Most recent entries from all

ALSA-2024:4499 — Moderate: ruby security update

Affected: AlmaLinux:8: ruby, AlmaLinux:8: ruby-devel, AlmaLinux:8: ruby-doc, AlmaLinux:8: ruby-irb, AlmaLinux:8: ruby-libs, AlmaLinux:8: rubygem-abrt, AlmaLinux:8: rubygem-abrt-doc, AlmaLinux:8: rubygem-bigdecimal, AlmaLinux:8: rubygem-bson, AlmaLinux:8: rubygem-bson-doc and 22 more

Ruby is an extensible, interpreted, object-oriented, scripting language. It has features to process text files and to perform system management tasks.

Security Fix(es):

* rubygem-uri: ReDoS vulnerability - upstream's incomplete fix for CVE-2023-28755 (CVE-2023-36617) * ruby: Buffer overread vulnerability in StringIO (CVE-2024-27280) * ruby: RCE vulnerability with .rdoc_options in RDoc (CVE-2024-27281) * ruby: Arbitrary memory address read vulnerability with Regex search (CVE-2024-27282) * REXML: DoS parsing an XML with many `<`s in an attribute value (CVE-2024-35176)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

bdu:2024-08622

BREW-asciidoctor-CVE-2024-35176 — REXML contains a denial of service vulnerability

Affected: Homebrew: asciidoctor

### Impact

The REXML gem before 3.2.6 has a DoS vulnerability when it parses an XML that has many `>`s in an attribute value.

If you need to parse untrusted XMLs, you may be impacted to this vulnerability.

### Patches

The REXML gem 3.2.7 or later include the patch to fix this vulnerability.

### Workarounds

Don't parse untrusted XMLs.

### References

* https://www.ruby-lang.org/en/news/2024/05/16/dos-rexml-cve-2024-35176/

certfr-2024-avi-0923 — De multiples vulnérabilités ont été découvertes dans les produits IBM. Certaines d'entre elles permettent à un attaquan…

certfr-2024-avi-0923

EUVD-2026-258128

fkie_cve-2024-35176

REXML is an XML toolkit for Ruby. The REXML gem before 3.2.6 has a denial of service vulnerability when it parses an XML that has many `<`s in an attribute value. Those who need to parse untrusted XMLs may be impacted to this vulnerability. The REXML gem 3.2.7 or later include the patch to fix this vulnerability. As a workaround, don't parse untrusted XMLs.

GHSA-vg3r-rm7w-2xgh — REXML contains a denial of service vulnerability

Affected: RubyGems: rexml

### Impact

The REXML gem before 3.2.6 has a DoS vulnerability when it parses an XML that has many `>`s in an attribute value.

If you need to parse untrusted XMLs, you may be impacted to this vulnerability.

### Patches

The REXML gem 3.2.7 or later include the patch to fix this vulnerability.

### Workarounds

Don't parse untrusted XMLs.

### References

* https://www.ruby-lang.org/en/news/2024/05/16/dos-rexml-cve-2024-35176/

msrc_CVE-2024-35176 — REXML contains a denial of service vulnerability

msrc_CVE-2024-35176

OESA-2024-1824 — ruby security update

Affected: openEuler:22.03-LTS-SP3: ruby, openEuler:20.03-LTS-SP4: ruby, openEuler:24.03-LTS: ruby, openEuler:22.03-LTS-SP4: ruby, openEuler:22.03-LTS-SP1: ruby

Ruby is a fast and easy interpreted scripting language for object-oriented programming. It has many functions for processing text Files and perform system management tasks (such as Perl).

Security Fix(es):

openSUSE-SU-2025:0129-1 — Security update for rubygem-rexml

Security update for rubygem-rexml

UBUNTU-CVE-2024-35176

Affected: Ubuntu:Pro:14.04:LTS: jruby, Ubuntu:Pro:16.04:LTS: ruby2.3, Ubuntu:16.04:LTS: jruby, Ubuntu:Pro:18.04:LTS: ruby2.5, Ubuntu:18.04:LTS: jruby, Ubuntu:20.04:LTS: ruby2.7, Ubuntu:20.04:LTS: jruby, Ubuntu:22.04:LTS: ruby3.0, Ubuntu:24.04:LTS: jruby, Ubuntu:24.04:LTS: ruby3.2 and 2 more

WID-SEC-W-2024-1465 — IBM License Metric Tool: Schwachstelle ermöglicht Denial of Service

Ein entfernter, anonymer Angreifer kann eine Schwachstelle in IBM License Metric Tool ausnutzen, um einen Denial of Service Angriff durchzuführen.