Threats Tagged 'cve-2026-27820'

Multiple security vulnerabilities have been identified and addressed in the Ruby 4.0 module for Red Hat Enterprise Linux 9. These include memory corruption via buffer overflow in Zlib::GzipReader, several arbitrary IMAP command injection flaws, and denial of service issues related to Net::IMAP. The update rebases Ruby 4.0 to the latest release and includes bug fixes and enhancements. The advisory rates the security impact as Important and provides updated packages for affected Red Hat Enterprise Linux 9 variants.

This Red Hat Security Advisory addresses multiple vulnerabilities in Ruby 3.3, including memory corruption via buffer overflow in Zlib::GzipReader, arbitrary IMAP command injection through unvalidated input, and denial of service via malformed or large iteration count inputs in Net::IMAP. The update rebases Ruby 3.3 to the latest release and includes bug fixes and enhancements. The advisory affects Red Hat Enterprise Linux 9 and related variants. No CVSS scores are provided, but the vulnerabilities are rated as having a high security impact.

Multiple security vulnerabilities have been identified and fixed in Ruby as part of a Red Hat security advisory. These include memory corruption via buffer overflow in Zlib::GzipReader, arbitrary IMAP command injection through various input validation flaws, and denial of service conditions in Net::IMAP. The advisory also includes bug fixes and enhancements, rebasing Ruby to the latest 3.3 release. The update is rated as important by Red Hat Product Security and affects Red Hat Enterprise Linux 10 and related products.

Red Hat has issued a security advisory for ruby4.0 addressing multiple vulnerabilities including memory corruption via buffer overflow in Zlib::GzipReader, arbitrary IMAP command injection through various input validation flaws, and denial of service via malformed or large iteration count inputs in Net::IMAP. The update rebases ruby4.0 to the latest Ruby 4.0 release and includes bug fixes and enhancements. These vulnerabilities affect Red Hat Enterprise Linux 10 and related products. The advisory rates the security impact as Important and provides updated packages to remediate these issues.

Red Hat has issued a security advisory for the ruby:3.3 module in Red Hat Enterprise Linux 8, addressing multiple vulnerabilities including memory corruption via buffer overflow in Zlib::GzipReader, arbitrary IMAP command injection through various input validation flaws, and denial of service via malformed or large iteration count inputs in Net::IMAP. The update rebases Ruby 3.3 to the latest release, incorporating these security fixes along with bug fixes and enhancements.

zlib is a Ruby interface for the zlib compression/decompression library. Versions 3.0.0 and below, 3.1.0, 3.1.1, 3.2.0 and 3.2.1 contain a buffer overflow vulnerability in the Zlib::GzipReader. The zstream_buffer_ungets function prepends caller-provided bytes ahead of previously produced output but fails to guarantee the backing Ruby string has enough capacity before the memmove shifts the existing data. This can lead to memory corruption when the buffer length exceeds capacity. This issue has been fixed in versions 3.0.1, 3.1.2 and 3.2.3.