SB2013051705 - Slackware Linux update for ruby
Published: May 17, 2013 Updated: May 6, 2017
Security Bulletin ID
SB2013051705
Severity
Medium
Patch available
YES
Number of vulnerabilities
1
Exploitation vector
Remote access
Highest impact
Data manipulation
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 1 security vulnerability.
1) Permissions, Privileges, and Access Controls (CVE-ID: CVE-2013-2065)
The vulnerability allows a remote non-authenticated attacker to read and manipulate data.
(1) DL and (2) Fiddle in Ruby 1.9 before 1.9.3 patchlevel 426, and 2.0 before 2.0.0 patchlevel 195, do not perform taint checking for native functions, which allows context-dependent attackers to bypass intended $SAFE level restrictions.
Remediation
Install update from vendor's website.