-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 Format: 1.8 Date: Fri, 30 Oct 2026 15:35:16 -0300 Source: ruby3.3 Binary: libruby3.3 libruby3.3-dbgsym ruby3.3 ruby3.3-dbgsym ruby3.3-dev Architecture: amd64 Version: 3.3.13-0+deb13u1 Distribution: trixie-security Urgency: medium Maintainer: all / amd64 / i386 Build Daemon (x86-conova-01) Changed-By: Lucas Kanashiro Description: libruby3.3 - Libraries necessary to run Ruby 3.3 ruby3.3 - Interpreter of object-oriented scripting language Ruby ruby3.3-dev - Header files for compiling extension modules for the Ruby 3.3 Changes: ruby3.3 (3.3.13-0+deb13u1) trixie-security; urgency=medium . * New upstream version 3.3.13. It contains the following security fixes: - resolv: + CVE-2025-24294: Fix denial of service caused by excessive CPU consumption when parsing highly compressed DNS names. + CVE-2026-80212: Fix unbounded memory consumption when processing DNS responses containing unknown resource record types. + CVE-2026-80213: Fix DNS hostname validation bypass caused by incorrectly handling DNS label and name length limits. - REXML: + CVE-2025-58767: Fix denial of service when parsing XML documents containing multiple XML declarations. - uri: + CVE-2025-61594: Fix credential leakage when combining URIs using the '+' operator. - zlib: + CVE-2026-27820: Fix buffer overflow in Zlib::GzipReader. - erb: + CVE-2026-41316: Fix deserialization guard bypass allowing arbitrary code execution through def_method, def_module and def_class. - net-imap: + CVE-2026-42245: Fix denial of service caused by quadratic processing of IMAP responses containing multiple string literals. + CVE-2026-42246: Fix STARTTLS stripping vulnerability caused by incorrect handling of IMAP server responses. + CVE-2026-42256: Fix denial of service caused by excessive iteration counts in SCRAM authentication. + CVE-2026-42257: Fix IMAP command injection through unvalidated raw command arguments. + CVE-2026-42258: Fix IMAP command injection through unvalidated Symbol arguments. + CVE-2026-47240: Fix IMAP command injection through non-synchronizing literals in raw arguments. + CVE-2026-47241: Fix denial of service caused by incomplete validation of raw IMAP command arguments. + CVE-2026-47242: Fix IMAP command injection through unvalidated arguments to the ID and ENABLE commands. - Onigmo (regular expression engine): + CVE-2026-89078: Fix a double-free vulnerability in regular expression compilation. + CVE-2026-93577: Fix an integer overflow vulnerability in regular expression compilation. + CVE-2026-97229: Fix an integer overflow vulnerability in regular expression compilation. + CVE-2026-110264: Fix an internal ID overflow vulnerability in regular expression compilation. * d/p/CVE-2025-27221_{1,2}.patch: removed, applied by upstream Checksums-Sha1: 023251f68ed4d049d102aa6e03208894cf683904 10056892 libruby3.3-dbgsym_3.3.13-0+deb13u1_amd64.deb 95d67d665b316512e341f1572c356563c5986681 5539844 libruby3.3_3.3.13-0+deb13u1_amd64.deb b16ccf7477bf16018307995429778ae8d0a6117d 3604 ruby3.3-dbgsym_3.3.13-0+deb13u1_amd64.deb 2332efaecafa43cb0bfa7f95f613d06314d4ca30 267748 ruby3.3-dev_3.3.13-0+deb13u1_amd64.deb 4f8eaea979e4f9ab5e560ef6ea5f7e7d0228d8f9 8163 ruby3.3_3.3.13-0+deb13u1_amd64-buildd.buildinfo d0be8c15487ccec64ccb1fc5f76e9ef9f1565ab6 57372 ruby3.3_3.3.13-0+deb13u1_amd64.deb Checksums-Sha256: 85ed56fe42af854b15261c43602ffe1e2924db0c0706ae5016e4a378d025b8ad 10056892 libruby3.3-dbgsym_3.3.13-0+deb13u1_amd64.deb f7d75845a26a0a163476ede94c48219ebe452053943e5499a015c8edcc5d5b7a 5539844 libruby3.3_3.3.13-0+deb13u1_amd64.deb ce79c1a2fdf510788b3e3a39f1d32930c2b585eef29018324a50de4c91539109 3604 ruby3.3-dbgsym_3.3.13-0+deb13u1_amd64.deb a69d21f33c897ba49cc2e8b031a51bf82353fb365e9f98507bf04033b867a8bc 267748 ruby3.3-dev_3.3.13-0+deb13u1_amd64.deb a27496ff49b070dda213d90b3892904532e389599fe5c92de1b3dff300995c9e 8163 ruby3.3_3.3.13-0+deb13u1_amd64-buildd.buildinfo 0395c5e99b662bc0c3fb7cb371ea484f576e981ee1b234e53a48f1f38cab3095 57372 ruby3.3_3.3.13-0+deb13u1_amd64.deb Files: d4ea3afa6fd1f5d4a0005693eaebb4f4 10056892 debug optional libruby3.3-dbgsym_3.3.13-0+deb13u1_amd64.deb 1d3435dd25ad51af6e74b612998a6dde 5539844 libs optional libruby3.3_3.3.13-0+deb13u1_amd64.deb 1bdd2c585b4a4aa449cda09d2c9485a2 3604 debug optional ruby3.3-dbgsym_3.3.13-0+deb13u1_amd64.deb c76b553d4ebb517d7edef47a99b6d90c 267748 ruby optional ruby3.3-dev_3.3.13-0+deb13u1_amd64.deb 5c83b4bc67b4ab51b8d5be4902e0f0df 8163 ruby optional ruby3.3_3.3.13-0+deb13u1_amd64-buildd.buildinfo a539da9db071db5b46684695f1a8562e 57372 ruby optional ruby3.3_3.3.13-0+deb13u1_amd64.deb -----BEGIN PGP SIGNATURE----- iQIzBAEBCgAdFiEE7cQ9mRD4+dWjjrb6PkCWRKsh20cFAmrsjW4ACgkQPkCWRKsh 20c13w//U+6Q8km7QWopy6v0Ptl1+PgJgwwhDR6TAO6XwtYJibQvEfwAqtpLIUJG Z7CnprtRQJoXu/G4THCRqg0iurecVTae4Dv0EtHoJxRkOAHn4EVsPIeqFWVmZ6/T 3OIC7wzLtAHTcRtI1Fhr3aAp9QVq1rR/eQ+CEBwabXWXuq7C6L1Hxy3Zc2jC+jP4 xmNQmHSNt+xTzChsNIo/h01WKk+2TNUSK4j3cUVG1rNLctZOQWZC6XtYX4ew7a18 77g5PsWVC4zrS4xyi6GZiC8P4UeZNgXJ0MlYtqVcWgdW1I4Gi4K0UyWu3h/I23WW JiLpRFiDK9/DDhoUnQ985SnGZV80vIZR1BrtqEQ2Wy1Ywl911N9zBsTxTKBWLnYJ OtTUgz4zQE08/bKkQhI7o81AQ8zRcj8L8FS3+N+kM8UxED0rc+VlZGtb+WetP3ln 7RDyqONSGovDgHh0j7K/MEGkHhuw6f90l3JH6FOI+4JoN5j7BYNSllRGSvajXTCR jyvea/BmHkvzdtDYomrQRhU1UvXNsqxLYzFdEeofzbt37UJmHqsEPuX7DCfrppmy ZzYNJjvd0dQOgdkrT0HvJWTDoUtil0NssAR2B+Iq51qtW/j0zKgcqtTj0HgeQ7WD b+nOsh3/6SSdF4r9STCz7mSSsnKTQipXiMVcf5GMJuYxKBB5TGQ= =GF+I -----END PGP SIGNATURE-----