Security bugs are reported here via bugzilla

[Thomas Houssin <thomas.houssin AT gmail.com>]

Synopsis
========
ruby allows attackers to bypass safe level and taint flag protections
and execute disallowed code.

Background
==========
ruby is the interpreted scripting language for quick and easy
object-oriented programming.  It has many features to process text files
and to do system management tasks (like Perl).  It is simple, straight
foward extensible and portable.

Description
===========
CAN-2005-2337:
ruby allows attackers to bypass safe level and taint flag protections
and execute disallowed code when Ruby processes a program through
standard input (stdin).

Impact
======
An attacker could exploit this vulnerability to execute arbitrary code
beyond the restrictions specified in each safe level.

Workaround
==========
There are no known workarounds at this time.

Affected packages
=================
This is now fixed in all grimoires.

Resolution
==========
All ruby users should upgrade to the latest available version:
         # scribe update
         # cast -c ruby

References
==========
   [ 1 ] CAN-2005-2337
         http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2005-2337
   [ 2 ] GLSA 200510-05
         http://www.gentoo.org/security/en/glsa/glsa-200510-05.xml

-- 
Thomas Houssin

Security Team Leader Source Mage GNU/Linux (http://www.sourcemage.org)
Key fingerprint = 3CB8 3FC4 840D B272 E623  BCB8 54DB F4E3 4240 4C36
http://pgp.mit.edu:11371/pks/lookup?op=get&search=0x42404C36

Attachment: signature.asc
Description: OpenPGP digital signature