USN-3528-1

Dashboard / Vulnerabilities / USN-3528-1

USN-3528-1

Summary: ruby1.9.1, ruby2.3 vulnerabilities

Details: It was discovered that Ruby incorrectly handled certain terminal emulator escape sequences. An attacker could use this to execute arbitrary code via a crafted user name. This issue only affected Ubuntu 16.04 LTS and Ubuntu 17.10. (CVE-2017-10784) It was discovered that Ruby incorrectly handled certain strings. An attacker could use this to cause a denial of service. This issue only affected Ubuntu 16.04 LTS and Ubuntu 17.10. (CVE-2017-14033) It was discovered that Ruby incorrectly handled some generating JSON. An attacker could use this to possible expose sensitive information. This issue only affected Ubuntu 16.04 LTS and Ubuntu 17.10. (CVE-2017-14064) It was discovered that Ruby incorrectly handled certain inputs. An attacker could use this to execute arbitrary code. (CVE-2017-17790)

References: https://ubuntu.com/security/notices/USN-3528-1, https://ubuntu.com/security/CVE-2017-10784, https://ubuntu.com/security/CVE-2017-14033, https://ubuntu.com/security/CVE-2017-14064, https://ubuntu.com/security/CVE-2017-17790