-------------------------------------------------------------------------------- Fedora Update Notification FEDORA-2013-22423 2013-12-01 08:09:56 --------------------------------------------------------------------------------
Name : ruby Product : Fedora 19 Version : 2.0.0.353 Release : 16.fc19 URL : http://ruby-lang.org/ Summary : An interpreter of object-oriented scripting language Description : Ruby is the interpreted scripting language for quick and easy object-oriented programming. It has many features to process text files and to do system management tasks (as in Perl). It is simple, straight-forward, and extensible.
-------------------------------------------------------------------------------- Update Information:
Update to Ruby 2.0.0-p353. This includes fix to an overflow in floating point number parsing found in Ruby currently being shipped on Fedora 20. This vulnerability has been assigned the CVE identifier CVE-2013-4164. This new rpm should fix this issue. -------------------------------------------------------------------------------- ChangeLog:
* Mon Nov 25 2013 Vít Ondruch vondruch@redhat.com - 2.0.0.353-16 - Update to Ruby 2.0.0-p353. - Fix heap overflow in floating point parsing (CVE-2013-4164). * Tue Jul 30 2013 Vít Ondruch vondruch@redhat.com - 2.0.0.247-15 - Move Psych symlinks to vendor dir, to prevent F18 -> F19 upgrade issues (rhbz#988490). * Mon Jul 15 2013 Vít Ondruch vondruch@redhat.com - 2.0.0.247-14 - Add forgotten psych.rb link into rubygem-psych to fix "private method `load' called for Psych:Moduler" error (rhbz#979133). * Thu Jul 11 2013 Vít Ondruch vondruch@redhat.com - 2.0.0.247-13 - Fixes multilib conlicts of .gemspec files. - Make symlinks for psych gem to ruby stdlib dirs (rhbz#979133). - Use system-wide cert.pem. * Thu Jul 4 2013 Vít Ondruch vondruch@redhat.com - 2.0.0.247-12 - Fix RubyGems search paths when building gems with native extension (rhbz#979133). * Tue Jul 2 2013 Vít Ondruch vondruch@redhat.com - 2.0.0.247-11 - Fix RubyGems version. * Tue Jul 2 2013 Vít Ondruch vondruch@redhat.com - 2.0.0.247-10 - Better support for build without configuration (rhbz#977941). * Mon Jul 1 2013 Vít Ondruch vondruch@redhat.com - 2.0.0.247-9 - Update to Ruby 2.0.0-p247 (rhbz#979605). - Fix CVE-2013-4073. - Fix for wrong makefiles created by mkmf (rhbz#921650). - Add support for ABRT autoloading. -------------------------------------------------------------------------------- References:
[ 1 ] Bug #1034122 - ruby-2.0.0.353 is available https://bugzilla.redhat.com/show_bug.cgi?id=1034122 [ 2 ] Bug #1033546 - CVE-2013-4164 ruby: heap overflow in floating point parsing [fedora-all] https://bugzilla.redhat.com/show_bug.cgi?id=1033546 --------------------------------------------------------------------------------
This update can be installed with the "yum" update program. Use su -c 'yum update ruby' at the command line. For more information, refer to "Managing Software with yum", available at http://docs.fedoraproject.org/yum/.
All packages are signed with the Fedora Project GPG key. More details on the GPG keys used by the Fedora Project can be found at https://fedoraproject.org/keys --------------------------------------------------------------------------------