File _patchinfo of Package patchinfo.4483
<patchinfo incident="4483"> <issue id="1014863" tracker="bnc">SUSEconnect doesn't handle domain wildcards in no_proxy environment variable properly</issue> <issue id="1018808" tracker="bnc">VUL-0: CVE-2016-2339: ruby19,ruby: heap overflow vulnerability in the Fiddle::Function.new"initialize"</issue> <issue id="887877" tracker="bnc">VUL-1: CVE-2014-4975: ruby20: off-by-one stack-based buffer overflow in the encodes() function</issue> <issue id="909695" tracker="bnc">segmentation fault after pack & ioctl & unpack</issue> <issue id="926974" tracker="bnc">VUL-0: CVE-2015-1855: ruby: Ruby OpenSSL Hostname Verification</issue> <issue id="936032" tracker="bnc">VUL-0: CVE-2015-3900: ruby,ruby19,ruby2.1: RubyGems 2.0.x before 2.0.16, 2.2.x before 2.2.4, and 2.4.x before 2.4.7 doesnot validate the hostn...</issue> <issue id="959495" tracker="bnc">VUL-0: CVE-2015-7551: ruby19,ruby: Unsafe tainted string usage in Fiddle and DL</issue> <issue id="986630" tracker="bnc">VUL-0: ruby19,ruby: Ruby:HTTP Header injection in 'net/http'</issue> <issue id="2016-2339" tracker="cve" /> <issue id="2014-4975" tracker="cve" /> <issue id="2015-1855" tracker="cve" /> <issue id="2015-3900" tracker="cve" /> <issue id="2015-7551" tracker="cve" /> <category>security</category> <rating>important</rating> <packager>darix</packager> <description> This ruby2.1 update to version 2.1.9 fixes the following issues: Security issues fixed: - CVE-2016-2339: heap overflow vulnerability in the Fiddle::Function.new"initialize" (bsc#1018808) - CVE-2015-7551: Unsafe tainted string usage in Fiddle and DL (bsc#959495) - CVE-2015-3900: hostname validation does not work when fetching gems or making API requests (bsc#936032) - CVE-2015-1855: Ruby'a OpenSSL extension suffers a vulnerability through overly permissive matching of hostnames (bsc#926974) - CVE-2014-4975: off-by-one stack-based buffer overflow in the encodes() function (bsc#887877) Bugfixes: - SUSEconnect doesn't handle domain wildcards in no_proxy environment variable properly (bsc#1014863) - Segmentation fault after pack & ioctl & unpack (bsc#909695) - Ruby:HTTP Header injection in 'net/http' (bsc#986630) ChangeLog: - http://svn.ruby-lang.org/repos/ruby/tags/v2_1_9/ChangeLog </description> <summary>Security update for ruby2.1</summary> </patchinfo>
