--==============91116765=Content-Type: multipart/alternative; boundary1636c5b351c9a6bf046d177731

--001636c5b351c9a6bf046d177731
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 7bit

------------------------------------------------------------------------
Pardus Linux Security Advisory 2009-93            security@pardus.org.tr
------------------------------------------------------------------------

      Date: 2009-06-24
  Severity: 3
      Type: Remote
------------------------------------------------------------------------

Summary
======
A vulnerability has been reported in Ruby, which can  be  exploited  by

malicious people to cause a DoS (Denial of Service).


Description
==========
The vulnerability is caused due  to  an  error  within  the  BigDecimal
standard library when trying to e.g. convert  BigDecimal  objects  into

floating point numbers. This can be exploited to crash  an  application
using this library.



Affected packages:

  Pardus 2008:
    ruby, all before 1.8.7_p173-19-7
    ruby-mode, all before 1.8.7_p173-19-7



Resolution
=========
There are update(s) for ruby, ruby-mode. You can update them via Package
Manager or with a single command from console:

    pisi up ruby ruby-mode

References

=========
  * http://bugs.pardus.org.tr/show_bug.cgi?id™83
  * http://www.ruby-lang.org/en/news/2009/06/09/dos-vulnerability-in-bigdecimal/

  * http://redmine.ruby-lang.org/issues/show/794
  * http://bugs.pardus.org.tr/show_bug.cgi?id™86