MGASA-2017-0290

Dashboard / Vulnerabilities / MGASA-2017-0290

MGASA-2017-0290

Summary: Updated ruby packages fix security vulnerabilities

Details: It was discovered that Ruby Net::SMTP incorrectly handled CRLF sequences. A remote attacker could possibly use this issue to inject SMTP commands. (CVE-2015-9096) Marcin Noga discovered that Ruby incorrectly handled certain arguments in a TclTkIp class method. An attacker could possibly use this issue to execute arbitrary code. This issue only affected Ubuntu 14.04 LTS. (CVE-2016-2337) It was discovered that Ruby Fiddle::Function.new incorrectly handled certain arguments. An attacker could possibly use this issue to execute arbitrary code. This issue only affected Ubuntu 14.04 LTS. (CVE-2016-2339)

References: https://advisories.mageia.org/MGASA-2017-0290.html, https://bugs.mageia.org/show_bug.cgi?id=20625, https://usn.ubuntu.com/usn/usn-3365-1/