-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 Format: 1.8 Date: Fri, 30 Oct 2026 15:35:16 -0300 Source: ruby3.3 Binary: libruby3.3 libruby3.3-dbgsym ruby3.3 ruby3.3-dbgsym ruby3.3-dev Architecture: ppc64el Version: 3.3.13-0+deb13u1 Distribution: trixie-security Urgency: medium Maintainer: ppc64el Build Daemon (ppc64el-conova-01) Changed-By: Lucas Kanashiro Description: libruby3.3 - Libraries necessary to run Ruby 3.3 ruby3.3 - Interpreter of object-oriented scripting language Ruby ruby3.3-dev - Header files for compiling extension modules for the Ruby 3.3 Changes: ruby3.3 (3.3.13-0+deb13u1) trixie-security; urgency=medium . * New upstream version 3.3.13. It contains the following security fixes: - resolv: + CVE-2025-24294: Fix denial of service caused by excessive CPU consumption when parsing highly compressed DNS names. + CVE-2026-80212: Fix unbounded memory consumption when processing DNS responses containing unknown resource record types. + CVE-2026-80213: Fix DNS hostname validation bypass caused by incorrectly handling DNS label and name length limits. - REXML: + CVE-2025-58767: Fix denial of service when parsing XML documents containing multiple XML declarations. - uri: + CVE-2025-61594: Fix credential leakage when combining URIs using the '+' operator. - zlib: + CVE-2026-27820: Fix buffer overflow in Zlib::GzipReader. - erb: + CVE-2026-41316: Fix deserialization guard bypass allowing arbitrary code execution through def_method, def_module and def_class. - net-imap: + CVE-2026-42245: Fix denial of service caused by quadratic processing of IMAP responses containing multiple string literals. + CVE-2026-42246: Fix STARTTLS stripping vulnerability caused by incorrect handling of IMAP server responses. + CVE-2026-42256: Fix denial of service caused by excessive iteration counts in SCRAM authentication. + CVE-2026-42257: Fix IMAP command injection through unvalidated raw command arguments. + CVE-2026-42258: Fix IMAP command injection through unvalidated Symbol arguments. + CVE-2026-47240: Fix IMAP command injection through non-synchronizing literals in raw arguments. + CVE-2026-47241: Fix denial of service caused by incomplete validation of raw IMAP command arguments. + CVE-2026-47242: Fix IMAP command injection through unvalidated arguments to the ID and ENABLE commands. - Onigmo (regular expression engine): + CVE-2026-89078: Fix a double-free vulnerability in regular expression compilation. + CVE-2026-93577: Fix an integer overflow vulnerability in regular expression compilation. + CVE-2026-97229: Fix an integer overflow vulnerability in regular expression compilation. + CVE-2026-110264: Fix an internal ID overflow vulnerability in regular expression compilation. * d/p/CVE-2025-27221_{1,2}.patch: removed, applied by upstream Checksums-Sha1: cd6afb02241a31e0dcecf06c5f088840aa165117 10153284 libruby3.3-dbgsym_3.3.13-0+deb13u1_ppc64el.deb bc3157bd0ba62f358e787466fda284fc5d35225f 5590000 libruby3.3_3.3.13-0+deb13u1_ppc64el.deb 72b3131768222f2309806fad262bd8235526b7a4 3764 ruby3.3-dbgsym_3.3.13-0+deb13u1_ppc64el.deb 9facc82485f8b09d15a363b14229c4f8eecae3f1 267692 ruby3.3-dev_3.3.13-0+deb13u1_ppc64el.deb 3a7c13e139620a7b1f3177783302ce465bc5560c 8180 ruby3.3_3.3.13-0+deb13u1_ppc64el-buildd.buildinfo 8e0c33b5f4a732d3074665761fdb2c6472fb6d6a 57488 ruby3.3_3.3.13-0+deb13u1_ppc64el.deb Checksums-Sha256: 6cef6a58bccce3f63fef9c3acc04c53eff44ed690339095d127e46543e44b5d1 10153284 libruby3.3-dbgsym_3.3.13-0+deb13u1_ppc64el.deb 0014ccf0f2eed65d838b6127781520af92c7b97928df7812113001249d68852c 5590000 libruby3.3_3.3.13-0+deb13u1_ppc64el.deb 226df8a1fc2d5b80d0cd63b0e4da0fb794249a95b872facb665d70a3a6a834af 3764 ruby3.3-dbgsym_3.3.13-0+deb13u1_ppc64el.deb a4a5d385ee7eb151a280a9f5ab5191825db6b732ed1b852db9a15e64c627c299 267692 ruby3.3-dev_3.3.13-0+deb13u1_ppc64el.deb 565c23c906c35b17eae9b4322c469777dcab7053bf37307fcdc402f71d35868e 8180 ruby3.3_3.3.13-0+deb13u1_ppc64el-buildd.buildinfo a1102a32cd342a2fe170079a1ac08c9ce2e255fa3a2193ad0f6c549e0564b022 57488 ruby3.3_3.3.13-0+deb13u1_ppc64el.deb Files: c6f4224d8b19b09721ae8717c376c634 10153284 debug optional libruby3.3-dbgsym_3.3.13-0+deb13u1_ppc64el.deb 7db2682d5098b33cb0c252e35f24673f 5590000 libs optional libruby3.3_3.3.13-0+deb13u1_ppc64el.deb ed61d26437892d2fe2c39170a5462a3a 3764 debug optional ruby3.3-dbgsym_3.3.13-0+deb13u1_ppc64el.deb c3e3a79c00dee88d6c5337899946e174 267692 ruby optional ruby3.3-dev_3.3.13-0+deb13u1_ppc64el.deb 3c9bbea29910255cd5ae225acbb3488e 8180 ruby optional ruby3.3_3.3.13-0+deb13u1_ppc64el-buildd.buildinfo 397f257d72f1818b89b48508bfcd3c25 57488 ruby optional ruby3.3_3.3.13-0+deb13u1_ppc64el.deb -----BEGIN PGP SIGNATURE----- iQIzBAEBCgAdFiEEDoRc43uRWMOoIqIgDNLUPhbmg7MFAmrsjIUACgkQDNLUPhbm g7OFnA//T/POLaZsh6UgrlYbgBsR6f4Ql0UGx5J85919xbdZoM4Zz317p5L3eFNe 4CWZ76SYV7aNrVsC4rTQMcgGAFq+xXSzlCq82lW6kXGge+N4QVTn+u7VQYxdwu/y Rnea32HFnfUS5bcmgc5g4JF795b6UTUSVrh+keJnwCTQcDVHOVJIAlhYYfT2saCs 0auC2RVzMfoQf+sLP8gfSUD8/fcIRZ8fV4DyxbGLTc9jVy4LHEgyGu4EQSjP6YUf vIo/8W9AA/vXxwOHsiDFK/W3ilMwVkPOlxABLTg3Y84HZi6uQluKsquCeB6nZPO2 O/Liyn/FC8eQlvJFisWKx2vbc4swSBNGTQiIYqkINo1qTdeajIRIGz5CndZ2SfmK qYfO6isFz+RprM91ril/GVYGetEje/A9EMZJe2679CMK8Zxe0jQVzAfswkz+I0Mp K8dmdvyS+rbT+s9ZB2sSjPBsPBOY937etLS93IA1pC8ULa10VfDP5fzFc9V22s7G 7qmMB9S94GDEc8c9PQwxTLLNB+yb3iv7deCK5/TdQD2r6bUGWot41wnwdvEmLiBP Muug2wrQt40PaY2ecbkwdMAq1Ywn4PngCRj5ZVtCyfzxGbe+Yr5ZqwHsxcd9W3nw ezNX9vec2CQ4xHdTdDm0okTfpP9jCYrikcv2HX5CyhPMgevyACM= =Slal -----END PGP SIGNATURE-----