MGASA-2014-0472

See a problem?
Please try reporting it to the source first.
Source
https://advisories.mageia.org/MGASA-2014-0472.html
Import Source
https://advisories.mageia.org/MGASA-2014-0472.json
JSON Data
https://api.osv.dev/v1/vulns/MGASA-2014-0472
Upstream
  • CVE-2014-4975
  • CVE-2014-8090
Published
2014-11-21T12:44:16Z
Modified
2026-04-16T06:26:07.444884199Z
Summary
Updated ruby packages fix security vulnerabilities
Details

Will Wood discovered that Ruby incorrectly handled the encodes() function. An attacker could possibly use this issue to cause Ruby to crash, resulting in a denial of service, or possibly execute arbitrary code. The default compiler options for affected releases should reduce the vulnerability to a denial of service (CVE-2014-4975).

Due to an incomplete fix for CVE-2014-8080, 100% CPU utilization can occur as a result of recursive expansion with an empty String. When reading text nodes from an XML document, the REXML parser in Ruby can be coerced into allocating extremely large string objects which can consume all of the memory on a machine, causing a denial of service (CVE-2014-8090).

References
Credits

Affected packages

Mageia:3 / ruby

Package

Name
ruby
Purl
pkg:rpm/mageia/ruby?arch=source&distro=mageia-3

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
1.9.3.p551-1.mga3

Ecosystem specific 

{
    "section": "core"
}

Database specific

source 
"https://advisories.mageia.org/MGASA-2014-0472.json"

Mageia:4 / ruby

Package

Name
ruby
Purl
pkg:rpm/mageia/ruby?arch=source&distro=mageia-4

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
2.0.0.p598-1.mga4

Ecosystem specific 

{
    "section": "core"
}

Database specific

source 
"https://advisories.mageia.org/MGASA-2014-0472.json"