Bug 4000 - ruby possibly missing security update for CVE-2010-0541 and CVE-2011-0188
Summary: ruby possibly missing security update for CVE-2010-0541 and CVE-2011-0188
Status: RESOLVED DUPLICATE of bug 4031
Alias: None
Product: Mageia
Classification: Unclassified
Component: Security (show other bugs)
Version: 1
Hardware: i586 Linux
Priority: Normal normal
Target Milestone: ---
Assignee: Pascal Terjan
QA Contact:
URL:
Whiteboard:
Keywords: Triaged
Depends on:
Blocks:
 
Reported: 2012-01-01 21:55 CET by David Walser
Modified: 2012-02-13 00:32 CET (History)
2 users (show)

See Also:
Source RPM: ruby-1.8.7.p334-1.mga1.src.rpm
CVE:
Status comment:

Attachments
Add an attachment (proposed patch, testcase, etc.)

Description David Walser 2012-01-01 21:55:57 CET 
Mandriva issued this advisory on May 23:
http://lists.mandriva.com/security-announce/2011-05/msg00022.php

It is not totally clear which versions of Ruby are vulnerable to these, but our Ruby package is from February 20.  The other two CVEs are fixed in p334.
Comment 1 Manuel Hiebel 2012-01-01 23:14:35 CET 
Hi, thanks for reporting this bug.
Assigned to the package maintainer.

(Please set the status to 'assigned' if you are working on it)

Keywords: (none) => Triaged
CC: (none) => pterjan

Manuel Hiebel 2012-01-02 00:14:12 CET

Assignee: bugsquad => pterjan

Comment 2 Manuel Hiebel 2012-01-16 17:05:35 CET 
Ping ?

CC: (none) => shikamaru

Comment 3 Manuel Hiebel 2012-02-01 11:44:42 CET 
Ping ?
Comment 4 Pascal Terjan 2012-02-12 20:42:47 CET 
CVE-2010-0541 is very old and was fixed in Ruby 1.8.7-p299

CVE-2011-0188 was fixed upstream by http://svn.ruby-lang.org/cgi-bin/viewvc.cgi/trunk/ext/bigdecimal/bigdecimal.c?r1=29364&r2=30993&view=patch

Backport by Debian for easy inclusion in the package: http://patch-tracker.debian.org/patch/series/view/ruby1.8/1.8.7.352-2/110703_CVE-2011-0188.patch
Comment 5 Pascal Terjan 2012-02-13 00:32:38 CET 
Merged with bug #4031

*** This bug has been marked as a duplicate of bug 4031 ***

Status: NEW => RESOLVED
Resolution: (none) => DUPLICATE
Note You need to log in before you can comment on or make changes to this bug.