Most recent entries from all

ALSA-2024:3500 — Moderate: ruby:3.0 security update

Affected: AlmaLinux:8: ruby, AlmaLinux:8: ruby-default-gems, AlmaLinux:8: ruby-devel, AlmaLinux:8: ruby-doc, AlmaLinux:8: ruby-libs, AlmaLinux:8: rubygem-abrt, AlmaLinux:8: rubygem-abrt-doc, AlmaLinux:8: rubygem-bigdecimal, AlmaLinux:8: rubygem-bundler, AlmaLinux:8: rubygem-io-console and 18 more

Ruby is an extensible, interpreted, object-oriented, scripting language. It has features to process text files and to perform system management tasks.

Security Fix(es):

* ruby/cgi-gem: HTTP response splitting in CGI (CVE-2021-33621) * ruby: ReDoS vulnerability in URI (CVE-2023-28755) * ruby: ReDoS vulnerability in Time (CVE-2023-28756) * ruby: RCE vulnerability with .rdoc_options in RDoc (CVE-2024-27281) * ruby: Buffer overread vulnerability in StringIO (CVE-2024-27280) * ruby: Arbitrary memory address read vulnerability with Regex search (CVE-2024-27282)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

bdu:2024-03599

BELL-CVE-2024-27282

Affected: Alpaquita:23: ruby, Alpaquita:stream: ruby

BIT-ruby-2024-27282

Affected: Bitnami: ruby

An issue was discovered in Ruby 3.x through 3.3.0. If attacker-supplied data is provided to the Ruby regex compiler, it is possible to extract arbitrary heap data relative to the start of the text, including pointers and sensitive strings. The fixed versions are 3.0.7, 3.1.5, 3.2.4, and 3.3.1.

certfr-2025-avi-0055 — De multiples vulnérabilités ont été découvertes dans Oracle PeopleSoft. Elles permettent à un attaquant de provoquer un…

certfr-2025-avi-0055

CLEANSTART-2026-LA33786 — Security fix for CVE-2024-27282 applied in: ruby 3.3.1-r0

Affected: CleanStart: ruby

Security vulnerability affects the ruby package. This issue is resolved in later releases. See references for vulnerability details.

EUVD-2026-259032

fkie_cve-2024-27282

GHSA-63cq-cj6g-qfr2

gsd-2024-27282

msrc_CVE-2024-27282 — An issue was discovered in Ruby 3.x through 3.3.0. If attacker-supplied data is provided to the Ruby regex compiler it…

msrc_CVE-2024-27282

OESA-2024-1545 — ruby security update

Affected: openEuler:20.03-LTS-SP1: ruby

Ruby is a fast and easy interpreted scripting language for object-oriented programming. It has many functions for processing text Files and perform system management tasks (such as Perl). Security Fix(es): An issue was discovered in Ruby 3.x through 3.3.0. If attacker-supplied data is provided to the Ruby regex compiler, it is possible to extract arbitrary heap data relative to the start of the text, including pointers and sensitive strings. The fixed versions are 3.0.7, 3.1.5, 3.2.4, and 3.3.1.(CVE-2024-27282)

RHSA-2024:3500 — Red Hat Security Advisory: ruby:3.0 security update

ruby/cgi-gem: HTTP response splitting in CGI ruby: ReDoS vulnerability in URI ruby: ReDoS vulnerability in Time ruby: Buffer overread vulnerability in StringIO ruby: RCE vulnerability with .rdoc_options in RDoc ruby: Arbitrary memory address read vulnerability with Regex search

RHSA-2026:7305 — Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update

ruby: WEBrick CGI source disclosure ruby: Integer overflows in rb_str_buf_append() ruby: Integer overflows in rb_ary_store() ruby: Unsafe use of alloca in rb_str_format() ruby: integer overflow in rb_ary_splice/update/replace() - REALLOC_N ruby: integer overflow in rb_ary_splice/update/replace() - beg + rlen ruby: multiple insufficient safe mode restrictions ruby: WEBrick DoS vulnerability (CPU consumption) ruby: missing "taintness" checks in dl module ruby: use of predictable source port and transaction id in DNS requests done by resolv.rb module ruby: dlopen could open a library with tainted library name ruby: memory corruption in BigDecimal on 64bit platforms ruby: Properly initialize the random number generator when forking new process ruby: Properly initialize the random number generator when forking new process ruby: Properly initialize the random number generator when forking new process ruby: hash table collisions CPU usage DoS (oCERT-2011-003) ruby: Murmur hash-flooding DoS flaw in ruby 1.9 (oCERT-2012-001) ruby: entity expansion DoS vulnerability in REXML ruby: off-by-one stack-based buffer overflow in the encodes() function ruby: Unsafe parsing of long strings via decode_www_form_component method ruby: REXML billion laughs attack via parameter entity expansion ruby: REXML incomplete fix for CVE-2014-8080 ruby: dlopen could open a library with tainted library name ruby: SMTP command injection via CRLF sequences in RCPT TO or MAIL FROM commands in Net::SMTP ruby: Es…

UBUNTU-CVE-2024-27282

Affected: Ubuntu:Pro:14.04:LTS: jruby, Ubuntu:Pro:16.04:LTS: ruby2.3, Ubuntu:16.04:LTS: jruby, Ubuntu:Pro:18.04:LTS: ruby2.5, Ubuntu:18.04:LTS: jruby, Ubuntu:20.04:LTS: ruby2.7, Ubuntu:20.04:LTS: jruby, Ubuntu:22.04:LTS: ruby3.0, Ubuntu:24.04:LTS: jruby, Ubuntu:24.04:LTS: ruby3.2 and 2 more

WID-SEC-W-2024-0952 — Ruby: Schwachstelle ermöglicht Offenlegung von Informationen

Ein lokaler Angreifer kann eine Schwachstelle in Ruby ausnutzen, um Informationen offenzulegen.