what you don't know can hurt you

Register | Login

FilesNewsUsersAuthors

Home Files News &[SERVICES_TAB]About Contact Add New

Mandriva Linux Security Advisory 2011-098

Posted May 23, 2011

Authored by Mandriva | Site mandriva.com

Mandriva Linux Security Advisory 2011-098 - Cross-site scripting vulnerability in the WEBrick HTTP server in Ruby allows remote attackers to inject arbitrary web script or HTML via a crafted URI that triggers a UTF-7 error page. The safe-level feature in Ruby allows context-dependent attackers to modify strings via the Exception#to_s method, as demonstrated by changing an intended pathname. The VpMemAlloc function in bigdecimal.c in the BigDecimal class in Ruby does not properly allocate memory, which allows context-dependent attackers to execute arbitrary code or cause a denial of service via vectors involving creation of a large BigDecimal value within a 64-bit process, related to an integer truncation issue. The updated packages have been patched to correct this issue.

tags | advisory, remote, web, denial of service, arbitrary, xss, ruby

systems | linux, mandriva

advisories | CVE-2010-0541, CVE-2011-1005, CVE-2011-0188

SHA-256 | c941433f0af830382d2f5cef03846e0594fa90093d37e8faa51dbc590703d07c

Download | Favorite | View

Related Files

No related files