Openwall GNU/*/Linux - a small security-enhanced Linux distro for servers
[<prev] [next>] [<thread-prev] [day] [month] [year] [list]
Date: Wed, 12 Mar 2014 07:10:46 -0400 (EDT)
From: cve-assign@...re.org
To: larry0@...com
Cc: cve-assign@...re.org, oss-security@...ts.openwall.com
Subject: Re: Remote Command Injection in Arabic Prawn 0.0.1 Ruby Gem

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

> http://www.vapid.dhs.org/advisories/arabic-ruby-gem.html

> In Arabic-Prawn-0.0.1/lib/string_utf_support.rb

> If the downloaded file name #{downloaded_file} or #{url} contains any
> shell meta characters like ';' a malicious user can inject shell
> commands.

Use CVE-2014-2322.

- -- 
CVE assignment team, MITRE CVE Numbering Authority
M/S M300
202 Burlington Road, Bedford, MA 01730 USA
[ PGP key available through http://cve.mitre.org/cve/request_id.html ]
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.14 (SunOS)

iQEcBAEBAgAGBQJTID8nAAoJEKllVAevmvmsqx0IAJT0oDoDBciWG/V8tcBBv471
Pbn3SCXaT0Hxh6/hGgHDAJT9qxYjLloP18Go8/j5w38QGkyQHtDSj+IvMNRWwIU0
z8byXV7Ar1GoqcdZGugerGEFWRdrqdRGyoSsYbjD3NJpziP+YY/lUE5iQZd5jF0S
iCENnwLZuJe1q9nz5T+N1clq7Lt+j5T271/A91HrpPWl8KO4brEdC3nP2mqaagkE
p7a5VyJUUdIm2/bQKZeVbGqe2S+PsJhBV+6da7+56u8NOAA0GMUYYM/b3431SZDq
ZGPdcvUu55WHZwXSuulzM+n5S5Y0MkMDuN7FGD9WZpvbAczyxwMEeEMaK3iKNT4=
=/MsD
-----END PGP SIGNATURE-----

Powered by blists - more mailing lists

Your e-mail address:

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Powered by Openwall GNU/*/Linux - Powered by OpenVZ