HCE2-SA-2024-0144 Moderate HCE 2.0 Security Fix(es): An issue was discovered in RDoc 6.3.3 through 6.6.2, as distributed in Ruby 3.x through 3.3.0. When parsing .rdoc_options (used for configuration in RDoc) as a YAML file, object injection and resultant remote code execution are possible because there are no restrictions on the classes that can be restored. (When loading the documentation cache, object injection and resultant remote code execution are also possible if there were a crafted cache.) The main fixed version is 6.6.3.1. For Ruby 3.0 users, a fixed version is rdoc 6.3.4.1. For Ruby 3.1 users, a fixed version is rdoc 6.4.1.1. For Ruby 3.2 users, a fixed version is rdoc 6.5.1.1. (CVE-2024-27281) A buffer-overread issue was discovered in StringIO 3.0.1, as distributed in Ruby 3.0.x through 3.0.6 and 3.1.x through 3.1.4. The ungetbyte and ungetc methods on a StringIO can read past the end of a string, and a subsequent call to StringIO.gets may return the memory value. 3.0.3 is the main fixed version; however, for Ruby 3.0 users, a fixed version is stringio 3.0.1.1, and for Ruby 3.1 users, a fixed version is stringio 3.0.1.2. (CVE-2024-27280) HCE 2.0 rubygems-3.2.32-122.r10.hce2.noarch.rpm rubygems-devel-3.2.32-122.r10.hce2.noarch.rpm rubygem-bigdecimal-3.0.0-122.r10.hce2.aarch64.rpm rubygem-did_you_mean-1.5.0-122.r10.hce2.noarch.rpm rubygem-io-console-0.5.7-122.r10.hce2.aarch64.rpm rubygem-json-2.5.1-122.r10.hce2.aarch64.rpm rubygem-minitest-5.14.2-122.r10.hce2.noarch.rpm rubygem-openssl-2.2.1-122.r10.hce2.aarch64.rpm rubygem-power_assert-1.2.0-122.r10.hce2.noarch.rpm rubygem-psych-3.3.2-122.r10.hce2.aarch64.rpm rubygem-rake-13.0.3-122.r10.hce2.noarch.rpm rubygem-rbs-1.4.0-122.r10.hce2.noarch.rpm rubygem-rdoc-6.3.3-122.r10.hce2.noarch.rpm rubygem-rexml-3.2.5-122.r10.hce2.noarch.rpm rubygem-rss-0.2.9-122.r10.hce2.noarch.rpm rubygem-test-unit-3.3.7-122.r10.hce2.noarch.rpm rubygem-typeprof-0.15.2-122.r10.hce2.noarch.rpm ruby-3.0.3-122.r10.hce2.aarch64.rpm ruby-devel-3.0.3-122.r10.hce2.aarch64.rpm ruby-help-3.0.3-122.r10.hce2.noarch.rpm ruby-irb-3.0.3-122.r10.hce2.noarch.rpm rubygem-bigdecimal-3.0.0-122.r10.hce2.x86_64.rpm rubygem-io-console-0.5.7-122.r10.hce2.x86_64.rpm rubygem-json-2.5.1-122.r10.hce2.x86_64.rpm rubygem-openssl-2.2.1-122.r10.hce2.x86_64.rpm rubygem-psych-3.3.2-122.r10.hce2.x86_64.rpm ruby-3.0.3-122.r10.hce2.x86_64.rpm ruby-devel-3.0.3-122.r10.hce2.x86_64.rpm