[DRE-maint] [Bug 1098357] Re: update libextlib-ruby/ruby-extlib packages for CVE-2013-0156

Thomas Ward teward at trekweb.org
Fri Jan 11 02:46:57 UTC 2013


Do you happen to know which version(s) of the library are impacted by
this CVE?

** CVE added: http://www.cve.mitre.org/cgi-
bin/cvename.cgi?name=2013-0156

-- 
You received this bug notification because you are subscribed to Ubuntu.
https://bugs.launchpad.net/bugs/1098357

Title:
  update libextlib-ruby/ruby-extlib packages for CVE-2013-0156

Status in “libextlib-ruby” package in Ubuntu:
  New
Status in “libextlib-ruby” package in Debian:
  Unknown

Bug description:
  Dan Kubb, maintainer of the extlib RubyGem recently updated it to
  resolve security issues reported in CVE-2013-0156.

  The patches are are available from the extlib Git repository on GitHub
  to remove symbol and yaml coercion, respectively:

  https://github.com/datamapper/extlib/commit/4540e7102b803624cc2eade4bb8aaaa934fc31c5
  https://github.com/datamapper/extlib/commit/633974b2759d9b924657f3888473d5fd681538dd

To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/libextlib-ruby/+bug/1098357/+subscriptions





More information about the Pkg-ruby-extras-maintainers mailing list