[ubuntu/jammy-security] ruby3.0 3.0.2-7ubuntu2.6 (Accepted)

[Marc Deslauriers]

ruby3.0 (3.0.2-7ubuntu2.6) jammy-security; urgency=medium

  * SECURITY UPDATE: code execution in RDoc
    - debian/patches/CVE-2024-27281-1.patch: filter marshalled objects in
      lib/rdoc/store.rb.
    - debian/patches/CVE-2024-27281-2.patch: use safe_load and
      safe_load_file for .rdoc_options in lib/rdoc/rdoc.rb,
      test/rdoc/test_rdoc_options.rb.
    - debian/patches/CVE-2024-27281-3.patch: fix NoMethodError for
      start_with in lib/rdoc/store.rb.
    - CVE-2024-27281
  * SECURITY UPDATE: heap data extraction via regex
    - debian/patches/CVE-2024-27282.patch: fix Use-After-Free issue for
      Regexp in regexec.c.
    - CVE-2024-27282

ruby3.0 (3.0.2-7ubuntu2.5) jammy; urgency=medium

  * d/p/fix-ruby_xfree-segfault.patch: fix occasional segfault (LP: #2049197).
  * Replace expired certificate in tests with upstream patch (LP: #2051380).
    - d/p/renew-test-certificates-d3933fc753187a055a4904af82f5f3794c88c416.patch

Date: 2024-06-14 13:43:10.255772+00:00
Changed-By: Marc Deslauriers <marc.deslauriers at canonical.com>
https://launchpad.net/ubuntu/+source/ruby3.0/3.0.2-7ubuntu2.6
-------------- next part --------------
Sorry, changesfile not available.