Your message dated Wed, 23 Jul 2008 07:52:18 +0000
with message-id <[EMAIL PROTECTED]>
and subject line Bug#487238: fixed in ruby1.8 1.8.5-4etch2
has caused the Debian Bug report #487238,
regarding ruby1.8: Arbitrary code execution vulnerability and so on
to be marked as done.
This means that you claim that the problem has been dealt with.
If this is not the case it is now your responsibility to reopen the
Bug report if necessary, and/or fix the problem forthwith.
(NB: If you are a system administrator and have no idea what this
message is talking about, this may indicate a serious mail system
misconfiguration somewhere. Please contact [EMAIL PROTECTED]
immediately.)
--
487238: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=487238
Debian Bug Tracking System
Contact [EMAIL PROTECTED] with problems
--- Begin Message ---
Package: ruby1.8
Version: 1.8.6.114-2
Severity: grave
Tags: security
Justification: user security hole
The upstream has announced multiple vulnerabilities in Ruby. They may lead
to a denial of service (DoS) condition or allow execution of arbitrary code.
* CVE-2008-2662
* CVE-2008-2663
* CVE-2008-2725
* CVE-2008-2726
* CVE-2008-2727
* CVE-2008-2728
* CVE-2008-2664
Vulnerable versions
1.8 series
* 1.8.4 and all prior versions
* 1.8.5-p230 and all prior versions
* 1.8.6-p229 and all prior versions
* 1.8.7-p21 and all prior versions
1.9 series
* 1.9.0-1 and all prior versions
-- System Information:
Debian Release: lenny/sid
APT prefers testing
APT policy: (990, 'testing'), (500, 'stable'), (90, 'unstable'), (1,
'experimental')
Architecture: i386 (i686)
Kernel: Linux 2.6.24-1-686 (SMP w/2 CPU cores)
Locale: LANG=ja_JP.eucJP, LC_CTYPE=ja_JP.eucJP (charmap=EUC-JP)
Shell: /bin/sh linked to /bin/bash
Versions of packages ruby1.8 depends on:
ii libc6 2.7-10 GNU C Library: Shared libraries
ii libruby1.8 1.8.6.114-2 Libraries necessary to run Ruby 1.
ruby1.8 recommends no packages.
-- no debconf information
--- End Message ---
--- Begin Message ---
Source: ruby1.8
Source-Version: 1.8.5-4etch2
We believe that the bug you reported is fixed in the latest version of
ruby1.8, which is due to be installed in the Debian FTP archive:
irb1.8_1.8.5-4etch2_all.deb
to pool/main/r/ruby1.8/irb1.8_1.8.5-4etch2_all.deb
libdbm-ruby1.8_1.8.5-4etch2_i386.deb
to pool/main/r/ruby1.8/libdbm-ruby1.8_1.8.5-4etch2_i386.deb
libgdbm-ruby1.8_1.8.5-4etch2_i386.deb
to pool/main/r/ruby1.8/libgdbm-ruby1.8_1.8.5-4etch2_i386.deb
libopenssl-ruby1.8_1.8.5-4etch2_i386.deb
to pool/main/r/ruby1.8/libopenssl-ruby1.8_1.8.5-4etch2_i386.deb
libreadline-ruby1.8_1.8.5-4etch2_i386.deb
to pool/main/r/ruby1.8/libreadline-ruby1.8_1.8.5-4etch2_i386.deb
libruby1.8-dbg_1.8.5-4etch2_i386.deb
to pool/main/r/ruby1.8/libruby1.8-dbg_1.8.5-4etch2_i386.deb
libruby1.8_1.8.5-4etch2_i386.deb
to pool/main/r/ruby1.8/libruby1.8_1.8.5-4etch2_i386.deb
libtcltk-ruby1.8_1.8.5-4etch2_i386.deb
to pool/main/r/ruby1.8/libtcltk-ruby1.8_1.8.5-4etch2_i386.deb
rdoc1.8_1.8.5-4etch2_all.deb
to pool/main/r/ruby1.8/rdoc1.8_1.8.5-4etch2_all.deb
ri1.8_1.8.5-4etch2_all.deb
to pool/main/r/ruby1.8/ri1.8_1.8.5-4etch2_all.deb
ruby1.8-dev_1.8.5-4etch2_i386.deb
to pool/main/r/ruby1.8/ruby1.8-dev_1.8.5-4etch2_i386.deb
ruby1.8-elisp_1.8.5-4etch2_all.deb
to pool/main/r/ruby1.8/ruby1.8-elisp_1.8.5-4etch2_all.deb
ruby1.8-examples_1.8.5-4etch2_all.deb
to pool/main/r/ruby1.8/ruby1.8-examples_1.8.5-4etch2_all.deb
ruby1.8_1.8.5-4etch2.diff.gz
to pool/main/r/ruby1.8/ruby1.8_1.8.5-4etch2.diff.gz
ruby1.8_1.8.5-4etch2.dsc
to pool/main/r/ruby1.8/ruby1.8_1.8.5-4etch2.dsc
ruby1.8_1.8.5-4etch2_i386.deb
to pool/main/r/ruby1.8/ruby1.8_1.8.5-4etch2_i386.deb
A summary of the changes between this version and the previous one is
attached.
Thank you for reporting the bug, which will now be closed. If you
have further comments please address them to [EMAIL PROTECTED],
and the maintainer will reopen the bug report if appropriate.
Debian distribution maintenance software
pp.
akira yamada <[EMAIL PROTECTED]> (supplier of updated ruby1.8 package)
(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing [EMAIL PROTECTED])
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
Format: 1.7
Date: Thu, 10 Jul 2008 14:58:13 +0900
Source: ruby1.8
Binary: libtcltk-ruby1.8 libruby1.8-dbg rdoc1.8 libgdbm-ruby1.8 ruby1.8-dev
ruby1.8-elisp ruby1.8-examples libdbm-ruby1.8 irb1.8 ruby1.8
libreadline-ruby1.8 libopenssl-ruby1.8 libruby1.8 ri1.8
Architecture: source i386 all
Version: 1.8.5-4etch2
Distribution: stable-security
Urgency: low
Maintainer: akira yamada <[EMAIL PROTECTED]>
Changed-By: akira yamada <[EMAIL PROTECTED]>
Description:
irb1.8 - Interactive Ruby (for Ruby 1.8)
libdbm-ruby1.8 - DBM interface for Ruby 1.8
libgdbm-ruby1.8 - GDBM interface for Ruby 1.8
libopenssl-ruby1.8 - OpenSSL interface for Ruby 1.8
libreadline-ruby1.8 - Readline interface for Ruby 1.8
libruby1.8 - Libraries necessary to run Ruby 1.8
libruby1.8-dbg - Debugging symbols for Ruby 1.8
libtcltk-ruby1.8 - Tcl/Tk interface for Ruby 1.8
rdoc1.8 - Generate documentation from Ruby source files (for Ruby 1.8)
ri1.8 - Ruby Interactive reference (for Ruby 1.8)
ruby1.8 - Interpreter of object-oriented scripting language Ruby 1.8
ruby1.8-dev - Header files for compiling extension modules for the Ruby 1.8
ruby1.8-elisp - ruby-mode for Emacsen
ruby1.8-examples - Examples for Ruby 1.8
Closes: 487238
Changes:
ruby1.8 (1.8.5-4etch2) stable-security; urgency=low
.
* applied debian/patches/165_CVE-2008-2662,2663,2664,2725,2726.patch and
appiled debian/patches/166_CVE-2008-2376.patch:
- security fixes for CVE-2008-2662, CVE-2008-2663, CVE-2008-2664,
CVE-2008-2725, CVE-2008-2726, CVE-2008-2376.
(Closes: #487238)
Files:
02286e0f1885c65a9d1fdad5bd933ac7 1079 interpreters optional
ruby1.8_1.8.5-4etch2.dsc
f55f4e2a0ca298d6312a8e3c4618da0f 100878 interpreters optional
ruby1.8_1.8.5-4etch2.diff.gz
fd84d502e12c0ed9dcb9931533bedf14 217452 interpreters optional
ruby1.8_1.8.5-4etch2_i386.deb
e554018801428fcc8a0eb270cecbe0a1 1529512 libs optional
libruby1.8_1.8.5-4etch2_i386.deb
9f9723f995389d89c8edff650cd80572 1002688 libdevel extra
libruby1.8-dbg_1.8.5-4etch2_i386.deb
eb2bb629d207bdb94513224cd696133a 719152 devel optional
ruby1.8-dev_1.8.5-4etch2_i386.deb
cc0255b2d30f2868b3a35131baea785e 197152 interpreters optional
libdbm-ruby1.8_1.8.5-4etch2_i386.deb
8dda63e50264e70657c900bf0e31268a 197870 interpreters optional
libgdbm-ruby1.8_1.8.5-4etch2_i386.deb
23448fa802f56b0353e146dd95798b40 197458 interpreters optional
libreadline-ruby1.8_1.8.5-4etch2_i386.deb
cfe09cb1dee2dc0ec663b764016c5c41 1830888 interpreters optional
libtcltk-ruby1.8_1.8.5-4etch2_i386.deb
669ff5d31b18e684695fcc585bbcf37d 292002 interpreters optional
libopenssl-ruby1.8_1.8.5-4etch2_i386.deb
11359f9774006c02ca68402b1a6c021e 242330 interpreters optional
ruby1.8-examples_1.8.5-4etch2_all.deb
76ab42ff282540121b1ffa23b8c34208 209874 interpreters optional
ruby1.8-elisp_1.8.5-4etch2_all.deb
cacd1dfc0b53e163adf3090175d85260 1228716 interpreters optional
ri1.8_1.8.5-4etch2_all.deb
0d08bd3d9b467f82df59811dcb4ffd10 309932 doc optional
rdoc1.8_1.8.5-4etch2_all.deb
d1f242b11d00199ecedf64cac2c6ac44 235238 interpreters optional
irb1.8_1.8.5-4etch2_all.deb
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.6 (GNU/Linux)
iD8DBQFIg50SXm3vHE4uyloRAhdxAJ9pvZg7GAMxmcPAAmIgv5ZswCLhvwCguXNi
LHk4xKjGGi9W8drE9OZLxoA=
=RoRu
-----END PGP SIGNATURE-----
--- End Message ---
