-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

Format: 1.8
Date: Fri, 30 Oct 2026 15:35:16 -0300
Source: ruby3.3
Architecture: source
Version: 3.3.13-0+deb13u1
Distribution: trixie-security
Urgency: medium
Maintainer: Debian Ruby Team <pkg-ruby-extras-maintainers@lists.alioth.debian.org>
Changed-By: Lucas Kanashiro <kanashiro@debian.org>
Changes:
 ruby3.3 (3.3.13-0+deb13u1) trixie-security; urgency=medium
 .
   * New upstream version 3.3.13. It contains the following security fixes:
     - resolv:
       + CVE-2025-24294: Fix denial of service caused by excessive CPU
         consumption when parsing highly compressed DNS names.
       + CVE-2026-80212: Fix unbounded memory consumption when processing
         DNS responses containing unknown resource record types.
       + CVE-2026-80213: Fix DNS hostname validation bypass caused by
         incorrectly handling DNS label and name length limits.
     - REXML:
       + CVE-2025-58767: Fix denial of service when parsing XML documents
         containing multiple XML declarations.
     - uri:
       + CVE-2025-61594: Fix credential leakage when combining URIs using
         the '+' operator.
     - zlib:
       + CVE-2026-27820: Fix buffer overflow in Zlib::GzipReader.
     - erb:
       + CVE-2026-41316: Fix deserialization guard bypass allowing
         arbitrary code execution through def_method, def_module and
         def_class.
     - net-imap:
       + CVE-2026-42245: Fix denial of service caused by quadratic
         processing of IMAP responses containing multiple string literals.
       + CVE-2026-42246: Fix STARTTLS stripping vulnerability caused by
         incorrect handling of IMAP server responses.
       + CVE-2026-42256: Fix denial of service caused by excessive
         iteration counts in SCRAM authentication.
       + CVE-2026-42257: Fix IMAP command injection through unvalidated
         raw command arguments.
       + CVE-2026-42258: Fix IMAP command injection through unvalidated
         Symbol arguments.
       + CVE-2026-47240: Fix IMAP command injection through
         non-synchronizing literals in raw arguments.
       + CVE-2026-47241: Fix denial of service caused by incomplete
         validation of raw IMAP command arguments.
       + CVE-2026-47242: Fix IMAP command injection through unvalidated
         arguments to the ID and ENABLE commands.
     - Onigmo (regular expression engine):
       + CVE-2026-89078: Fix a double-free vulnerability in regular
         expression compilation.
       + CVE-2026-93577: Fix an integer overflow vulnerability in
         regular expression compilation.
       + CVE-2026-97229: Fix an integer overflow vulnerability in
         regular expression compilation.
       + CVE-2026-110264: Fix an internal ID overflow vulnerability in
         regular expression compilation.
   * d/p/CVE-2025-27221_{1,2}.patch: removed, applied by upstream
Checksums-Sha1:
 23bc1b08e06ed83247ab1b4f47346e04bae7252c 2700 ruby3.3_3.3.13-0+deb13u1.dsc
 3a172307e7f4bc3b08a5c9dd3511e25cbc6f040d 14078404 ruby3.3_3.3.13.orig.tar.xz
 5bad7977767a7552cdbad07b79b68c1114353df4 64468 ruby3.3_3.3.13-0+deb13u1.debian.tar.xz
 07bea98aff0b3a2d7b2de73e743e1c81302a3a0d 6600 ruby3.3_3.3.13-0+deb13u1_source.buildinfo
Checksums-Sha256:
 7212f00dbbf9eed75d45dbb8c8d27543701ad6c5969debb35999f649aaddcd43 2700 ruby3.3_3.3.13-0+deb13u1.dsc
 c65da8ce035ec279f732446a772d54047daa520a5720b7a94d49fe61047dc8ef 14078404 ruby3.3_3.3.13.orig.tar.xz
 337e2bc8f804eaef8d61e913ba100e541f6ac74510ec4b70c367c238af50aa13 64468 ruby3.3_3.3.13-0+deb13u1.debian.tar.xz
 03a74c2832847597ef66a256c668b36c358f125f0f74af4a2917353678ec5586 6600 ruby3.3_3.3.13-0+deb13u1_source.buildinfo
Files:
 d1f27a9d42b78166a091c0a43dace526 2700 ruby optional ruby3.3_3.3.13-0+deb13u1.dsc
 10a8dd666a5a7dce16cbffed5d62db8d 14078404 ruby optional ruby3.3_3.3.13.orig.tar.xz
 961956d74e3fc7d141839d4e5b6561c0 64468 ruby optional ruby3.3_3.3.13-0+deb13u1.debian.tar.xz
 281373714be5ce414b86dbf753cdf06a 6600 ruby optional ruby3.3_3.3.13-0+deb13u1_source.buildinfo

-----BEGIN PGP SIGNATURE-----

wsG7BAEBCgBvBYJq7IICCRD4I6JymIPJfEcUAAAAAAAeACBzYWx0QG5vdGF0aW9u
cy5zZXF1b2lhLXBncC5vcmcVz+aG7fdz4cuGaL8hEdVGFfLSaVojdVeFMAyhpZSa
ihYhBI7Ww/i6ydt/wTCocPgjonKYg8l8AAClNw//fyczRVvi6xkl1q9+GSCdEi88
XYRBBczUS53y8Ua2Udj4qLzbE+YwTDK8zta7AXMQ8DagIDGPyiKNz5I5p/q8CBK7
H/8mIKF3Nnwja4yOy1plNJk7GVJO22ilzmwhMVsWICiahO3xOW8ncj4E1+RmGJzY
SXWCbCHAwMko7v6OxQxW2dDmo69ksyx18v/ZQYHPO9S5/XeaplkBc9LuywXPZl/l
vHMObdw1mbma6y8hbb7Ju8kgwMlK8NyNDkB2pGlQUW6ntMUcNmkILJVMpikMG2ha
JGBR/DmuSyQ3U5AEjKJyY2HAQFVR8BaKiu+5jJx32gCQqgEIBVaJddceYw68cfJM
ZcOjV8s6I67Gz7ennQ7jfBE+NEAe5CXLVdRs1O4aomfeTYlFe+kO009xD1zIP0bA
N8ZOAoD9JcIok1dmljkfn32zZVnK4b5kJF2mVXbmEWyrqVm9dV1Hm4dkmFUTVhjD
y5G9TsOEz83uU1GUr+7I5cCbzcl0DO3c5UIJi6rINvXkNRE1pJGdC1bKi4twj2q5
glMMAa5jZP07rBmLDuwD7P7V7ZKhOAtAtGShuUq20tkPu7sZy9DTo6PRYcoQmSw0
dMe7Hs1++eWIdb9UYwpr7Gt1kw6Ph6+SNONAkjT3h+xP8Jk282UoR3Rx5XySOiRO
5FR4ArqJSMTT83Fqc7U=
=sqai
-----END PGP SIGNATURE-----