdksa_2009_160.nasl
2009-07-29	Name : SuSE Security Advisory SUSE-SA:2009:037 (dhcp-client) File : nvt/suse_sa_2009_037.nasl
2009-07-06	Name : CentOS Security Advisory CESA-2009:1140 (ruby) File : nvt/ovcesa2009_1140.nasl
2009-07-06	Name : RedHat Security Advisory RHSA-2009:1140 File : nvt/RHSA_2009_1140.nasl
2009-06-30	Name : Gentoo Security Advisory GLSA 200906-02 (ruby) File : nvt/glsa_200906_02.nasl
2009-06-23	Name : Ruby BigDecimal Library Denial of Service Vulnerability (Linux) File : nvt/secpod_ruby_bigdecimal_lib_dos_vuln.nasl
2009-06-15	Name : FreeBSD Ports: ruby, ruby+pthreads, ruby+pthreads+oniguruma, ruby+oniguruma File : nvt/freebsd_ruby10.nasl
2009-05-05	Name : HP-UX Update for Thunderbird HPSBUX02156 File : nvt/gb_hp_ux_HPSBUX02156.nasl
2009-04-09	Name : Mandriva Update for mozilla-thunderbird MDKSA-2007:131 (mozilla-thunderbird) File : nvt/gb_mandriva_MDKSA_2007_131.nasl
2009-04-09	Name : Mandriva Update for fetchmail MDKSA-2007:105 (fetchmail) File : nvt/gb_mandriva_MDKSA_2007_105.nasl
2009-04-09	Name : Mandriva Update for mozilla-thunderbird MDKSA-2007:119 (mozilla-thunderbird) File : nvt/gb_mandriva_MDKSA_2007_119.nasl
2009-04-09	Name : Mandriva Update for evolution MDKSA-2007:107 (evolution) File : nvt/gb_mandriva_MDKSA_2007_107.nasl
2009-04-09	Name : Mandriva Update for mutt MDKSA-2007:113 (mutt) File : nvt/gb_mandriva_MDKSA_2007_113.nasl
2009-03-23	Name : Ubuntu Update for mozilla-thunderbird vulnerabilities USN-469-1 File : nvt/gb_ubuntu_USN_469_1.nasl
2009-03-23	Name : Ubuntu Update for fetchmail vulnerabilities USN-520-1 File : nvt/gb_ubuntu_USN_520_1.nasl
2009-02-27	Name : Fedora Update for thunderbird FEDORA-2007-550 File : nvt/gb_fedora_2007_550_thunderbird_fc6.nasl
2009-02-27	Name : Fedora Update for mutt FEDORA-2007-0001 File : nvt/gb_fedora_2007_0001_mutt_fc7.nasl
2009-02-27	Name : Fedora Update for thunderbird FEDORA-2007-0544 File : nvt/gb_fedora_2007_0544_thunderbird_fc7.nasl
2009-02-27	Name : Fedora Update for balsa FEDORA-2007-1447 File : nvt/gb_fedora_2007_1447_balsa_fc7.nasl
2009-02-27	Name : Fedora Update for mutt FEDORA-2007-539 File : nvt/gb_fedora_2007_539_mutt_fc6.nasl
2009-02-27	Name : Fedora Update for mutt FEDORA-2007-540 File : nvt/gb_fedora_2007_540_mutt_fc5.nasl
2009-02-27	Name : Fedora Update for thunderbird FEDORA-2007-551 File : nvt/gb_fedora_2007_551_thunderbird_fc5.nasl
2009-02-27	Name : Fedora Update for devhelp FEDORA-2007-552 File : nvt/gb_fedora_2007_552_devhelp_fc5.nasl
2009-02-27	Name : Fedora Update for epiphany FEDORA-2007-552 File : nvt/gb_fedora_2007_552_epiphany_fc5.nasl
2009-02-27	Name : Fedora Update for seamonkey FEDORA-2007-552 File : nvt/gb_fedora_2007_552_seamonkey_fc5.nasl
2009-02-27	Name : Fedora Update for yelp FEDORA-2007-552 File : nvt/gb_fedora_2007_552_yelp_fc5.nasl
2009-01-28	Name : SuSE Update for mozilla,MozillaFirefox,MozillaThunderbird SUSE-SA:2007:036 File : nvt/gb_suse_2007_036.nasl
2008-09-24	Name : Gentoo Security Advisory GLSA 200706-06 (mozilla/thunderbird/firefox/xulrunner) File : nvt/glsa_200706_06.nasl
2008-09-04	Name : FreeBSD Ports: fetchmail File : nvt/freebsd_fetchmail9.nasl
2008-09-04	Name : FreeBSD Ports: claws-mail File : nvt/freebsd_claws-mail0.nasl
2008-01-17	Name : Debian Security Advisory DSA 1305-1 (icedove) File : nvt/deb_1305_1.nasl
2008-01-17	Name : Debian Security Advisory DSA 1300-1 (iceape) File : nvt/deb_1300_1.nasl
0000-00-00	Name : Slackware Advisory SSA:2009-170-02 ruby File : nvt/esoft_slk_ssa_2009_170_02.nasl
0000-00-00	Name : Slackware Advisory SSA:2007-152-02 firefox-seamonkey-thunderbird File : nvt/esoft_slk_ssa_2007_152_02.nasl

Open Source Vulnerability Database (OSVDB)

Id	Description
55031	Ruby BigDecimal Library Float Data Type Conversion String Argument Handling DoS
52194	Ruby ext/openssl/ossl_ocsp.c OCSP_basic_verify() Function X.509 Certificate H...
34856	APOP Protocol MiTM Crafted IDs/MD5 Collision Cleartext Password Fragment Disc...

Nessus® Vulnerability Scanner

Date	Description
2013-07-12	Name : The remote Oracle Linux host is missing one or more security updates. File : oraclelinux_ELSA-2007-0344.nasl - Type : ACT_GATHER_INFO
2013-07-12	Name : The remote Oracle Linux host is missing one or more security updates. File : oraclelinux_ELSA-2009-1140.nasl - Type : ACT_GATHER_INFO
2013-07-12	Name : The remote Oracle Linux host is missing one or more security updates. File : oraclelinux_ELSA-2007-0402.nasl - Type : ACT_GATHER_INFO
2013-07-12	Name : The remote Oracle Linux host is missing one or more security updates. File : oraclelinux_ELSA-2007-0353.nasl - Type : ACT_GATHER_INFO
2013-07-12	Name : The remote Oracle Linux host is missing a security update. File : oraclelinux_ELSA-2007-0401.nasl - Type : ACT_GATHER_INFO
2013-07-12	Name : The remote Oracle Linux host is missing a security update. File : oraclelinux_ELSA-2007-0386.nasl - Type : ACT_GATHER_INFO
2013-07-12	Name : The remote Oracle Linux host is missing a security update. File : oraclelinux_ELSA-2007-0385.nasl - Type : ACT_GATHER_INFO
2012-09-24	Name : The remote Fedora host is missing a security update. File : fedora_2007-0002.nasl - Type : ACT_GATHER_INFO
2012-08-01	Name : The remote Scientific Linux host is missing one or more security updates. File : sl_20090702_ruby_on_SL4_x.nasl - Type : ACT_GATHER_INFO
2012-08-01	Name : The remote Scientific Linux host is missing a security update. File : sl_20070607_fetchmail_on_SL5_x.nasl - Type : ACT_GATHER_INFO
2012-08-01	Name : The remote Scientific Linux host is missing a security update. File : sl_20070604_mutt_on_SL5_x.nasl - Type : ACT_GATHER_INFO
2012-08-01	Name : The remote Scientific Linux host is missing one or more security updates. File : sl_20070530_seamonkey_on_SL4_x.nasl - Type : ACT_GATHER_INFO
2012-08-01	Name : The remote Scientific Linux host is missing one or more security updates. File : sl_20070530_evolution_data_server_on_SL5_x.nasl - Type : ACT_GATHER_INFO
2012-08-01	Name : The remote Scientific Linux host is missing a security update. File : sl_20070530_Thunderbird_on_SL5_x.nasl - Type : ACT_GATHER_INFO
2012-08-01	Name : The remote Scientific Linux host is missing one or more security updates. File : sl_20070517_evolution_on_SL4_x.nasl - Type : ACT_GATHER_INFO
2011-01-27	Name : The remote SuSE 10 host is missing a security-related patch. File : suse_ruby-6338.nasl - Type : ACT_GATHER_INFO
2010-03-29	Name : The remote host is missing a Mac OS X update that fixes various security issues. File : macosx_SecUpd2010-002.nasl - Type : ACT_GATHER_INFO
2010-03-29	Name : The remote host is missing a Mac OS X update that fixes various security issues. File : macosx_10_6_3.nasl - Type : ACT_GATHER_INFO
2010-02-24	Name : The remote Debian host is missing a security-related update. File : debian_DSA-1860.nasl - Type : ACT_GATHER_INFO
2010-02-17	Name : The remote Ubuntu host is missing one or more security-related patches. File : ubuntu_USN-900-1.nasl - Type : ACT_GATHER_INFO
2010-01-06	Name : The remote CentOS host is missing one or more security updates. File : centos_RHSA-2009-1140.nasl - Type : ACT_GATHER_INFO
2009-12-14	Name : The remote Fedora host is missing a security update. File : fedora_2009-13066.nasl - Type : ACT_GATHER_INFO
2009-12-08	Name : The remote Mandriva Linux host is missing one or more security updates. File : mandriva_MDVSA-2009-325.nasl - Type : ACT_GATHER_INFO
2009-10-06	Name : The remote openSUSE host is missing a security update. File : suse_ruby-6339.nasl - Type : ACT_GATHER_INFO
2009-09-24	Name : The remote SuSE 11 host is missing one or more security updates. File : suse_11_ruby-090703.nasl - Type : ACT_GATHER_INFO
2009-09-24	Name : The remote SuSE 9 host is missing a security-related patch. File : suse9_12452.nasl - Type : ACT_GATHER_INFO
2009-08-06	Name : The remote Mandriva Linux host is missing one or more security updates. File : mandriva_MDVSA-2009-193.nasl - Type : ACT_GATHER_INFO
2009-07-28	Name : The remote Mandriva Linux host is missing one or more security updates. File : mandriva_MDVSA-2009-160.nasl - Type : ACT_GATHER_INFO
2009-07-21	Name : The remote Ubuntu host is missing one or more security-related patches. File : ubuntu_USN-805-1.nasl - Type : ACT_GATHER_INFO
2009-07-21	Name : The remote openSUSE host is missing a security update. File : suse_11_1_ruby-090703.nasl - Type : ACT_GATHER_INFO
2009-07-21	Name : The remote openSUSE host is missing a security update. File : suse_11_0_ruby-090703.nasl - Type : ACT_GATHER_INFO
2009-07-03	Name : The remote Red Hat host is missing one or more security updates. File : redhat-RHSA-2009-1140.nasl - Type : ACT_GATHER_INFO
2009-06-29	Name : The remote Gentoo host is missing one or more security-related patches. File : gentoo_GLSA-200906-02.nasl - Type : ACT_GATHER_INFO
2009-06-21	Name : The remote Slackware host is missing a security update. File : Slackware_SSA_2009-170-02.nasl - Type : ACT_GATHER_INFO
2009-06-15	Name : The remote FreeBSD host is missing one or more security-related updates. File : freebsd_pkg_62e0fbe5579811debb78001cc0377035.nasl - Type : ACT_GATHER_INFO
2009-04-23	Name : The remote Mandrake Linux host is missing one or more security updates. File : mandrake_MDKSA-2007-131.nasl - Type : ACT_GATHER_INFO
2009-04-23	Name : The remote CentOS host is missing one or more security updates. File : centos_RHSA-2007-0402.nasl - Type : ACT_GATHER_INFO
2009-04-23	Name : The remote CentOS host is missing a security update. File : centos_RHSA-2007-0401.nasl - Type : ACT_GATHER_INFO
2007-12-13	Name : The remote SuSE 10 host is missing a security-related patch. File : suse_mutt-3752.nasl - Type : ACT_GATHER_INFO
2007-11-10	Name : The remote Ubuntu host is missing one or more security-related patches. File : ubuntu_USN-520-1.nasl - Type : ACT_GATHER_INFO
2007-11-10	Name : The remote Ubuntu host is missing one or more security-related patches. File : ubuntu_USN-469-1.nasl - Type : ACT_GATHER_INFO
2007-11-06	Name : The remote Fedora host is missing a security update. File : fedora_2007-1447.nasl - Type : ACT_GATHER_INFO
2007-11-06	Name : The remote Fedora host is missing a security update. File : fedora_2007-0544.nasl - Type : ACT_GATHER_INFO
2007-10-17	Name : The remote openSUSE host is missing a security update. File : suse_mutt-3702.nasl - Type : ACT_GATHER_INFO
2007-10-17	Name : The remote openSUSE host is missing a security update. File : suse_MozillaThunderbird-3546.nasl - Type : ACT_GATHER_INFO
2007-10-17	Name : The remote openSUSE host is missing a security update. File : suse_MozillaThunderbird-3545.nasl - Type : ACT_GATHER_INFO
2007-10-17	Name : The remote openSUSE host is missing a security update. File : suse_mutt-3751.nasl - Type : ACT_GATHER_INFO
2007-10-17	Name : The remote openSUSE host is missing a security update. File : suse_seamonkey-3631.nasl - Type : ACT_GATHER_INFO
2007-10-17	Name : The remote openSUSE host is missing a security update. File : suse_seamonkey-3632.nasl - Type : ACT_GATHER_INFO
2007-06-21	Name : The remote Gentoo host is missing one or more security-related patches. File : gentoo_GLSA-200706-06.nasl - Type : ACT_GATHER_INFO
2007-06-14	Name : The remote Debian host is missing a security-related update. File : debian_DSA-1305.nasl - Type : ACT_GATHER_INFO
2007-06-14	Name : The remote Mandrake Linux host is missing one or more security updates. File : mandrake_MDKSA-2007-119.nasl - Type : ACT_GATHER_INFO
2007-06-12	Name : The remote Debian host is missing a security-related update. File : debian_DSA-1300.nasl - Type : ACT_GATHER_INFO
2007-06-07	Name : The remote CentOS host is missing a security update. File : centos_RHSA-2007-0385.nasl - Type : ACT_GATHER_INFO
2007-06-07	Name : The remote Red Hat host is missing one or more security updates. File : redhat-RHSA-2007-0385.nasl - Type : ACT_GATHER_INFO
2007-06-05	Name : The remote Mandrake Linux host is missing one or more security updates. File : mandrake_MDKSA-2007-113.nasl - Type : ACT_GATHER_INFO
2007-06-04	Name : The remote Slackware host is missing a security update. File : Slackware_SSA_2007-152-02.nasl - Type : ACT_GATHER_INFO
2007-06-04	Name : The remote CentOS host is missing a security update. File : centos_RHSA-2007-0386.nasl - Type : ACT_GATHER_INFO
2007-06-04	Name : The remote Red Hat host is missing a security update. File : redhat-RHSA-2007-0386.nasl - Type : ACT_GATHER_INFO
2007-06-04	Name : The remote Fedora Core host is missing one or more security updates. File : fedora_2007-552.nasl - Type : ACT_GATHER_INFO
2007-06-04	Name : The remote Fedora Core host is missing a security update. File : fedora_2007-550.nasl - Type : ACT_GATHER_INFO
2007-06-04	Name : The remote Fedora Core host is missing a security update. File : fedora_2007-551.nasl - Type : ACT_GATHER_INFO
2007-06-01	Name : The remote CentOS host is missing one or more security updates. File : centos_RHSA-2007-0344.nasl - Type : ACT_GATHER_INFO
2007-06-01	Name : The remote Red Hat host is missing one or more security updates. File : redhat-RHSA-2007-0402.nasl - Type : ACT_GATHER_INFO
2007-06-01	Name : The remote Red Hat host is missing a security update. File : redhat-RHSA-2007-0401.nasl - Type : ACT_GATHER_INFO
2007-06-01	Name : The remote Red Hat host is missing one or more security updates. File : redhat-RHSA-2007-0344.nasl - Type : ACT_GATHER_INFO
2007-06-01	Name : The remote Fedora Core host is missing a security update. File : fedora_2007-539.nasl - Type : ACT_GATHER_INFO
2007-06-01	Name : The remote Fedora Core host is missing a security update. File : fedora_2007-540.nasl - Type : ACT_GATHER_INFO
2007-05-31	Name : A web browser on the remote host is prone to multiple flaws. File : seamonkey_109.nasl - Type : ACT_GATHER_INFO
2007-05-31	Name : The remote Windows host contains a mail client that is affected by multiple v... File : mozilla_thunderbird_15012.nasl - Type : ACT_GATHER_INFO
2007-05-25	Name : The remote host is missing a Mac OS X update that fixes several security issues. File : macosx_SecUpd2007-005.nasl - Type : ACT_GATHER_INFO
2007-05-20	Name : The remote CentOS host is missing one or more security updates. File : centos_RHSA-2007-0353.nasl - Type : ACT_GATHER_INFO
2007-05-20	Name : The remote Mandrake Linux host is missing one or more security updates. File : mandrake_MDKSA-2007-105.nasl - Type : ACT_GATHER_INFO
2007-05-20	Name : The remote Mandrake Linux host is missing one or more security updates. File : mandrake_MDKSA-2007-107.nasl - Type : ACT_GATHER_INFO
2007-05-20	Name : The remote Red Hat host is missing one or more security updates. File : redhat-RHSA-2007-0353.nasl - Type : ACT_GATHER_INFO
2007-04-30	Name : The remote FreeBSD host is missing a security-related update. File : freebsd_pkg_c389d06dee5711dbbd510016179b2dd5.nasl - Type : ACT_GATHER_INFO
2007-04-10	Name : The remote FreeBSD host is missing a security-related update. File : freebsd_pkg_f1c4d133e6d311db99ea0060084a00e5.nasl - Type : ACT_GATHER_INFO

Alert History

If you want to see full details history, please login or register.

Date	Informations
2014-02-17 11:52:39	Multiple Updates

Global Informations

Type	Count
CWE ID(s)	2
Oval ID(s)	11
CPE ID(s)	5
osvdb(s)	3
Openvas Exploit(s)	49
Nessus® Exploit(s)	77

	Related
6.8	CVE-2009-0642
5	CVE-2009-1904
2.6	CVE-2007-1558
Info : listing not affected by your CVSS Env Score

Same Subject	Severity
Login to view 3 more Alert(s)