-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 Format: 1.8 Date: Fri, 30 Oct 2026 15:35:16 -0300 Source: ruby3.3 Binary: libruby3.3 libruby3.3-dbgsym ruby3.3 ruby3.3-dbgsym ruby3.3-dev Architecture: armel Version: 3.3.13-0+deb13u1 Distribution: trixie-security Urgency: medium Maintainer: armel Build Daemon (arm-conova-02) Changed-By: Lucas Kanashiro Description: libruby3.3 - Libraries necessary to run Ruby 3.3 ruby3.3 - Interpreter of object-oriented scripting language Ruby ruby3.3-dev - Header files for compiling extension modules for the Ruby 3.3 Changes: ruby3.3 (3.3.13-0+deb13u1) trixie-security; urgency=medium . * New upstream version 3.3.13. It contains the following security fixes: - resolv: + CVE-2025-24294: Fix denial of service caused by excessive CPU consumption when parsing highly compressed DNS names. + CVE-2026-80212: Fix unbounded memory consumption when processing DNS responses containing unknown resource record types. + CVE-2026-80213: Fix DNS hostname validation bypass caused by incorrectly handling DNS label and name length limits. - REXML: + CVE-2025-58767: Fix denial of service when parsing XML documents containing multiple XML declarations. - uri: + CVE-2025-61594: Fix credential leakage when combining URIs using the '+' operator. - zlib: + CVE-2026-27820: Fix buffer overflow in Zlib::GzipReader. - erb: + CVE-2026-41316: Fix deserialization guard bypass allowing arbitrary code execution through def_method, def_module and def_class. - net-imap: + CVE-2026-42245: Fix denial of service caused by quadratic processing of IMAP responses containing multiple string literals. + CVE-2026-42246: Fix STARTTLS stripping vulnerability caused by incorrect handling of IMAP server responses. + CVE-2026-42256: Fix denial of service caused by excessive iteration counts in SCRAM authentication. + CVE-2026-42257: Fix IMAP command injection through unvalidated raw command arguments. + CVE-2026-42258: Fix IMAP command injection through unvalidated Symbol arguments. + CVE-2026-47240: Fix IMAP command injection through non-synchronizing literals in raw arguments. + CVE-2026-47241: Fix denial of service caused by incomplete validation of raw IMAP command arguments. + CVE-2026-47242: Fix IMAP command injection through unvalidated arguments to the ID and ENABLE commands. - Onigmo (regular expression engine): + CVE-2026-89078: Fix a double-free vulnerability in regular expression compilation. + CVE-2026-93577: Fix an integer overflow vulnerability in regular expression compilation. + CVE-2026-97229: Fix an integer overflow vulnerability in regular expression compilation. + CVE-2026-110264: Fix an internal ID overflow vulnerability in regular expression compilation. * d/p/CVE-2025-27221_{1,2}.patch: removed, applied by upstream Checksums-Sha1: c8a63584a3805132e5d31b241040745480db25a6 9750752 libruby3.3-dbgsym_3.3.13-0+deb13u1_armel.deb 7985cfee2c00c79959a0be3e6ad9f849364c2e57 5193748 libruby3.3_3.3.13-0+deb13u1_armel.deb 6857040f3751527027c4d6435f7ea0728f6268da 3816 ruby3.3-dbgsym_3.3.13-0+deb13u1_armel.deb b5bc8d15f1d9f02bd33d4a3e5ca09a2f058b64ad 267656 ruby3.3-dev_3.3.13-0+deb13u1_armel.deb 989f6f1865e9ae0560ba5c2fe82cb83ee129c486 8012 ruby3.3_3.3.13-0+deb13u1_armel-buildd.buildinfo 4c7337cb3cf27a6175658b95306aed4ede37bc5e 57480 ruby3.3_3.3.13-0+deb13u1_armel.deb Checksums-Sha256: 71b295dfc7a7a61520407b7b8023a187fac5dfe9ddc1fc88ed1fe0b9a6c6af57 9750752 libruby3.3-dbgsym_3.3.13-0+deb13u1_armel.deb 769d2861c303d0bfc7ba51fe2d1a5b0ffe53c930768eecc46e2c3d344d391e31 5193748 libruby3.3_3.3.13-0+deb13u1_armel.deb b267a3dd3d71e661ad950a893dbc38302ea66ee30d891a9c54e99195072edb2b 3816 ruby3.3-dbgsym_3.3.13-0+deb13u1_armel.deb cd6b50fb3796dbeb297829cc9c1ac5d8d4f7e09a3f2a5958501c25c48df67c5c 267656 ruby3.3-dev_3.3.13-0+deb13u1_armel.deb 104978ef8a3abe9c93ff33853b559fcb6a700125ab2e359cdd8fe4658402c37e 8012 ruby3.3_3.3.13-0+deb13u1_armel-buildd.buildinfo c5b2628e8cbf3499e9e4f8a5fe521d69e20bc973003eb839d8e57414b06a3d70 57480 ruby3.3_3.3.13-0+deb13u1_armel.deb Files: 90c125ab2ab8313b436fc1a998d6f72e 9750752 debug optional libruby3.3-dbgsym_3.3.13-0+deb13u1_armel.deb ba23c13e90a44bfcbdd5940a982f951b 5193748 libs optional libruby3.3_3.3.13-0+deb13u1_armel.deb cd8819884c387e1fac13a434c5291ca9 3816 debug optional ruby3.3-dbgsym_3.3.13-0+deb13u1_armel.deb c60c5b8e9f2cc61e8de033ea710fa905 267656 ruby optional ruby3.3-dev_3.3.13-0+deb13u1_armel.deb 2c062e7f0e20cad662e37019499763d8 8012 ruby optional ruby3.3_3.3.13-0+deb13u1_armel-buildd.buildinfo 59dde2040cf4d6d11c9e2f4feff03a71 57480 ruby optional ruby3.3_3.3.13-0+deb13u1_armel.deb -----BEGIN PGP SIGNATURE----- iQIzBAEBCgAdFiEEa5s+5E+WDkV2pQjwIyDMsRzdi8EFAmrsjZUACgkQIyDMsRzd i8GapA/+OiizPyQ8fKoFc5Vb7XiVtKeXMVPwdtGcK5QHqrhrjlSn8nNMPq3JaG80 kf5UANgxX0DQRyCvTjaKdHE0nHqGjhF7n7GRxfvK8Ucv0lz6oHIoBzdrlKGtMhtD rlCDlfX//L67NzL4cG8eUZTJdnKfIvuO0DMmuDYX//c4agAGmzCzkAf3VJ2JfP6r hr/8D9ZrApsd5wTWD21klRtAsVbigRZ6rgoL6tp+ytHqzT3l9odpYe9EdJSwGNZk Cu/32EU0y0gB6oFLUMls4gpJ6NtQW9qJXD0YSz4twpKrXcffT3V3/zLJJ/0HM923 E1xRdNNgNj1Lj6mhscmEiCRKVMnCBFZCw5ohhbNvx0Utf2LG4CJG1FCHoathmpeK U9uzclv8anthGbdc6vrXdHM9SHh9M1KPgALKumHMT7loUvCoYHp+tNv6cQ9OG+Bx SzK4TddQwiyCDrzKnNM7Kj8SEHAvQP+jtKf6Wp/aizHWcItXDTvp0mWC4e3Q5zkS JVV00Z2Yg3FWpJ7fkFYOgFbgtuhz394NYQZph6eZCmV0KzqoXFpF9Z5l8YJAgkp+ TdezPcwbS61K2+U6NAcoLhNlEyhxA2k6dK2196GVMnsDd6MQX31o18d58V4cliiO EUozdaq/Qr6rtK/Psszal0JGHrKkeO7V7IU5hmQTF6172FZV794= =BfHI -----END PGP SIGNATURE-----