Secure testing team - May 2011 - Bug#628451: CVE-2011-0188: arbitrary code execution

Package: ruby1.9
Severity: grave
Tags: security

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Hi,
the following CVE (Common Vulnerabilities & Exposures) id was
published for openswan.

CVE-2011-0188[0]:
| The VpMemAlloc function in bigdecimal.c in the BigDecimal class in
| Ruby 1.9.2-p136 and earlier, as used on Apple Mac OS X before 10.6.7
| and other platforms, does not properly allocate memory, which allows
| context-dependent attackers to execute arbitrary code or cause a
| denial of service (application crash) via vectors involving creation
| of a large BigDecimal value within a 64-bit process, related to an
| "integer truncation issue."

If you fix the vulnerability please also make sure to include the
CVE id in your changelog entry.

Cheers,
Steffen

For further information see:

[0] http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-0188
    http://security-tracker.debian.org/tracker/CVE-2011-0188

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.11 (GNU/Linux)

iEYEARECAAYFAk3hvtoACgkQ62zWxYk/rQcLpwCff23GyqO9ChRxot2/jjt2fMCr
RzUAn0f6CcyulgL1YuKBrvo7ZGl3By59
=Ffgi
-----END PGP SIGNATURE-----