SUSE-SU-2017:0948-1

HIGH8.4

Security update for ruby

Published Apr 6, 2017

Modified 9 years ago

Fix available

Details

Description of the patch:

This update for ruby fixes the following issues:

Secuirty issues fixed:

CVE-2015-1855: Ruby OpenSSL Hostname Verification (bsc#926974)
CVE-2015-7551: Unsafe tainted string usage in Fiddle and DL (bsc#959495)

Bugfixes:

fix small mistake in the backport for (bsc#986630)

Affected Packages

ruby-devel

SUSE Lifecycle Management Server 1.3SUSE Linux Enterprise Desktop 11 SP4SUSE Linux Enterprise Server 11 SP4SUSE Linux Enterprise Server for SAP Applications 11 SP4SUSE Linux Enterprise Software Development Kit 11 SP4

Fixed in:

1.8.7.p357-0.9.19.1

ruby-doc-html

SUSE Linux Enterprise Desktop 11 SP4SUSE Linux Enterprise Server 11 SP4SUSE Linux Enterprise Server for SAP Applications 11 SP4SUSE Linux Enterprise Software Development Kit 11 SP4

Fixed in:

1.8.7.p357-0.9.19.1

ruby-doc-ri

SUSE Linux Enterprise Desktop 11 SP4SUSE Linux Enterprise Server 11 SP4SUSE Linux Enterprise Server for SAP Applications 11 SP4SUSE Linux Enterprise Software Development Kit 11 SP4

Fixed in:

1.8.7.p357-0.9.19.1

ruby-examples

SUSE Linux Enterprise Desktop 11 SP4SUSE Linux Enterprise Server 11 SP4SUSE Linux Enterprise Server for SAP Applications 11 SP4SUSE Linux Enterprise Software Development Kit 11 SP4

Fixed in:

1.8.7.p357-0.9.19.1

ruby-test-suite

SUSE Linux Enterprise Desktop 11 SP4SUSE Linux Enterprise Server 11 SP4SUSE Linux Enterprise Server for SAP Applications 11 SP4SUSE Linux Enterprise Software Development Kit 11 SP4

Fixed in:

1.8.7.p357-0.9.19.1

ruby-tk

SUSE Linux Enterprise Desktop 11 SP4SUSE Linux Enterprise Server 11 SP4SUSE Linux Enterprise Server for SAP Applications 11 SP4SUSE Linux Enterprise Software Development Kit 11 SP4

Fixed in:

1.8.7.p357-0.9.19.1

References

https://bugzilla.suse.com/926974

https://bugzilla.suse.com/959495

https://bugzilla.suse.com/986630

https://lists.suse.com/pipermail/sle-security-updates/2017-April/002786.html

https://www.suse.com/security/cve/CVE-2015-1855/

https://www.suse.com/security/cve/CVE-2015-7551/

https://www.suse.com/support/security/rating/

https://www.suse.com/support/update/announcement/2017/suse-su-20170948-1/

CVSS Analysis

CVSS v3.0

8.4

Exploitability

Attack Vector

LocalAV:L

Attack Complexity

LowAC:L

Privileges Required

NonePR:N

User Interaction

NoneUI:N

Scope

Scope

UnchangedS:U

Impact

Confidentiality

HighC:H

Integrity

HighI:H

Availability

HighA:H

8.4/CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Upstream

CVE-2015-1855 CVE-2015-7551

Ecosystems(7)

SUSE Lifecycle Management Server 1.3 SUSE Linux Enterprise Desktop 11 SP4 SUSE Linux Enterprise Server 11 SP4 SUSE Linux Enterprise Server for SAP Applications 11 SP4 SUSE Linux Enterprise Software Development Kit 11 SP4

Timeline

PublishedApr 6, 2017

ModifiedApr 6, 2017

SUSE-SU-2017:0948-1 | Mondoo Vulnerability Intelligence