Package Instance

Improper Restriction of Operations within the Bounds of a Memory Buffer
An issue was discovered in RubyGems. Since `Gem::CommandManager#run` calls alert_error without escaping, escape sequence injection is possible. (There are many ways to cause an error.)

Tainted flags not always propogated in Array#pack and String#unpack
In `Array#pack` and `String#unpack` with some formats, the tainted flags of
the original data are not propagated to the returned string/array.

`Array#pack` method converts the receiver’s contents into a string with
specified format. If the receiver contains some tainted objects, the
returned string also should be tainted. `String#unpack` method which
converts the receiver into an array also should propagate its tainted flag
to the objects contained in the returned array. But, with `B`, `b`, `H` and
`h` directives, the tainted flags are not propagated. So, if a script
processes unreliable inputs by `Array#pack` and/or `String#unpack` with these
directives and checks the reliability with tainted flags, the check might be
wrong.

All users running an affected release should upgrade immediately.

Argument Injection or Modification
An issue was discovered in RubyGems. Since `Gem::UserInteraction#verbose` calls say without escaping, escape sequence injection is possible.

Injection Vulnerability
An issue was discovered in RubyGems. `Gem::GemcutterUtilities#with_response` may output the API response to stdout as it is. Therefore, if the API side modifies the response, escape sequence injection may occur.

Improper Input Validation
A crafted gem with a multi-line name is not handled correctly. Therefore, an attacker could inject arbitrary code to the stub line of gemspec, which is evaluated by `ensure_loadable_spec` during the pre-installation check.

Injection Vulnerability
An issue was discovered in RubyGems. The gem owner command outputs the contents of the API response directly to stdout. Therefore, if the response is crafted, escape sequence injection may occur.