-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 Format: 1.8 Date: Fri, 30 Oct 2026 15:35:16 -0300 Source: ruby3.3 Binary: ruby3.3-doc Architecture: all Version: 3.3.13-0+deb13u1 Distribution: trixie-security Urgency: medium Maintainer: all / amd64 / i386 Build Daemon (x86-conova-01) Changed-By: Lucas Kanashiro Description: ruby3.3-doc - Documentation for Ruby 3.3 Changes: ruby3.3 (3.3.13-0+deb13u1) trixie-security; urgency=medium . * New upstream version 3.3.13. It contains the following security fixes: - resolv: + CVE-2025-24294: Fix denial of service caused by excessive CPU consumption when parsing highly compressed DNS names. + CVE-2026-80212: Fix unbounded memory consumption when processing DNS responses containing unknown resource record types. + CVE-2026-80213: Fix DNS hostname validation bypass caused by incorrectly handling DNS label and name length limits. - REXML: + CVE-2025-58767: Fix denial of service when parsing XML documents containing multiple XML declarations. - uri: + CVE-2025-61594: Fix credential leakage when combining URIs using the '+' operator. - zlib: + CVE-2026-27820: Fix buffer overflow in Zlib::GzipReader. - erb: + CVE-2026-41316: Fix deserialization guard bypass allowing arbitrary code execution through def_method, def_module and def_class. - net-imap: + CVE-2026-42245: Fix denial of service caused by quadratic processing of IMAP responses containing multiple string literals. + CVE-2026-42246: Fix STARTTLS stripping vulnerability caused by incorrect handling of IMAP server responses. + CVE-2026-42256: Fix denial of service caused by excessive iteration counts in SCRAM authentication. + CVE-2026-42257: Fix IMAP command injection through unvalidated raw command arguments. + CVE-2026-42258: Fix IMAP command injection through unvalidated Symbol arguments. + CVE-2026-47240: Fix IMAP command injection through non-synchronizing literals in raw arguments. + CVE-2026-47241: Fix denial of service caused by incomplete validation of raw IMAP command arguments. + CVE-2026-47242: Fix IMAP command injection through unvalidated arguments to the ID and ENABLE commands. - Onigmo (regular expression engine): + CVE-2026-89078: Fix a double-free vulnerability in regular expression compilation. + CVE-2026-93577: Fix an integer overflow vulnerability in regular expression compilation. + CVE-2026-97229: Fix an integer overflow vulnerability in regular expression compilation. + CVE-2026-110264: Fix an internal ID overflow vulnerability in regular expression compilation. * d/p/CVE-2025-27221_{1,2}.patch: removed, applied by upstream Checksums-Sha1: 784ba8dd86457845a0509e7cb9e0f3398bf60614 2186792 ruby3.3-doc_3.3.13-0+deb13u1_all.deb eaac98ddd93ff5683b5babe9767e3c39a2cfd470 6974 ruby3.3_3.3.13-0+deb13u1_all-buildd.buildinfo Checksums-Sha256: 94764f5ae449de4f719454bc8de2b21f2c8c80b06e18114f9554ceab2623de3f 2186792 ruby3.3-doc_3.3.13-0+deb13u1_all.deb c99ced1079e257d012e8360c162968d6979cc4b874ca944a5c381723fcce96d0 6974 ruby3.3_3.3.13-0+deb13u1_all-buildd.buildinfo Files: 5a62b927ba2eaaf6968da4fe2dfae9e8 2186792 doc optional ruby3.3-doc_3.3.13-0+deb13u1_all.deb c1e688604b34c1907d36060c37a9adb7 6974 ruby optional ruby3.3_3.3.13-0+deb13u1_all-buildd.buildinfo -----BEGIN PGP SIGNATURE----- iQIzBAEBCgAdFiEE7cQ9mRD4+dWjjrb6PkCWRKsh20cFAmrskLcACgkQPkCWRKsh 20dphA/+Ifaa4FdXH+YHSfdSyiGy4gzrz09gZBubAU7AUvogCi9zQxDL9Wu0DPgP 6YbOt/uSXmQ7O8z5mQ8TOjCgiTvY7d8PaWt8lxNhPUGMxl3xlNsriJHbZQrsooAk u2Dv3qB7e+2jRwjF1YVhTKN1D0za/QTBQeNKBoghuwTvf9mb6u+Tx7sovqMQSSf2 LnDvStQtbWdugMFDC47tg71rigKFRLDtGxqYW9uFm/9Zs8zxstainwky/1EWNIyi jUIGHqnNDn1onlyHcDRPQVcPrxCNCs/VOPHgjhl0YvU31rjeRqYVHKGegGHFt1jk gm4eWDoYvyb3UonBax70aoPp2hsKFS5l4vvIcyLD7dDEaCIRQkpGK6qa2Xj7V8ze gS8KMxEE80YBo4/0GifoJA+BWQLxXYr/O0r2v/o4gAw5spNzb0/FAh7Z9zsAX3cD iqeTPJoekGteZ0qC9iLbWPcLciRx95wHDzD38dChlO8Lj0vyPihVyXRJR6UjBipJ cNkXNURv/OOe9ZK8DBDP3qQ+OShRNG3qz0rxK4dcmlA6ZunzaIvSdR/+Vs9kOSnv 56fNytuYncVxp8BBXniLnU001w6SZFrAlZ2W7I/Z5S7q2sTbrmCZFCPG/buocB7D 6/I0fGC5lbys1R/QPXApX3Qai8RJ4bhO2iVxXHsSmbXI7XfAvjY= =xMqm -----END PGP SIGNATURE-----