[prev in list] [next in list] [prev in thread] [next in thread] 

List:       oss-security
Subject:    Re: [oss-security] CVE request: Two ruby 'dl' vulnerabilities fixed in ruby-1.9.1-p129
From:       Reed Loden <reed () reedloden ! com>
Date:       2015-07-29 21:48:27
Message-ID: CALPTtNWfcr-Y6XTM9yphQ5xVkOKTYJ_vWLaOLw4972afNQhPOw () mail ! gmail ! com
[Download RAW message or body]


On Tue, Jul 28, 2015 at 5:39 AM, Jan Rusnacko <jrusnack@redhat.com> wrote:

> On 07/28/2015 11:44 AM, Reed Loden wrote:
> > * DL::Function#call could pass tainted arguments to a C function even if
> > $SAFE > 0.
> >
> https://github.com/ruby/ruby/commit/7269e3de3cee3bbb6ab77fc708f3a10cab00b65e
> Could this be related to CVE-2013-2065 ?
>
>
> https://www.ruby-lang.org/en/news/2013/05/14/taint-bypass-dl-fiddle-cve-2013-2065/


For the record, CVE-2013-2065 is
https://github.com/ruby/ruby/commit/c7d7ff45f1e0d6fad28e53c02108d4b067e843c3
.

~reed


[prev in list] [next in list] [prev in thread] [next in thread]