bundler-budit 0.6.2 → 0.6.3

data/data/ruby-advisory-db/gems/newrelic_rpm/OSVDB-90189.yml

@@ -1,17 +0,0 @@
----
-gem: newrelic_rpm
-cve: 2013-0284
-osvdb: 90189
-url: http://osvdb.org/show/osvdb/90189
-title: Ruby on Rails newrelic_rpm Gem Discloses Sensitive Information
-date: 2012-12-06
-
-description: |
-  A bug in the Ruby agent causes database connection information and raw SQL
-  statements to be transmitted to New Relic servers. The database connection
-  information includes the database IP address, username, and password
-
-cvss_v2: 5.0
-
-patched_versions: 
-  - ">= 3.5.3.25"

data/data/ruby-advisory-db/gems/nokogiri/CVE-2015-1819.yml

@@ -1,52 +0,0 @@
----
-gem: nokogiri
-cve: 2015-1819
-url: https://github.com/sparklemotion/nokogiri/issues/1374
-title: Nokogiri gem contains several vulnerabilities in libxml2 and libxslt
-date: 2015-04-14
-description: |
-  Several vulnerabilities were discovered in the libxml2 and libxslt libraries
-  that the Nokogiri gem depends on.
-
-  CVE-2015-1819
-  A denial of service flaw was found in the way libxml2 parsed XML
-  documents. This flaw could cause an application that uses libxml2 to use an
-  excessive amount of memory.
-
-  CVE-2015-7941
-  libxml2 does not properly stop parsing invalid input, which allows
-  context-dependent attackers to cause a denial of service (out-of-bounds read
-  and libxml2 crash) via crafted specially XML data.
-
-  CVE-2015-7942
-  The xmlParseConditionalSections function in parser.c in libxml2
-  does not properly skip intermediary entities when it stops parsing invalid
-  input, which allows context-dependent attackers to cause a denial of service
-  (out-of-bounds read and crash) via crafted XML data.
-
-  CVE-2015-7995
-  The xsltStylePreCompute function in preproc.c in libxslt 1.1.28 does not
-  check whether the parent node is an element, which allows attackers to cause
-  a denial of service using a specially crafted XML document.
-
-  CVE-2015-8035
-  The xz_decomp function in xzlib.c in libxml2 2.9.1 does not
-  properly detect compression errors, which allows context-dependent attackers
-  to cause a denial of service (process hang) via crafted XML data.
-
-  Another vulnerability was discoverd in libxml2 that could cause parsing
-  of unclosed comments to result in "conditional jump or move depends on
-  uninitialized value(s)" and unsafe memory access. This issue does not have a
-  CVE assigned yet. See related URLs for details. Patched in v1.6.7.rc4.
-patched_versions:
-  - "~> 1.6.6.4"
-  - ">= 1.6.7.rc4"
-related:
-  cve:
-    - 2015-7941
-    - 2015-7942
-    - 2015-7995
-    - 2015-8035
-  url:
-    - https://github.com/sparklemotion/nokogiri/pull/1376
-    - https://github.com/sparklemotion/nokogiri/commit/8f3de6d88d0da11fb62a45daa61b85ce71b4af59

data/data/ruby-advisory-db/gems/nokogiri/CVE-2015-5312.yml

@@ -1,92 +0,0 @@
----
-gem: nokogiri
-cve: 2015-5312
-url: https://groups.google.com/forum/#!topic/ruby-security-ann/aSbgDiwb24s
-title: Nokogiri gem contains several vulnerabilities in libxml2
-date: 2015-12-15
-
-description: |
-  Nokogiri version 1.6.7.1 has been released, pulling in several upstream
-  patches to the vendored libxml2 to address the following CVEs:
-
-  CVE-2015-5312
-  CVSS v2 Base Score: 7.1 (HIGH)
-  The xmlStringLenDecodeEntities function in parser.c in libxml2
-  before 2.9.3 does not properly prevent entity expansion, which
-  allows context-dependent attackers to cause a denial of
-  service (CPU consumption) via crafted XML data, a different
-  vulnerability than CVE-2014-3660.
-
-  CVE-2015-7497
-  CVSS v2 Base Score: 5.0 (MEDIUM)
-  Heap-based buffer overflow in the xmlDictComputeFastQKey
-  function in dict.c in libxml2 before 2.9.3 allows
-  context-dependent attackers to cause a denial of service via
-  unspecified vectors.
-
-  CVE-2015-7498
-  CVSS v2 Base Score: 5.0 (MEDIUM)
-  Heap-based buffer overflow in the xmlParseXmlDecl function in
-  parser.c in libxml2 before 2.9.3 allows context-dependent
-  attackers to cause a denial of service via unspecified vectors
-  related to extracting errors after an encoding conversion
-  failure.
-
-  CVE-2015-7499
-  CVSS v2 Base Score: 5.0 (MEDIUM)
-  Heap-based buffer overflow in the xmlGROW function in parser.c
-  in libxml2 before 2.9.3 allows context-dependent attackers to
-  obtain sensitive process memory information via unspecified
-  vectors.
-
-  CVE-2015-7500
-  CVSS v2 Base Score: 5.0 (MEDIUM)
-  The xmlParseMisc function in parser.c in libxml2 before 2.9.3
-  allows context-dependent attackers to cause a denial of
-  service (out-of-bounds heap read) via unspecified vectors
-  related to incorrect entities boundaries and start tags.
-
-  CVE-2015-8241
-  CVSS v2 Base Score: 6.4 (MEDIUM)
-  The xmlNextChar function in libxml2 2.9.2 does not properly
-  check the state, which allows context-dependent attackers to
-  cause a denial of service (heap-based buffer over-read and
-  application crash) or obtain sensitive information via crafted
-  XML data.
-
-  CVE-2015-8242
-  CVSS v2 Base Score: 5.8 (MEDIUM)
-  The xmlSAX2TextNode function in SAX2.c in the push interface in
-  the HTML parser in libxml2 before 2.9.3 allows
-  context-dependent attackers to cause a denial of
-  service (stack-based buffer over-read and application crash) or
-  obtain sensitive information via crafted XML data.
-
-  CVE-2015-8317
-  CVSS v2 Base Score: 5.0 (MEDIUM)
-  The xmlParseXMLDecl function in parser.c in libxml2 before
-  2.9.3 allows context-dependent attackers to obtain sensitive
-  information via an (1) unterminated encoding value or (2)
-  incomplete XML declaration in XML data, which triggers an
-  out-of-bounds heap read.
-
-cvss_v2: 7.1
-
-unaffected_versions:
-  - "< 1.6.0"
-
-patched_versions:
-  - ">= 1.6.7.1"
-
-related:
-  cve:
-    - 2015-7497
-    - 2015-7498
-    - 2015-7499
-    - 2015-7500
-    - 2015-8241
-    - 2015-8242
-    - 2015-8317
-  url:
-    - https://github.com/sparklemotion/nokogiri/pull/1378
-    - https://github.com/sparklemotion/nokogiri/commit/4205af1a2a546f79d1b48df2ad8b27299c0099c5

data/data/ruby-advisory-db/gems/nokogiri/CVE-2015-7499.yml

@@ -1,37 +0,0 @@
----
-gem: nokogiri
-cve: 2015-7499
-url: https://groups.google.com/forum/#!topic/ruby-security-ann/Dy7YiKb_pMM
-title: |
-  Nokogiri gem contains a heap-based buffer overflow vulnerability in libxml2
-date: 2016-01-19
-
-description: |
-  Nokogiri version 1.6.7.2 has been released, pulling in several upstream
-  patches to the vendored libxml2 to address the following CVE:
-
-  CVE-2015-7499
-  CVSS v2 Base Score: 5.0 (MEDIUM)
-
-  Heap-based buffer overflow in the xmlGROW function in parser.c
-  in libxml2 before 2.9.3 allows context-dependent attackers to
-  obtain sensitive process memory information via unspecified
-  vectors.
-
-  libxml2 could be made to crash if it opened a specially crafted
-  file. It was discovered that libxml2 incorrectly handled certain
-  malformed documents. If a user or automated system were tricked
-  into opening a specially crafted document, an attacker could
-  possibly cause libxml2 to crash, resulting in a denial of service.
-
-cvss_v2: 5.0
-
-unaffected_versions:
-  - "< 1.6.0"
-
-patched_versions:
-  - ">= 1.6.7.2"
-
-related:
-  url:
-    - https://github.com/sparklemotion/nokogiri/commit/9eb540e7c905924a42757bf0a34c2c00707d536c

data/data/ruby-advisory-db/gems/nokogiri/CVE-2015-8806.yml

@@ -1,42 +0,0 @@
----
-gem: nokogiri
-cve: 2015-8806
-url: https://github.com/sparklemotion/nokogiri/issues/1473
-title: Denial of service or RCE from libxml2 and libxslt
-date: 2016-06-07
-description: |
-  Nokogiri is affected by series of vulnerabilities in libxml2 and libxslt,
-  which are libraries Nokogiri depends on. It was discovered that libxml2 and
-  libxslt incorrectly handled certain malformed documents, which can allow
-  malicious users to cause issues ranging from denial of service to remote code
-  execution attacks.
-
-  For more information, the Ubuntu Security Notice is a good start: 
-  http://www.ubuntu.com/usn/usn-2994-1/
-
-patched_versions:
-  - ">= 1.6.8"
-unaffected_versions:
-  - "< 1.6.0"
-related:
-  cve:
-    - 2016-1762
-    - 2016-1833
-    - 2016-1834
-    - 2016-1835
-    - 2016-1836
-    - 2016-1837
-    - 2016-1838
-    - 2016-1839
-    - 2016-1840
-    - 2016-2073
-    - 2016-3627
-    - 2016-3705
-    - 2016-4447
-    - 2016-4449
-    - 2016-4483
-  url:
-    - https://github.com/sparklemotion/nokogiri/issues/1473
-    - https://github.com/sparklemotion/nokogiri/commit/03d402212707bd5dfa0a21b7de5e91a7f9d90028
-    - https://mail.gnome.org/archives/xml/2016-May/msg00023.html
-    - http://www.ubuntu.com/usn/usn-2994-1/

data/data/ruby-advisory-db/gems/nokogiri/CVE-2016-4658.yml

@@ -1,33 +0,0 @@
----
-gem: nokogiri
-cve: 2016-4658
-url: https://github.com/sparklemotion/nokogiri/issues/1615
-title: Nokogiri gem contains several vulnerabilities in libxml2 and libxslt
-date: 2017-03-11
-description: |
-  Nokogiri version 1.7.1 has been released, pulling in several upstream
-  patches to the vendored libxml2 to address the following CVEs:
-
-  CVE-2016-4658
-  CVSS v3 Base Score: 9.8 (Critical)
-  libxml2 in Apple iOS before 10, OS X before 10.12, tvOS before 10, and
-  watchOS before 3 allows remote attackers to execute arbitrary code or cause
-  a denial of service (memory corruption) via a crafted XML document.
-
-  CVE-2016-5131
-  CVSS v3 Base Score: 8.8 (HIGH)
-  Use-after-free vulnerability in libxml2 through 2.9.4, as used in Google
-  Chrome before 52.0.2743.82, allows remote attackers to cause a denial of
-  service or possibly have unspecified other impact via vectors related to
-  the XPointer range-to function.
-
-cvss_v2: 10.0
-cvss_v3: 9.8
-
-patched_versions:
-  - ">= 1.7.1"
-related:
-  cve:
-    - 2016-5131
-  url:
-    - https://github.com/sparklemotion/nokogiri/issues/1615

data/data/ruby-advisory-db/gems/nokogiri/CVE-2017-15412.yml

@@ -1,23 +0,0 @@
----
-gem: nokogiri
-cve: 2017-15412
-url: https://github.com/sparklemotion/nokogiri/issues/1714
-title: Nokogiri gem, via libxml, is affected by DoS vulnerabilities
-date: 2018-01-29
-description: |
-  The version of libxml2 packaged with Nokogiri contains a
-  vulnerability. Nokogiri has mitigated these issue by upgrading to
-  libxml 2.9.6.
-
-  It was discovered that libxml2 incorrecty handled certain files. An attacker
-  could use this issue with specially constructed XML data to cause libxml2 to
-  consume resources, leading to a denial of service.
-
-patched_versions:
-  - ">= 1.8.2"
-related:
-  cve:
-    - 2017-18258
-  url:
-    - https://usn.ubuntu.com/usn/usn-3513-1/
-    - https://people.canonical.com/~ubuntu-security/cve/2017/CVE-2017-15412.html

data/data/ruby-advisory-db/gems/nokogiri/CVE-2017-16932.yml

@@ -1,21 +0,0 @@
----
-gem: nokogiri
-cve: 2017-16932
-url: https://github.com/sparklemotion/nokogiri/issues/1714
-title: Nokogiri gem, via libxml, is affected by DoS vulnerabilities
-date: 2018-01-29
-description: |
-  The version of libxml2 packaged with Nokogiri contains a
-  vulnerability. Nokogiri has mitigated these issue by upgrading to
-  libxml 2.9.5.
-
-  Wei Lei discovered that libxml2 incorrecty handled certain parameter
-  entities. An attacker could use this issue with specially constructed XML
-  data to cause libxml2 to consume resources, leading to a denial of service.
-
-patched_versions:
-  - ">= 1.8.1"
-related:
-  url:
-    - https://usn.ubuntu.com/usn/usn-3504-1/
-    - https://people.canonical.com/~ubuntu-security/cve/2017/CVE-2017-16932.html

data/data/ruby-advisory-db/gems/nokogiri/CVE-2017-5029.yml

@@ -1,44 +0,0 @@
----
-gem: nokogiri
-cve: 2017-5029
-url: https://github.com/sparklemotion/nokogiri/issues/1634
-title: Nokogiri gem contains two upstream vulnerabilities in libxslt 1.1.29
-date: 2017-05-09
-description: |
-    nokogiri version 1.7.2 has been released.
-
-    This is a security update based on 1.7.1, addressing two upstream
-    libxslt 1.1.29 vulnerabilities classified as "Medium" by Canonical 
-    and given a CVSS3 score of "6.5 Medium" and "8.8 High" by RedHat.
-
-    These patches only apply when using Nokogiri's vendored libxslt
-    package. If you're using your distro's system libraries, there's no
-    need to upgrade from 1.7.0.1 or 1.7.1 at this time.
-
-    Full details are available at the github issue linked to in the
-    changelog below.
-
-    -----
-
-    # 1.7.2 / 2017-05-09
-
-    ## Security Notes
-
-    [MRI] Upstream libxslt patches are applied to the vendored libxslt
-    1.1.29 which address CVE-2017-5029 and CVE-2016-4738.
-
-    For more information:
-
-    * https://github.com/sparklemotion/nokogiri/issues/1634
-    * http://people.canonical.com/~ubuntu-security/cve/2017/CVE-2017-5029.html
-    * http://people.canonical.com/~ubuntu-security/cve/2016/CVE-2016-4738.html
-
-patched_versions:
-  - ">= 1.7.2"
-related:
-  cve:
-    - 2016-4738
-    - 2017-5029
-  url:
-    - http://people.canonical.com/~ubuntu-security/cve/2017/CVE-2017-5029.html
-    - http://people.canonical.com/~ubuntu-security/cve/2016/CVE-2016-4738.html

data/data/ruby-advisory-db/gems/nokogiri/CVE-2017-9050.yml

@@ -1,60 +0,0 @@
----
-gem: nokogiri
-cve: 2017-9050
-url: https://github.com/sparklemotion/nokogiri/issues/1673
-title: Nokogiri gem, via libxml, is affected by DoS and RCE vulnerabilities 
-date: 2017-09-19
-description: |
-  The version of libxml2 packaged with Nokogiri contains several
-  vulnerabilities. Nokogiri has mitigated these issues by upgrading to
-  libxml 2.9.5.
-
-  It was discovered that a type confusion error existed in libxml2. An
-  attacker could use this to specially construct XML data that
-  could cause a denial of service or possibly execute arbitrary
-  code. (CVE-2017-0663)
-
-  It was discovered that libxml2 did not properly validate parsed entity
-  references. An attacker could use this to specially construct XML
-  data that could expose sensitive information. (CVE-2017-7375)
-
-  It was discovered that a buffer overflow existed in libxml2 when
-  handling HTTP redirects. An attacker could use this to specially
-  construct XML data that could cause a denial of service or possibly
-  execute arbitrary code. (CVE-2017-7376)
-
-  Marcel Böhme and Van-Thuan Pham discovered a buffer overflow in
-  libxml2 when handling elements. An attacker could use this to specially
-  construct XML data that could cause a denial of service or possibly
-  execute arbitrary code. (CVE-2017-9047)
-
-  Marcel Böhme and Van-Thuan Pham discovered a buffer overread
-  in libxml2 when handling elements. An attacker could use this
-  to specially construct XML data that could cause a denial of
-  service. (CVE-2017-9048)
-
-  Marcel Böhme and Van-Thuan Pham discovered multiple buffer overreads
-  in libxml2 when handling parameter-entity references. An attacker
-  could use these to specially construct XML data that could cause a
-  denial of service. (CVE-2017-9049, CVE-2017-9050)
-
-patched_versions:
-  - ">= 1.8.1"
-related:
-  cve:
-    - 2017-0663
-    - 2017-7375
-    - 2017-7376
-    - 2017-9047
-    - 2017-9048
-    - 2017-9049
-    - 2017-9050
-  url:
-    - https://usn.ubuntu.com/usn/usn-3424-1/
-    - https://people.canonical.com/~ubuntu-security/cve/2017/CVE-2017-0663.html
-    - https://people.canonical.com/~ubuntu-security/cve/2017/CVE-2017-7375.html
-    - https://people.canonical.com/~ubuntu-security/cve/2017/CVE-2017-7376.html
-    - https://people.canonical.com/~ubuntu-security/cve/2017/CVE-2017-9047.html
-    - https://people.canonical.com/~ubuntu-security/cve/2017/CVE-2017-9048.html
-    - https://people.canonical.com/~ubuntu-security/cve/2017/CVE-2017-9049.html
-    - https://people.canonical.com/~ubuntu-security/cve/2017/CVE-2017-9050.html

data/data/ruby-advisory-db/gems/nokogiri/CVE-2018-14404.yml

@@ -1,69 +0,0 @@
----
-gem: nokogiri
-cve: 2018-14404
-date: 2018-10-04
-url: https://github.com/sparklemotion/nokogiri/issues/1785
-title: Nokogiri gem, via libxml2, is affected by multiple vulnerabilities
-description: |
-  Nokogiri 1.8.5 has been released.
-
-  This is a security and bugfix release. It addresses two CVEs in upstream
-  libxml2 rated as "medium" by Red Hat, for which details are below.
-
-  If you're using your distro's system libraries, rather than Nokogiri's
-  vendored libraries, there's no security need to upgrade at this time,
-  though you may want to check with your distro whether they've patched this
-  (Canonical has patched Ubuntu packages). Note that these patches are not
-  yet (as of 2018-10-04) in an upstream release of libxml2.
-
-  Full details about the security update are available in Github Issue #1785.
-  [#1785]: https://github.com/sparklemotion/nokogiri/issues/1785
-
-  -----
-
-  [MRI] Pulled in upstream patches from libxml2 that address CVE-2018-14404
-  and CVE-2018-14567. Full details are available in #1785. Note that these
-  patches are not yet (as of 2018-10-04) in an upstream release of libxml2.
-
-  -----
-
-  CVE-2018-14404
-
-  Permalink:
-
-  https://people.canonical.com/~ubuntu-security/cve/2018/CVE-2018-14404.html
-
-  Description:
-
-  A NULL pointer dereference vulnerability exists in the
-  xpath.c:xmlXPathCompOpEval() function of libxml2 through 2.9.8 when
-  parsing an invalid XPath expression in the XPATH_OP_AND or XPATH_OP_OR
-  case. Applications processing untrusted XSL format inputs with the use of
-  the libxml2 library may be vulnerable to a denial of service attack due
-  to a crash of the application
-
-  Canonical rates this vulnerability as "Priority: Medium"
-
-  -----
-
-  CVE-2018-14567
-
-  Permalink:
-
-  https://people.canonical.com/~ubuntu-security/cve/2018/CVE-2018-14567.html
-
-  Description:
-
-  infinite loop in LZMA decompression
-
-  Canonical rates this vulnerability as "Priority: Medium"
-
-patched_versions:
-  - ">= 1.8.5"
-related:
-  cve:
-    - 2018-14567
-  url:
-    - https://groups.google.com/forum/#!msg/ruby-security-ann/uVrmO2HjqQw/Fw3ocLI0BQAJ
-    - https://gitlab.gnome.org/GNOME/libxml2/commit/a436374994c47b12d5de1b8b1d191a098fa23594
-    - https://gitlab.gnome.org/GNOME/libxml2/commit/2240fbf5912054af025fb6e01e26375100275e74