FreshPorts - VuXML

The official ruby site reports:

WEBrick have had a cross-site scripting vulnerability that allows an attacker to inject arbitrary script or HTML via a crafted URI. This does not affect user agents that strictly implement HTTP/1.1, however, some user agents do not.

ge 1.8.*,1 lt 1.8.7.248_3,1

ge 1.9.*,1 lt 1.9.1.430,1

The official ruby site reports:

Multiple vulnerabilities in Ruby may lead to a denial of service (DoS) condition or allow execution of arbitrary code.

ge 1.8.*,1 lt 1.8.6.111_3,1

ge 1.8.*,1

The official ruby site reports:

A denial of service (DoS) vulnerability was found on the BigDecimal standard library of Ruby. Conversion from BigDecimal objects into Float numbers had a problem which enables attackers to effectively cause segmentation faults.

An attacker can cause a denial of service by causing BigDecimal to parse an insanely large number, such as:

BigDecimal("9E69999999").to_s("F")

ge 1.8.*,1 lt 1.8.7.160_1,1

The official ruby site reports:

resolv.rb allow remote attackers to spoof DNS answers. This risk can be reduced by randomness of DNS transaction IDs and source ports.

ge 1.8.*,1 lt 1.8.6.111_5,1

ge 1.9.*,1 lt 1.9.1.0,1

The official ruby site reports:

Another vulnerability has been discovered in the CGI library (cgi.rb) that ships with Ruby which could be used by a malicious user to create a denial of service attack (DoS).

A specific HTTP request for any web application using cgi.rb causes CPU consumption on the machine on which the web application is running. Many such requests result in a denial of service.

ge 1.8.*,1 lt 1.8.5_5,1

ge 1.8.*,1

Official ruby site reports:

A vulnerability has been discovered in the CGI library (cgi.rb) that ships with Ruby which could be used by a malicious user to create a denial of service attack (DoS). The problem is triggered by sending the library an HTTP request that uses multipart MIME encoding and as an invalid boundary specifier that begins with "-" instead of "--". Once triggered it will exhaust all available memory resources effectively creating a DoS condition.

ge 1.8.*,1 lt 1.8.5_4,1

ge 1.8.*,1

The official ruby site reports:

Several vulnerabilities in safe level have been discovereds:.

• untrace_var is permitted at safe level 4;
• $PROGRAM_NAME may be modified at safe level 4;
• insecure methods may be called at safe level 1-3;
• syslog operations are permitted at safe level 4;
• dl doesn't check taintness, so it could allow attackers to call dangerous functions.

ge 1.8.*,1 lt 1.8.6.287,1

ge 1.9.*,1 lt 1.9.1.0,1

The official ruby site reports:

WEBrick::HTTP::DefaultFileHandler is faulty of exponential time taking requests due to a backtracking regular expression in WEBrick::HTTPUtils.split_header_value.

ge 1.8.*,1 lt 1.8.6.111_5,1

ge 1.9.*,1 lt 1.9.1.0,1