Test ID:	1.3.6.1.4.1.25623.1.1.1.2.2014.88
Category:	Debian Local Security Checks
Title:	Debian: Security Advisory (DLA-88-1)
Summary:	The remote host is missing an update for the Debian 'ruby1.8' package(s) announced via the DLA-88-1 advisory.
Description:	Summary: The remote host is missing an update for the Debian 'ruby1.8' package(s) announced via the DLA-88-1 advisory. Vulnerability Insight: This update fixes multiple local and remote denial of service and remote code execute problems: CVE-2011-0188 Properly allocate memory, to prevent arbitrary code execution or application crash. Reported by Drew Yao. CVE-2011-2686 Reinitialize the random seed when forking to prevent CVE-2003-0900 like situations. CVE-2011-2705 Modify PRNG state to prevent random number sequence repeatation at forked child process which has same pid. Reported by Eric Wong. CVE-2011-4815 Fix a problem with predictable hash collisions resulting in denial of service (CPU consumption) attacks. Reported by Alexander Klink and Julian Waelde. CVE-2014-8080 Fix REXML parser to prevent memory consumption denial of service via crafted XML documents. Reported by Willis Vandevanter. CVE-2014-8090 Add REXML::Document#document to complement the fix for CVE-2014-8080. Reported by Tomas Hoger. For Debian 6 Squeeze, these issues have been fixed in ruby1.8 version 1.8.7.302-2squeeze3 Affected Software/OS: 'ruby1.8' package(s) on Debian 6. Solution: Please install the updated package(s). CVSS Score: 7.8 CVSS Vector: AV:N/AC:L/Au:N/C:N/I:N/A:C
Cross-Ref:	Common Vulnerability Exposure (CVE) ID: CVE-2011-0188 http://lists.apple.com/archives/security-announce/2011/Mar/msg00006.html http://www.mandriva.com/security/advisories?name=MDVSA-2011:097 http://www.mandriva.com/security/advisories?name=MDVSA-2011:098 http://www.redhat.com/support/errata/RHSA-2011-0908.html http://www.redhat.com/support/errata/RHSA-2011-0909.html http://www.redhat.com/support/errata/RHSA-2011-0910.html http://www.securitytracker.com/id?1025236 Common Vulnerability Exposure (CVE) ID: CVE-2011-2686 49015 http://www.securityfocus.com/bid/49015 FEDORA-2011-9359 http://lists.fedoraproject.org/pipermail/package-announce/2011-July/063071.html FEDORA-2011-9374 http://lists.fedoraproject.org/pipermail/package-announce/2011-July/063062.html [oss-security] 20110711 CVE Request: ruby PRNG fixes http://www.openwall.com/lists/oss-security/2011/07/11/1 [oss-security] 20110712 Re: CVE Request: ruby PRNG fixes http://www.openwall.com/lists/oss-security/2011/07/12/14 [oss-security] 20110720 Re: CVE Request: ruby PRNG fixes http://www.openwall.com/lists/oss-security/2011/07/20/1 http://www.openwall.com/lists/oss-security/2011/07/20/16 http://redmine.ruby-lang.org/issues/show/4338 http://svn.ruby-lang.org/cgi-bin/viewvc.cgi?view=revision&revision=31713 http://svn.ruby-lang.org/repos/ruby/tags/v1_8_7_352/ChangeLog http://www.ruby-lang.org/en/news/2011/07/02/ruby-1-8-7-p352-released/ https://bugzilla.redhat.com/show_bug.cgi?id=722415 ruby-random-number-dos(69032) https://exchange.xforce.ibmcloud.com/vulnerabilities/69032 Common Vulnerability Exposure (CVE) ID: CVE-2011-2705 RHSA-2011:1581 http://www.redhat.com/support/errata/RHSA-2011-1581.html http://redmine.ruby-lang.org/issues/4579 http://svn.ruby-lang.org/cgi-bin/viewvc.cgi?view=revision&revision=32050 http://svn.ruby-lang.org/repos/ruby/tags/v1_9_2_290/ChangeLog http://www.ruby-lang.org/en/news/2011/07/15/ruby-1-9-2-p290-is-released/ Common Vulnerability Exposure (CVE) ID: CVE-2011-4815 http://lists.apple.com/archives/security-announce/2012/May/msg00001.html Bugtraq: 20111228 n.runs-SA-2011.004 - web programming languages and platforms - DoS through hash table (Google Search) http://archives.neohapsis.com/archives/bugtraq/2011-12/0181.html CERT/CC vulnerability note: VU#903934 http://www.kb.cert.org/vuls/id/903934 http://jvn.jp/en/jp/JVN90615481/index.html http://jvndb.jvn.jp/ja/contents/2012/JVNDB-2012-000066.html http://www.nruns.com/_downloads/advisory28122011.pdf http://www.ocert.org/advisories/ocert-2011-003.html http://blade.nagaokaut.ac.jp/cgi-bin/scat.rb/ruby/ruby-talk/391606 RedHat Security Advisories: RHSA-2012:0069 http://rhn.redhat.com/errata/RHSA-2012-0069.html RedHat Security Advisories: RHSA-2012:0070 http://rhn.redhat.com/errata/RHSA-2012-0070.html http://www.securitytracker.com/id?1026474 http://secunia.com/advisories/47405 http://secunia.com/advisories/47822 XForce ISS Database: ruby-hash-dos(72020) https://exchange.xforce.ibmcloud.com/vulnerabilities/72020 Common Vulnerability Exposure (CVE) ID: CVE-2014-8080 http://lists.apple.com/archives/security-announce/2015/Sep/msg00008.html BugTraq ID: 70935 http://www.securityfocus.com/bid/70935 Debian Security Information: DSA-3157 (Google Search) http://www.debian.org/security/2015/dsa-3157 Debian Security Information: DSA-3159 (Google Search) http://www.debian.org/security/2015/dsa-3159 http://www.mandriva.com/security/advisories?name=MDVSA-2015:129 RedHat Security Advisories: RHSA-2014:1911 http://rhn.redhat.com/errata/RHSA-2014-1911.html RedHat Security Advisories: RHSA-2014:1912 http://rhn.redhat.com/errata/RHSA-2014-1912.html RedHat Security Advisories: RHSA-2014:1913 http://rhn.redhat.com/errata/RHSA-2014-1913.html RedHat Security Advisories: RHSA-2014:1914 http://rhn.redhat.com/errata/RHSA-2014-1914.html http://secunia.com/advisories/61607 http://secunia.com/advisories/62050 http://secunia.com/advisories/62748 SuSE Security Announcement: openSUSE-SU-2014:1589 (Google Search) http://lists.opensuse.org/opensuse-updates/2014-12/msg00035.html SuSE Security Announcement: openSUSE-SU-2015:0002 (Google Search) http://lists.opensuse.org/opensuse-updates/2015-01/msg00000.html SuSE Security Announcement: openSUSE-SU-2015:0007 (Google Search) http://lists.opensuse.org/opensuse-updates/2015-01/msg00004.html http://www.ubuntu.com/usn/USN-2397-1 Common Vulnerability Exposure (CVE) ID: CVE-2014-8090 BugTraq ID: 71230 http://www.securityfocus.com/bid/71230 http://secunia.com/advisories/59948 http://www.ubuntu.com/usn/USN-2412-1
Copyright	Copyright (C) 2023 Greenbone AG

This is only one of 145615 vulnerability tests in our test suite. Find out more about running a complete security audit. To run a free test of this vulnerability against your system, register below.