Bug#689075: CVE-2011-1005: safe level bypass

2013-01-17 Thread Jonathan Wiltshire
Package: ruby1.9.1 Dear maintainer, Recently you fixed one or more security problems and as a result you closed this bug. These problems were not serious enough for a Debian Security Advisory, so they are now on my radar for fixing in the following suites through point releases: squeeze (6.0.7)

Bug#689075: CVE-2011-1005: safe level bypass

2012-10-03 Thread Tyler Hicks
On 2012-10-01 11:04:30, Tyler Hicks wrote: I'll be sure to update this bug when they've applied the fix upstream. Ok, the fix is public: http://svn.ruby-lang.org/cgi-bin/viewvc.cgi?view=revisionrevision=37068 It ended up being more complicated than I initially thought. The vulnerability

Bug#689075: CVE-2011-1005: safe level bypass

2012-10-01 Thread Tyler Hicks
On 2012-09-30 17:47:30, Antonio Terceiro wrote: Thanks for submitting this. Did you notify upstream of the fact that the 1.9 series is actually affected by this issue? Yes, right after I filed this bug. After speaking with upstream, they will be applying a slightly different fix. You probably

Bug#689075: CVE-2011-1005: safe level bypass

2012-09-30 Thread Antonio Terceiro
tag 689075 + pending thanks Hello Tyler, Tyler Hicks escreveu: Package: ruby1.9.1 Version: 1.9.3.194-1 Severity: grave Tags: patch security Justification: user security hole User: ubuntu-de...@lists.ubuntu.com Usertags: origin-ubuntu quantal ubuntu-patch Dear Maintainer, While

Bug#689075: CVE-2011-1005: safe level bypass

2012-09-28 Thread Tyler Hicks
Package: ruby1.9.1 Version: 1.9.3.194-1 Severity: grave Tags: patch security Justification: user security hole User: ubuntu-de...@lists.ubuntu.com Usertags: origin-ubuntu quantal ubuntu-patch Dear Maintainer, While running some regression tests I discovered that 1.9.3.194-1 is vulnerable to