[Secure-testing-team] Bug#628452: CVE-2011-0188: arbitrary code execution

[Steffen Joeris]

Package: ruby1.8
Version: 1.8.7.334-5
Severity: grave
Tags: security

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Hi,
the following CVE (Common Vulnerabilities & Exposures) id was
published for openswan.

CVE-2011-0188[0]:
| The VpMemAlloc function in bigdecimal.c in the BigDecimal class in
| Ruby 1.9.2-p136 and earlier, as used on Apple Mac OS X before 10.6.7
| and other platforms, does not properly allocate memory, which allows
| context-dependent attackers to execute arbitrary code or cause a
| denial of service (application crash) via vectors involving creation
| of a large BigDecimal value within a 64-bit process, related to an
| "integer truncation issue."

If you fix the vulnerability please also make sure to include the
CVE id in your changelog entry.

Cheers,
Steffen

For further information see:

[0] http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-0188
    http://security-tracker.debian.org/tracker/CVE-2011-0188

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.11 (GNU/Linux)

iEYEARECAAYFAk3hvxAACgkQ62zWxYk/rQdzMACgkYd/w/hd/UIKj2y3uddmmQcy
JtoAnRtpwM2sNlTPBKJkvvFHhskoqsch
=RvTy
-----END PGP SIGNATURE-----