-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 Format: 1.8 Date: Fri, 30 Oct 2026 15:35:16 -0300 Source: ruby3.3 Binary: libruby3.3 libruby3.3-dbgsym ruby3.3 ruby3.3-dbgsym ruby3.3-dev Architecture: i386 Version: 3.3.13-0+deb13u1 Distribution: trixie-security Urgency: medium Maintainer: amd64 / i386 Build Daemon (x86-ubc-01) Changed-By: Lucas Kanashiro Description: libruby3.3 - Libraries necessary to run Ruby 3.3 ruby3.3 - Interpreter of object-oriented scripting language Ruby ruby3.3-dev - Header files for compiling extension modules for the Ruby 3.3 Changes: ruby3.3 (3.3.13-0+deb13u1) trixie-security; urgency=medium . * New upstream version 3.3.13. It contains the following security fixes: - resolv: + CVE-2025-24294: Fix denial of service caused by excessive CPU consumption when parsing highly compressed DNS names. + CVE-2026-80212: Fix unbounded memory consumption when processing DNS responses containing unknown resource record types. + CVE-2026-80213: Fix DNS hostname validation bypass caused by incorrectly handling DNS label and name length limits. - REXML: + CVE-2025-58767: Fix denial of service when parsing XML documents containing multiple XML declarations. - uri: + CVE-2025-61594: Fix credential leakage when combining URIs using the '+' operator. - zlib: + CVE-2026-27820: Fix buffer overflow in Zlib::GzipReader. - erb: + CVE-2026-41316: Fix deserialization guard bypass allowing arbitrary code execution through def_method, def_module and def_class. - net-imap: + CVE-2026-42245: Fix denial of service caused by quadratic processing of IMAP responses containing multiple string literals. + CVE-2026-42246: Fix STARTTLS stripping vulnerability caused by incorrect handling of IMAP server responses. + CVE-2026-42256: Fix denial of service caused by excessive iteration counts in SCRAM authentication. + CVE-2026-42257: Fix IMAP command injection through unvalidated raw command arguments. + CVE-2026-42258: Fix IMAP command injection through unvalidated Symbol arguments. + CVE-2026-47240: Fix IMAP command injection through non-synchronizing literals in raw arguments. + CVE-2026-47241: Fix denial of service caused by incomplete validation of raw IMAP command arguments. + CVE-2026-47242: Fix IMAP command injection through unvalidated arguments to the ID and ENABLE commands. - Onigmo (regular expression engine): + CVE-2026-89078: Fix a double-free vulnerability in regular expression compilation. + CVE-2026-93577: Fix an integer overflow vulnerability in regular expression compilation. + CVE-2026-97229: Fix an integer overflow vulnerability in regular expression compilation. + CVE-2026-110264: Fix an internal ID overflow vulnerability in regular expression compilation. * d/p/CVE-2025-27221_{1,2}.patch: removed, applied by upstream Checksums-Sha1: 3a70db7585086febbd61a204832d57ee8da8c3ff 9090484 libruby3.3-dbgsym_3.3.13-0+deb13u1_i386.deb 0c185b24e97d4a0597ddc1e6ed5f72cdb764374d 5636400 libruby3.3_3.3.13-0+deb13u1_i386.deb ba5e7da5fa7f511d97946f5f01549af46cfa826e 3528 ruby3.3-dbgsym_3.3.13-0+deb13u1_i386.deb 057991d76cc2a1a0c69b40890a027513db5ff56b 267740 ruby3.3-dev_3.3.13-0+deb13u1_i386.deb 45bdb767ed1d4957d9d4994c27f2c431bbfb20e8 8052 ruby3.3_3.3.13-0+deb13u1_i386-buildd.buildinfo a6f685f34003be6a69e013c32b1f461241dd496e 57464 ruby3.3_3.3.13-0+deb13u1_i386.deb Checksums-Sha256: f2ebfcd126a2eee55c0f02dffd6962f70e13b9159733fac2be11f06f351690f2 9090484 libruby3.3-dbgsym_3.3.13-0+deb13u1_i386.deb e8dfcec57f38d22fb5510da20a829328a292755c90fce3152336e60d00eb1d8c 5636400 libruby3.3_3.3.13-0+deb13u1_i386.deb 0bcdae405cf680e10549fe669e06aee6b2a5d0fdc8daf3dd9074b0bfa41ee2e3 3528 ruby3.3-dbgsym_3.3.13-0+deb13u1_i386.deb a4cbc1219444b9811ce34ea968472fa96d939eee74c3a0b0e6f500ad6ad721fb 267740 ruby3.3-dev_3.3.13-0+deb13u1_i386.deb 6093b66cf714f9a8ce369d0aab86c0dae241810cafb30a5879d831e757d4fd80 8052 ruby3.3_3.3.13-0+deb13u1_i386-buildd.buildinfo e0cd058b218c107c37f82667f8e021e3a4acd445d6f34483d9a3333ed132fc20 57464 ruby3.3_3.3.13-0+deb13u1_i386.deb Files: ede5f0440be3b2e4172dd3ba31391342 9090484 debug optional libruby3.3-dbgsym_3.3.13-0+deb13u1_i386.deb f6c17226d1a116872cfea60381d0ebf6 5636400 libs optional libruby3.3_3.3.13-0+deb13u1_i386.deb 4d641c2742213bb966965162f11a47cc 3528 debug optional ruby3.3-dbgsym_3.3.13-0+deb13u1_i386.deb 0f12462b02d4a56f3eb38581d3b556c2 267740 ruby optional ruby3.3-dev_3.3.13-0+deb13u1_i386.deb 302677431d94d3060c4c974e407dc241 8052 ruby optional ruby3.3_3.3.13-0+deb13u1_i386-buildd.buildinfo f750494316dca0a7023c3c5de895d30b 57464 ruby optional ruby3.3_3.3.13-0+deb13u1_i386.deb -----BEGIN PGP SIGNATURE----- iQIzBAEBCgAdFiEEmtr4KUMaso2EQ6NrTwt/65ON6zcFAmrsjaEACgkQTwt/65ON 6zeUHhAAvPxxY2AY9tCde3rj7z8wqlN5x8qyony2JoBw/nsDQ2VEAhywRYyXfGhV o27eRYCZ9Bku4i5Dd7li+xN9bgiF+F6NeraofYJCR4Sd2+mom4pIYIl1gzIIkKni +0fhVrURBAA8T0IFkzoj0ajZPRmrM8mBPcHbmdd52eLGfk9BVYGshHyx/4J2kz/M XflQ3DhCL2/Ctnu/UpJgoH4H4edWALnhxVbicUxqjL6tnkEQYxyoppRWEqwqcRmO ElfRKO71/VOK6Jf/NJ41NkixqycQNrqdaxJTDwrtKjhBDpDf2SYdG1YCRcctDXxl BRqi+0eGfe7wTokJiRvSXyFCV2Pa6M30dnNunpPKkyScx/Hg2PeOBY00o1zIcGKp kYb+Au662q6zrHLqNRbAOhEdXU9wjcALV/BQE+R06L/FxY8vPgUhg1OWsL7mrBAO wetMAuD1KczullumeM/lGxQoKgOfWo5iE6+JvNHtBaNZ0uE3pqdQWriXRe3PXyfF vCxhjtnK0/MRObQt7wvDv7CrT3samZL1GEw02hGpZR5jzQ+zCaCpRoo5G5vIYTwR uBsDuP6W8Ih4GPkSykyfyn0Mw2M7NnQc43fS8fFJARaVjtqYY886pJ74vhBj9arX KdjI2NbEOJpBKff8sKT4S90pdmXve9hYr2bmYGxD5hNtBGLYuLk= =3uwH -----END PGP SIGNATURE-----