Skip to content

Commit d115057

Browse files
jasnowRubySec CI
jasnow
authored and
RubySec CI
committed
Updated advisory posts against rubysec/ruby-advisory-db@0340343 
1 parent 9b60695 commit d115057

File tree

2 files changed

+143
-0
lines changed

2 files changed

+143
-0
lines changed

‎advisories/_posts/2025-07-20-CVE-2025-54314.md

Lines changed: 29 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,29 @@
1+
---
2+
layout: advisory
3+
title: 'CVE-2025-54314 (thor): Thor can construct an unsafe shell command from library
4+
input.'
5+
comments: false
6+
categories:
7+
- thor
8+
advisory:
9+
gem: thor
10+
cve: 2025-54314
11+
ghsa: mqcp-p2hv-vw6x
12+
url: https://github.com/advisories/GHSA-mqcp-p2hv-vw6x
13+
title: Thor can construct an unsafe shell command from library input.
14+
date: 2025-07-20
15+
description: |
16+
Thor before 1.4.0 can construct an unsafe shell command
17+
from library input.
18+
cvss_v3: 2.8
19+
patched_versions:
20+
- ">= 1.4.0"
21+
related:
22+
url:
23+
- https://nvd.nist.gov/vuln/detail/CVE-2025-54314
24+
- https://github.com/rails/thor/releases/tag/v1.4.0
25+
- https://github.com/rails/thor/pull/897
26+
- https://github.com/rails/thor/commit/536b79036a0efb765c1899233412e7b1ca94abfa
27+
- https://hackerone.com/reports/3260153
28+
- https://github.com/advisories/GHSA-mqcp-p2hv-vw6x
29+
---

‎advisories/_posts/2025-07-21-GHSA-353f-x4gh-cqq8.md

Lines changed: 114 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,114 @@
1+
---
2+
layout: advisory
3+
title: 'GHSA-353f-x4gh-cqq8 (nokogiri): Nokogiri patches vendored libxml2 to resolve
4+
multiple CVEs'
5+
comments: false
6+
categories:
7+
- nokogiri
8+
advisory:
9+
gem: nokogiri
10+
ghsa: 353f-x4gh-cqq8
11+
url: https://github.com/sparklemotion/nokogiri/security/advisories/GHSA-353f-x4gh-cqq8
12+
title: Nokogiri patches vendored libxml2 to resolve multiple CVEs
13+
date: 2025-07-21
14+
description: |
15+
## Summary
16+
17+
Nokogiri v1.18.9 patches the vendored libxml2 to address
18+
CVE-2025-6021, CVE-2025-6170, CVE-2025-49794, CVE-2025-49795,
19+
and CVE-2025-49796.
20+
21+
## Impact and severity
22+
23+
### CVE-2025-6021
24+
25+
A flaw was found in libxml2's xmlBuildQName function, where integer
26+
overflows in buffer size calculations can lead to a stack-based
27+
buffer overflow. This issue can result in memory corruption or a
28+
denial of service when processing crafted input.
29+
30+
NVD claims a severity of 7.5 High
31+
(CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
32+
33+
Fixed by applying https://gitlab.gnome.org/GNOME/libxml2/-/commit/17d950ae
34+
35+
### CVE-2025-6170
36+
37+
A flaw was found in the interactive shell of the xmllint command-line
38+
tool, used for parsing XML files. When a user inputs an overly long
39+
command, the program does not check the input size properly, which
40+
can cause it to crash. This issue might allow attackers to run
41+
harmful code in rare configurations without modern protections.
42+
43+
NVD claims a severity of 2.5 Low
44+
(CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:L)
45+
46+
Fixed by applying https://gitlab.gnome.org/GNOME/libxml2/-/commit/5e9ec5c1
47+
48+
### CVE-2025-49794
49+
50+
A use-after-free vulnerability was found in libxml2. This issue
51+
occurs when parsing XPath elements under certain circumstances when
52+
the XML schematron has the <sch:name path="..."/> schema elements.
53+
This flaw allows a malicious actor to craft a malicious XML document
54+
used as input for libxml, resulting in the program's crash using
55+
libxml or other possible undefined behaviors.
56+
57+
NVD claims a severity of 9.1 Critical
58+
(CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H)
59+
60+
Fixed by applying https://gitlab.gnome.org/GNOME/libxml2/-/commit/81cef8c5
61+
62+
### CVE-2025-49795
63+
64+
A NULL pointer dereference vulnerability was found in libxml2 when
65+
processing XPath XML expressions. This flaw allows an attacker to
66+
craft a malicious XML input to libxml2, leading to a denial of service.
67+
68+
NVD claims a severity of 7.5 High
69+
(CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
70+
71+
Fixed by applying https://gitlab.gnome.org/GNOME/libxml2/-/commit/62048278
72+
73+
### CVE-2025-49796
74+
75+
A vulnerability was found in libxml2. Processing certain sch:name
76+
elements from the input XML file can trigger a memory corruption
77+
issue. This flaw allows an attacker to craft a malicious XML input
78+
file that can lead libxml to crash, resulting in a denial of service
79+
or other possible undefined behavior due to sensitive data being
80+
corrupted in memory.
81+
82+
NVD claims a severity of 9.1 Critical
83+
(CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H)
84+
85+
Fixed by applying https://gitlab.gnome.org/GNOME/libxml2/-/commit/81cef8c5
86+
87+
## Affected Versions
88+
89+
- Nokogiri < 1.18.9 when using CRuby (MRI) with vendored libxml2
90+
91+
## Patched Versions
92+
93+
- Nokogiri >= 1.18.9
94+
95+
## Mitigation
96+
97+
Upgrade to Nokogiri v1.18.9 or later.
98+
99+
Users who are unable to upgrade Nokogiri may also choose a more
100+
complicated mitigation: compile and link Nokogiri against patched
101+
external libxml2 libraries which will also address these same issues.
102+
patched_versions:
103+
- ">= 1.18.9"
104+
related:
105+
url:
106+
- https://github.com/sparklemotion/nokogiri/security/advisories/GHSA-353f-x4gh-cqq8
107+
- https://nvd.nist.gov/vuln/detail/CVE-2025-49794
108+
- https://nvd.nist.gov/vuln/detail/CVE-2025-49795
109+
- https://nvd.nist.gov/vuln/detail/CVE-2025-49796
110+
- https://nvd.nist.gov/vuln/detail/CVE-2025-6021
111+
- https://nvd.nist.gov/vuln/detail/CVE-2025-6170
112+
- https://github.com/sparklemotion/nokogiri/pull/3526
113+
- https://github.com/advisories/GHSA-353f-x4gh-cqq8
114+
---

0 commit comments

Comments
 (0)