USN-2397-1

Dashboard / Vulnerabilities / USN-2397-1

USN-2397-1

Summary: ruby1.8, ruby1.9.1, ruby2.0, ruby2.1 vulnerabilities

Details: Will Wood discovered that Ruby incorrectly handled the encodes() function. An attacker could possibly use this issue to cause Ruby to crash, resulting in a denial of service, or possibly execute arbitrary code. The default compiler options for affected releases should reduce the vulnerability to a denial of service. (CVE-2014-4975) Willis Vandevanter discovered that Ruby incorrectly handled XML entity expansion. An attacker could use this flaw to cause Ruby to consume large amounts of resources, resulting in a denial of service. (CVE-2014-8080)

References: https://ubuntu.com/security/notices/USN-2397-1, https://ubuntu.com/security/CVE-2014-4975, https://ubuntu.com/security/CVE-2014-8080