-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 Format: 1.8 Date: Fri, 30 Oct 2026 15:35:16 -0300 Source: ruby3.3 Binary: libruby3.3 libruby3.3-dbgsym ruby3.3 ruby3.3-dbgsym ruby3.3-dev Architecture: armhf Version: 3.3.13-0+deb13u1 Distribution: trixie-security Urgency: medium Maintainer: armhf Build Daemon (arm-conova-01) Changed-By: Lucas Kanashiro Description: libruby3.3 - Libraries necessary to run Ruby 3.3 ruby3.3 - Interpreter of object-oriented scripting language Ruby ruby3.3-dev - Header files for compiling extension modules for the Ruby 3.3 Changes: ruby3.3 (3.3.13-0+deb13u1) trixie-security; urgency=medium . * New upstream version 3.3.13. It contains the following security fixes: - resolv: + CVE-2025-24294: Fix denial of service caused by excessive CPU consumption when parsing highly compressed DNS names. + CVE-2026-80212: Fix unbounded memory consumption when processing DNS responses containing unknown resource record types. + CVE-2026-80213: Fix DNS hostname validation bypass caused by incorrectly handling DNS label and name length limits. - REXML: + CVE-2025-58767: Fix denial of service when parsing XML documents containing multiple XML declarations. - uri: + CVE-2025-61594: Fix credential leakage when combining URIs using the '+' operator. - zlib: + CVE-2026-27820: Fix buffer overflow in Zlib::GzipReader. - erb: + CVE-2026-41316: Fix deserialization guard bypass allowing arbitrary code execution through def_method, def_module and def_class. - net-imap: + CVE-2026-42245: Fix denial of service caused by quadratic processing of IMAP responses containing multiple string literals. + CVE-2026-42246: Fix STARTTLS stripping vulnerability caused by incorrect handling of IMAP server responses. + CVE-2026-42256: Fix denial of service caused by excessive iteration counts in SCRAM authentication. + CVE-2026-42257: Fix IMAP command injection through unvalidated raw command arguments. + CVE-2026-42258: Fix IMAP command injection through unvalidated Symbol arguments. + CVE-2026-47240: Fix IMAP command injection through non-synchronizing literals in raw arguments. + CVE-2026-47241: Fix denial of service caused by incomplete validation of raw IMAP command arguments. + CVE-2026-47242: Fix IMAP command injection through unvalidated arguments to the ID and ENABLE commands. - Onigmo (regular expression engine): + CVE-2026-89078: Fix a double-free vulnerability in regular expression compilation. + CVE-2026-93577: Fix an integer overflow vulnerability in regular expression compilation. + CVE-2026-97229: Fix an integer overflow vulnerability in regular expression compilation. + CVE-2026-110264: Fix an internal ID overflow vulnerability in regular expression compilation. * d/p/CVE-2025-27221_{1,2}.patch: removed, applied by upstream Checksums-Sha1: 848de79924cefe6bcf9d3db8d325c56c93bbf976 9857232 libruby3.3-dbgsym_3.3.13-0+deb13u1_armhf.deb 0d3a970ed21afead84e2a2d8b409702154a11097 5248688 libruby3.3_3.3.13-0+deb13u1_armhf.deb 21ffe600a433ba4f495c9d709efb34891542b1f9 3832 ruby3.3-dbgsym_3.3.13-0+deb13u1_armhf.deb f37f3c5d180715bc8a11c1e2f67a5a017ea2ca2c 267672 ruby3.3-dev_3.3.13-0+deb13u1_armhf.deb 5c7f6d22cd4870a998924be07e5827e0ef288717 8026 ruby3.3_3.3.13-0+deb13u1_armhf-buildd.buildinfo 6c9942557b01947ab2ec08668fabe1834e1f9072 57444 ruby3.3_3.3.13-0+deb13u1_armhf.deb Checksums-Sha256: 8a6af73ac9f2c5ffd0eecad5b467981e4cb92f20cd0fc6115a8293ad479f4e1f 9857232 libruby3.3-dbgsym_3.3.13-0+deb13u1_armhf.deb b08dc853f6a49ec3c8d0bf0382f9ebda63f6210e99f2c2ef2dd97fa94e83defb 5248688 libruby3.3_3.3.13-0+deb13u1_armhf.deb 57d9a930cd1e09497de02c44efc6f9c558ae1095806bf2c59a4da23ff07793d2 3832 ruby3.3-dbgsym_3.3.13-0+deb13u1_armhf.deb ab27d2733c8be138b741869f9a0b3b404249e96abc8af4a8b0229a858b82274b 267672 ruby3.3-dev_3.3.13-0+deb13u1_armhf.deb 830c4941811069aa22b46fec6e127f17cb0ed6c8a98bec816d0aa79b8f6caeab 8026 ruby3.3_3.3.13-0+deb13u1_armhf-buildd.buildinfo 354e7fbf750cb44a544b6074e6b9a4ade02dd6c7cbd615da1e8aa4aafbd286ca 57444 ruby3.3_3.3.13-0+deb13u1_armhf.deb Files: 4405dce25e4d5af4cb6f2d577117d834 9857232 debug optional libruby3.3-dbgsym_3.3.13-0+deb13u1_armhf.deb 86dd8db995705abe7d1f356551cf95aa 5248688 libs optional libruby3.3_3.3.13-0+deb13u1_armhf.deb f404a56e2c070a2aaa1a6fbd22e642a0 3832 debug optional ruby3.3-dbgsym_3.3.13-0+deb13u1_armhf.deb b3269a352b0ccc6e349b35b470eec1c4 267672 ruby optional ruby3.3-dev_3.3.13-0+deb13u1_armhf.deb 57f7c98df9641a5bcdf4d60d6daf896a 8026 ruby optional ruby3.3_3.3.13-0+deb13u1_armhf-buildd.buildinfo ab8256a0e88c2d37f958e3500c2a159f 57444 ruby optional ruby3.3_3.3.13-0+deb13u1_armhf.deb -----BEGIN PGP SIGNATURE----- iQIzBAEBCgAdFiEEdK9iafpA71gaFfL5MLZgEo1cLWsFAmrsjNAACgkQMLZgEo1c LWsh0g//VO7lYWLX9/+h4Fa4QHHjp9hO0reLYjx0Sn45wFJ2IoXTqgqDrrGkdnk6 3tzVbEP8/wEkaZ/q475lDXZU0hGm2HKdXhKGkv7HCdv2tmlLr5Tz6S9zghQWtJYO p+i2QIqjOnzFKfSZdfBsqSl2Z2/jTGda5n2VuO7/2kWzlO7jxv2+CnmwYAoZ29QA gKydG3lUrQM4SBv58/UP8uhGx6Ir1+CV9tj8GcSEz3fuupX+ZLXwCMsBAYfGGgjM 3Sel+foEVCmXmt9WHqGjE6tgpfbuTiJysIiZiy9cUnM33lMVTfCV9RUaFsybHNoQ F6Cg+dGAVl7uTr256HgAhwVvLpAFe/WZlZlKZ3+tA044aOYxLHzCSGW2/rhLn0KH thxc8SuI70km4kZtnAwBbrQiCRTd/IBb5sutPJNjGBEpo4TfwCTmLRd4rXH8wz4T M6YWRtuCyNEDvUFmNlVGu8ksr8q2wW9wnjg44c1qwRCSPB5JXezt+J7ca7NcB8i0 15QfrLjPOWJNbuSZwmDeRtsBZYUc47xXWtPAAyHdkGrz9oX1Gt1ziQ8UzXCYxukT UKxMqoZkzmBNDIji1B4fAbqIjzMuKXk/kMFqIwqUaDUTCH34XHKCVeh+y8Gl0Wpt W8yPS/IJV16tg5N9JINZyya8lwdNdQ+Lyq5JcyUC3u9MEVIJyTc= =DHB4 -----END PGP SIGNATURE-----