-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 Format: 1.8 Date: Fri, 30 Oct 2026 15:35:16 -0300 Source: ruby3.3 Binary: libruby3.3 libruby3.3-dbgsym ruby3.3 ruby3.3-dbgsym ruby3.3-dev Architecture: riscv64 Version: 3.3.13-0+deb13u1 Distribution: trixie-security Urgency: medium Maintainer: riscv64 Build Daemon (rv-osuosl-04) Changed-By: Lucas Kanashiro Description: libruby3.3 - Libraries necessary to run Ruby 3.3 ruby3.3 - Interpreter of object-oriented scripting language Ruby ruby3.3-dev - Header files for compiling extension modules for the Ruby 3.3 Changes: ruby3.3 (3.3.13-0+deb13u1) trixie-security; urgency=medium . * New upstream version 3.3.13. It contains the following security fixes: - resolv: + CVE-2025-24294: Fix denial of service caused by excessive CPU consumption when parsing highly compressed DNS names. + CVE-2026-80212: Fix unbounded memory consumption when processing DNS responses containing unknown resource record types. + CVE-2026-80213: Fix DNS hostname validation bypass caused by incorrectly handling DNS label and name length limits. - REXML: + CVE-2025-58767: Fix denial of service when parsing XML documents containing multiple XML declarations. - uri: + CVE-2025-61594: Fix credential leakage when combining URIs using the '+' operator. - zlib: + CVE-2026-27820: Fix buffer overflow in Zlib::GzipReader. - erb: + CVE-2026-41316: Fix deserialization guard bypass allowing arbitrary code execution through def_method, def_module and def_class. - net-imap: + CVE-2026-42245: Fix denial of service caused by quadratic processing of IMAP responses containing multiple string literals. + CVE-2026-42246: Fix STARTTLS stripping vulnerability caused by incorrect handling of IMAP server responses. + CVE-2026-42256: Fix denial of service caused by excessive iteration counts in SCRAM authentication. + CVE-2026-42257: Fix IMAP command injection through unvalidated raw command arguments. + CVE-2026-42258: Fix IMAP command injection through unvalidated Symbol arguments. + CVE-2026-47240: Fix IMAP command injection through non-synchronizing literals in raw arguments. + CVE-2026-47241: Fix denial of service caused by incomplete validation of raw IMAP command arguments. + CVE-2026-47242: Fix IMAP command injection through unvalidated arguments to the ID and ENABLE commands. - Onigmo (regular expression engine): + CVE-2026-89078: Fix a double-free vulnerability in regular expression compilation. + CVE-2026-93577: Fix an integer overflow vulnerability in regular expression compilation. + CVE-2026-97229: Fix an integer overflow vulnerability in regular expression compilation. + CVE-2026-110264: Fix an internal ID overflow vulnerability in regular expression compilation. * d/p/CVE-2025-27221_{1,2}.patch: removed, applied by upstream Checksums-Sha1: 68f773629888caf876c564993dd6c1be7c4fd889 8824984 libruby3.3-dbgsym_3.3.13-0+deb13u1_riscv64.deb ebcf85ae1ac11aea821e128bd044a3d50d531e1f 5474396 libruby3.3_3.3.13-0+deb13u1_riscv64.deb 8b1bfbe9c1866f8aa2c0e60280c85aaa838ee02a 3788 ruby3.3-dbgsym_3.3.13-0+deb13u1_riscv64.deb 13ff42f1ec198ffa82128ec29dc2549966237783 267724 ruby3.3-dev_3.3.13-0+deb13u1_riscv64.deb f392d4aabf04ebc2965a936760b0bad418cd511b 8122 ruby3.3_3.3.13-0+deb13u1_riscv64-buildd.buildinfo 6df997ec39ef773b8efb69040179c5478b2a8d3e 57372 ruby3.3_3.3.13-0+deb13u1_riscv64.deb Checksums-Sha256: 974d870b1e7ac0704506cb4bf1e7c13165b55af2cf613ba83869b60a06e6d680 8824984 libruby3.3-dbgsym_3.3.13-0+deb13u1_riscv64.deb 0477ecf96b3319fc3e34a5d40336c1aa155c31882d9c0448d0fcdcbb8ba03f48 5474396 libruby3.3_3.3.13-0+deb13u1_riscv64.deb ed9278c7f98262295beefdaff370210640a0e9ea29461c353f4dc2dd4d4717ff 3788 ruby3.3-dbgsym_3.3.13-0+deb13u1_riscv64.deb 08b446ea511e27f3937636243f6d28ad98438dfcf700f28d13f63912dd5b7b28 267724 ruby3.3-dev_3.3.13-0+deb13u1_riscv64.deb a39fe918e753f8605cf1c2053ed413e5b59e1567328d7ebbbb42a3a198993d93 8122 ruby3.3_3.3.13-0+deb13u1_riscv64-buildd.buildinfo c722765700af8341c187354b56b49958e044a44d9119a16a0b401757f282d76f 57372 ruby3.3_3.3.13-0+deb13u1_riscv64.deb Files: e23f9d1774cd6f870e14b193fd36870a 8824984 debug optional libruby3.3-dbgsym_3.3.13-0+deb13u1_riscv64.deb d299e22701ba1e037a055a6e3b61c7c3 5474396 libs optional libruby3.3_3.3.13-0+deb13u1_riscv64.deb e42a49bf3b61ae87e7df4047a130a5eb 3788 debug optional ruby3.3-dbgsym_3.3.13-0+deb13u1_riscv64.deb 4d501f974e9d4806d3081f73e31338a4 267724 ruby optional ruby3.3-dev_3.3.13-0+deb13u1_riscv64.deb f244fe0af8236ad99ca72a68de6151c2 8122 ruby optional ruby3.3_3.3.13-0+deb13u1_riscv64-buildd.buildinfo 32489ae41bc388d3da0682195a817b1d 57372 ruby optional ruby3.3_3.3.13-0+deb13u1_riscv64.deb -----BEGIN PGP SIGNATURE----- iQIzBAEBCgAdFiEEgLDDByWcR07HDSHyNVgvumj7+mMFAmrszdsACgkQNVgvumj7 +mOOpQ//UNO8lPdNSKUfTBypaCqzuVfbMbUJXLQNLhegJEYNQjZy2j3pMUTEJXEP 38ZxmxFZtXDzykOj8N9LknqO623IVVGbKXyqScYwz+wm5d1crnm0V2cJ2HJl4G7v 5qJIgtvoLmWogD+hwOR/k/9YyXfrW1+/5Kpit/zTC17tsPgWFytDLFIGWXaCshyQ Hoqdw28TzwDD1G72r2/2NvXsNLxujI/O9G3L/gQQOD/cZqCu9r/JOZxz3rkKVuq8 xflGBKf3ouhIcfF4hSsjAbbItXXKwU5C73ET5wGVFK2vZdA3rDlPPDCQZDtISV2q kGpz7WnXFeEazCenMApMorsOPc7u+g0E1qERhfGiGTAkXzzOSEjlEsFkke1fLWAu d5ZbSIXcWe6kEWKkQbGeL9Sjs27aG1/wcT2xoYPbyma/Hc+gt5OfA4vC7mW8XSYv 7FDVfzOHDj2s1/2mf9td3HquE1SWIZcasC0fg1Z0YKVW0syqILuiS3uuDR1VlGs6 qlhO2HudWNpT4Ygbesh6NoFPY5kLK1urzKXntWXT2Hs1eIJOJnG1tPqUlByp1bgP rGsGlQqktm68Q4tdrfL75BQ/AsTmam8KKOTowtnc5q3+UqCk8TBqTSh4Umhz6d3c c0OIRwX7X4uwKQAHfJmOKd9ymYx+gTS3dygVFmZE5DjT8z3mqCs= =NaWU -----END PGP SIGNATURE-----