ruby1.9.1 (1.9.3.484-2ubuntu1.14) trusty-security; urgency=medium

  * SECURITY UPDATE: Delete directory using symlink when decompressing tar,
    Escape sequence injection vulnerability in gem owner, Escape sequence
    injection vulnerability in API response handling, Arbitrary code exec,
    Escape sequence injection vulnerability in errors
    - debian/patches/CVE-2019-8320-25.patch: fix in
      lib/rubygems/command_manager.rb,
      lib/rubygems/commands/owner_command.rb,
      lib/rubygems/gemcutter_utilities.rb,
      lib/rubygems/installer.rb,
      lib/rubygems/package.rb,
      test/rubygems/test_gem_installer.rb,
      test/rubygems/test_gem_package.rb,
      test/rubygems/test_gem_text.rb.
    - CVE-2019-8320
    - CVE-2019-8321
    - CVE-2019-8322
    - CVE-2019-8323
    - CVE-2019-8324
    - CVE-2019-8325
  * Fixing expired certification that causes tests to fail
    - debian/patches/fixing_expired_SSL_certificates.patch: updating certs in
      test/net/imap/cacert.pen, test/net/imap/server.crt,
      test/net/imap/server.key.

 -- Leonidas S. Barbosa <leo.barbosa@canonical.com>  Fri, 29 Mar 2019 14:46:36 -0300

ruby1.9.1 (1.9.3.484-2ubuntu1.13) trusty-security; urgency=medium

  * SECURITY UPDATE: Name equality check
    - debian/patches/CVE-2018-16395.patch: fix in
      ext/openssl/ossl_x509name.c.
    - CVE-2018-16395
  * SECURITY UPDATE: Tainted flags not propagted
    - debian/patches/CVE-2018-16396.patch: fix in
      pack.c, test/ruby/test_pack.rb.
    - CVE-2018-16396
  * Incresing maximum test failures to 39 since some tests that
    failed are related to timezone and tzdata changes.
    - debian/run-test-suites.bash.

 -- Leonidas S. Barbosa <leo.barbosa@canonical.com>  Thu, 01 Nov 2018 08:35:26 -0300

ruby1.9.1 (1.9.3.484-2ubuntu1.12) trusty-security; urgency=medium

  * SECURITY UPDATE: Response splitting attack
    - debian/patches/CVE-2017-17742*.patch: fix in webrick/httpresponse.rb,
      test/webrick/test_httpresponse.rb.
    - CVE-2017-17742
  * SECURITY UPDATE: Denial of service
    - debian/patches/CVE-2018-8777*.patch: fix in lib/webrick/httpresponse.rb,
      lib/webrick/httpservlet/filehandler.rb,
      test/webrick/test_filehandler.rb, test/webrick/test_httpresponse.rb.
    - CVE-2018-8777

 -- Leonidas S. Barbosa <leo.barbosa@canonical.com>  Thu, 07 Jun 2018 09:15:34 -0300

ruby1.9.1 (1.9.3.484-2ubuntu1.11) trusty-security; urgency=medium

  * SECURITY UPDATE: Directory traversal vulnerability
    - debian/patches/CVE-2018-6914.patch: fix in lib/tmpdir.rb,
      test/test_tempfile.rb.
    - CVE-2018-6914
  * SECURITY UPDATE: Buffer under-read
    - debian/patches/CVE-2018-8778.patch: fix in pack.c,
      test/ruby/test_pack.rb.
    - CVE-2018-8778
  * SECURITY UPDATE: Unintended socket
    - debian/patches/CVE-2018-8779.patch: fix in ext/socket/unixsocket.c,
      test/socket/test_unix.rb.
    - CVE-2018-8779
  * SECURITY UPDATE: Directory traversal
    - debian/patches/CVE-2018-8780.patch: fix in dir.c,
      test/ruby/test_dir.rb.
    - CVE-2018-8780

 -- Leonidas S. Barbosa <leo.barbosa@canonical.com>  Mon, 16 Apr 2018 10:52:29 -0300

ruby1.9.1 (1.9.3.484-2ubuntu1.10) trusty-security; urgency=medium

  * SECURITY REGRESSION: The fix for CVE-2018-1000074 was incomplete
    and will be addressed in a future update.

 -- Leonidas S. Barbosa <leo.barbosa@canonical.com>  Fri, 13 Apr 2018 09:53:54 -0300

ruby1.9.1 (1.9.3.484-2ubuntu1.8) trusty-security; urgency=medium

  * SECURITY UPDATE: Deserialization untrusted data
    - debian/patches/CVE-2018-1000074*.patch fix in
      lib/rubygems/commands/owner_command.rb,
      test/rubygems/test_gem_commands_owner_command.rb.
    - CVE-2018-1000074
  * SECURITY UPDATE: Infinite loop
    - debian/patches/CVE-2018-1000075.patch: fix in
      lib/rubygems/package/tar_header.rb,
      test/rubygems/test_gem_package_tar_header.rb.
    - CVE-2018-1000075
  * SECURITY UPDATE: Validation vulnerability
    - debian/patches/CVE-2018-1000077.patch: fix in
      lib/rubygems/specification.rb,
      test/rubygems/test_gem_specification.rb.
    - CVE-2018-1000077
  * SECURITY UPDATE: Cross site scripting
    - debian/patches/CVE-2018-1000078.patch: fix in
      lib/rubygems/server.rb.
    - CVE-2018-1000078

 -- Leonidas S. Barbosa <leo.barbosa@canonical.com>  Mon, 02 Apr 2018 16:24:32 -0300

ruby1.9.1 (1.9.3.484-2ubuntu1.7) trusty-security; urgency=medium

  * SECURITY UPDATE: possible command injection attacks through
    kernel#open
    - debian/patches/CVE-2017-17790.patch: fix uses of Kernel#open in
      lib/resolv.rb.
    - CVE-2017-17790

 -- Leonidas S. Barbosa <leo.barbosa@canonical.com>  Mon, 08 Jan 2018 17:41:26 -0300

ruby1.9.1 (1.9.3.484-2ubuntu1.6) trusty-security; urgency=medium

  * SECURITY UPDATE: command injection through Net::FTP
    - debian/patches/CVE-2017-17405.patch: fix command injection
      in lib/net/ftp.rb.
    - CVE-2017-17405

 -- Leonidas S. Barbosa <leo.barbosa@canonical.com>  Mon, 18 Dec 2017 14:36:12 -0300

ruby1.9.1 (1.9.3.484-2ubuntu1.5) trusty-security; urgency=medium

  * SECURITY UPDATE: Buffer underrun vulneratiblity
    - debian/patches/CVE-2017-0898-10748-14033-14064.patch
      patch extracted from debian Wheezy.
    - CVE-2017-0898
  * SECURITY UPDATE: ANSI escape sequence vulnerability
    - debian/patches/CVE-2017-0899-0900-0901.patch
      patch extracted from debian Wheezy.
    - CVE-2017-0899
  * SECURITY UPDATE: DoS vulnerability in query command
    - debian/patches/CVE-2017-0899-0900-0901-0902.patch
      patch extracted from debian Wheezy.
    - CVE-2017-0900
  * SECURITY UPDATE: Malicious gem overwrite arbitrary files
    - debian/patches/CVE-2017-0899-0900-0901.patch
      patch extracted from debian Wheezy.
    - CVE-2017-0901
  * SECURITY UPDATE: Escape sequence injection vulnerability
    - debian/patches/CVE-2017-0898-10748-14033-14064.patch
      patch extracted from debian Wheezy.
    - CVE-2017-10748
  * SECURITY UPDATE: Buffer underrun
    - debian/patches/CVE-2017-0898-10748-14033-14064.patch
      patch extracted from debian Wheezy.
    - CVE-2017-14033
  * SECURITY UPDATE: Heap exposure
    - debian/patches/CVE-2017-0898-10748-14033-14064.patch
      patch extracted from debian Wheezy.
    - CVE-2017-14064

 -- Leonidas S. Barbosa <leo.barbosa@canonical.com>  Tue, 03 Oct 2017 16:25:24 -0300

ruby1.9.1 (1.9.3.484-2ubuntu1.3) trusty-security; urgency=medium

  * SECURITY UPDATE: DoS and possible code execution in DL::dlopen
    - debian/patches/CVE-2009-5147.patch: check tainted string arguments in
      ext/dl/handle.c.
    - CVE-2009-5147
  * SECURITY UPDATE: incorrect hostname matching
    - debian/patches/CVE-2015-1855.patch: implement stricter hostname
      validation per RFC 6125 in ext/openssl/lib/openssl/ssl-internal.rb,
      added tests to test/openssl/test_ssl.rb.
    - CVE-2015-1855
  * SECURITY UPDATE: SMTP command injection
    - debian/patches/CVE-2015-9096.patch: don't allow bare CR or LF in
      lib/net/smtp.rb, added test to test/net/smtp/test_smtp.rb.
    - CVE-2015-9096
  * SECURITY UPDATE: type confusion in tcltkip
    - debian/patches/CVE-2016-2337.patch: check argument in
      ext/tk/tcltklib.c.
    - CVE-2016-2337
  * SECURITY UPDATE: heap overflow in Fiddle::Function.new
    - debian/patches/CVE-2016-2339.patch: check arguments in
      ext/fiddle/function.c.
    - CVE-2016-2339
  * SECURITY UPDATE: use of same initialization vector (IV)
    - debian/patches/CVE-2016-7798.patch: don't set dummy key in
      ext/openssl/ossl_cipher.c, added test to test/openssl/test_cipher.rb.
    - CVE-2016-7798

 -- Marc Deslauriers <marc.deslauriers@ubuntu.com>  Tue, 20 Jun 2017 08:03:20 -0400

# For older changelog entries, run 'apt-get changelog ri1.9.1'
