-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 Format: 1.8 Date: Fri, 30 Oct 2026 15:35:16 -0300 Source: ruby3.3 Binary: libruby3.3 libruby3.3-dbgsym ruby3.3 ruby3.3-dbgsym ruby3.3-dev Architecture: arm64 Version: 3.3.13-0+deb13u1 Distribution: trixie-security Urgency: medium Maintainer: arm64 Build Daemon (arm-conova-03) Changed-By: Lucas Kanashiro Description: libruby3.3 - Libraries necessary to run Ruby 3.3 ruby3.3 - Interpreter of object-oriented scripting language Ruby ruby3.3-dev - Header files for compiling extension modules for the Ruby 3.3 Changes: ruby3.3 (3.3.13-0+deb13u1) trixie-security; urgency=medium . * New upstream version 3.3.13. It contains the following security fixes: - resolv: + CVE-2025-24294: Fix denial of service caused by excessive CPU consumption when parsing highly compressed DNS names. + CVE-2026-80212: Fix unbounded memory consumption when processing DNS responses containing unknown resource record types. + CVE-2026-80213: Fix DNS hostname validation bypass caused by incorrectly handling DNS label and name length limits. - REXML: + CVE-2025-58767: Fix denial of service when parsing XML documents containing multiple XML declarations. - uri: + CVE-2025-61594: Fix credential leakage when combining URIs using the '+' operator. - zlib: + CVE-2026-27820: Fix buffer overflow in Zlib::GzipReader. - erb: + CVE-2026-41316: Fix deserialization guard bypass allowing arbitrary code execution through def_method, def_module and def_class. - net-imap: + CVE-2026-42245: Fix denial of service caused by quadratic processing of IMAP responses containing multiple string literals. + CVE-2026-42246: Fix STARTTLS stripping vulnerability caused by incorrect handling of IMAP server responses. + CVE-2026-42256: Fix denial of service caused by excessive iteration counts in SCRAM authentication. + CVE-2026-42257: Fix IMAP command injection through unvalidated raw command arguments. + CVE-2026-42258: Fix IMAP command injection through unvalidated Symbol arguments. + CVE-2026-47240: Fix IMAP command injection through non-synchronizing literals in raw arguments. + CVE-2026-47241: Fix denial of service caused by incomplete validation of raw IMAP command arguments. + CVE-2026-47242: Fix IMAP command injection through unvalidated arguments to the ID and ENABLE commands. - Onigmo (regular expression engine): + CVE-2026-89078: Fix a double-free vulnerability in regular expression compilation. + CVE-2026-93577: Fix an integer overflow vulnerability in regular expression compilation. + CVE-2026-97229: Fix an integer overflow vulnerability in regular expression compilation. + CVE-2026-110264: Fix an internal ID overflow vulnerability in regular expression compilation. * d/p/CVE-2025-27221_{1,2}.patch: removed, applied by upstream Checksums-Sha1: 2ab723d06ec1eb907e15938317bd20c2a56615f8 9996300 libruby3.3-dbgsym_3.3.13-0+deb13u1_arm64.deb 38b52948adfcde67670b48a229daceb928ef17d1 5377416 libruby3.3_3.3.13-0+deb13u1_arm64.deb 3614ec222daee1b73e23fe3b0efd57dc77401479 3876 ruby3.3-dbgsym_3.3.13-0+deb13u1_arm64.deb 0b3d52e75bf1ba25e5c472cc98a3875ff3dc10d9 267672 ruby3.3-dev_3.3.13-0+deb13u1_arm64.deb 51a36c5c9f9b799f9ba7b1b46a33049e7d9a26e4 8144 ruby3.3_3.3.13-0+deb13u1_arm64-buildd.buildinfo 992177ad8ec64c088ef98da6371d665d100cbf0e 57612 ruby3.3_3.3.13-0+deb13u1_arm64.deb Checksums-Sha256: bf1f59d4333eed07c9e0da12bfe1af8808f86026fe7372c38fe633458291a9c6 9996300 libruby3.3-dbgsym_3.3.13-0+deb13u1_arm64.deb b008c12d11718a430e6e33fd3439ed2da2ecbce3476d444311e93563d3d84a1e 5377416 libruby3.3_3.3.13-0+deb13u1_arm64.deb 87b714784713e66c747a9958c98e378527d59baecf0c1adb2b8b545bc1eed5a5 3876 ruby3.3-dbgsym_3.3.13-0+deb13u1_arm64.deb ad11bad1fcf5352991da5b65c0eab4b81a995238e14400b949689acccb581446 267672 ruby3.3-dev_3.3.13-0+deb13u1_arm64.deb 9327fd212984b0fbd98eb5bac495044b4a75430399c85f65114e7aa25788f1c4 8144 ruby3.3_3.3.13-0+deb13u1_arm64-buildd.buildinfo 1320df14304c40f54ab4fcdce36475e614d58c06313b4e7454502fdb1456c899 57612 ruby3.3_3.3.13-0+deb13u1_arm64.deb Files: ddd562f934cb18637b40d16d3303468c 9996300 debug optional libruby3.3-dbgsym_3.3.13-0+deb13u1_arm64.deb 30a9f6f242300deba34cb401784cd900 5377416 libs optional libruby3.3_3.3.13-0+deb13u1_arm64.deb 735a82198950afd8db3ee70d93810cea 3876 debug optional ruby3.3-dbgsym_3.3.13-0+deb13u1_arm64.deb e39075f79b855241f856a365dcca6082 267672 ruby optional ruby3.3-dev_3.3.13-0+deb13u1_arm64.deb ea13b7a382d64d1979a3f46f998cbc03 8144 ruby optional ruby3.3_3.3.13-0+deb13u1_arm64-buildd.buildinfo 2930f30cd62b4eac94cd9119440e54c1 57612 ruby optional ruby3.3_3.3.13-0+deb13u1_arm64.deb -----BEGIN PGP SIGNATURE----- iQIzBAEBCgAdFiEElFiH1oZRZh1t4FSiXVp1sEH/1mIFAmrsjIoACgkQXVp1sEH/ 1mLnfBAAniU1omqvnHoGhxnqnnO4f9FHqvMgYSas2OSwvyp8yFtqQU7cvPgZr2/R A5nb0q7hKZsDN5q8P0Chq/Ejglezaxsw6iygJvyK8al8QAbcRpdDgVsI/5JM9J2t xhcLeGlLSx+rt9xM0It75T7bixQOvJT9XYrVzgg20ibMNTo84Mz9Ue+phN7N6LqU kXfNVAGXv+4r7dNp0Hf1HQipNrIVG0/j0AyA+uVfJBIBYsZvz8YECw+wPbuz3orZ 1HPsoUiYU6/A6jMrTVBZVLGlUKmelrsGCOC0fNnc2TbY6VFE0S34gdEJxfHgDPrs Sv2Z3vcci1a2jy8VjyKfBqRNxw7H7IARM7mVqZQlkFYeWD1Tv6jgSE/C3k8qVhAi W+YBNK5DhMElYzZQqT0hxlBvqPpPpe1UZSyigVhV0abLiK1JWHayE/cVWoLAFudq PC08RCpzxiJE4nz/nM+bAkitcPdQJpamctlytyim9DngPK1gGilzQp35tT/fuZjC JslUzxaAn0gQf3vi1fdiOmu0YT/fBsIlvKYXq1sdOCkuemqaKdtY5txm0nFBN3Jb VfNPMgzbOmaTi7sEloRdGiUelfB1oOszZCB7ZvuGm2xMAfUplN1THA9PftCscl1X CTuw5gDfDDqubk6vaHgjaBUtIUIYnxs7cVU+xyL3nLN4Bhtf/p8= =v1WL -----END PGP SIGNATURE-----