Merge pull request #259 from totoche/master

reedloden · reedloden · commit 25f7dd14537a · 2016-06-07T12:49:19.000-07:00
Add CVE-2015-8806 for nokogiri
diff --git a/gems/nokogiri/CVE-2015-8806.yml b/gems/nokogiri/CVE-2015-8806.yml
@@ -0,0 +1,42 @@
+---
+gem: nokogiri
+cve: 2015-8806
+url: https://github.com/sparklemotion/nokogiri/issues/1473
+title: Denial of service or RCE from libxml2 and libxslt
+date: 2016-06-07
+description: |
+  Nokogiri is affected by series of vulnerabilities in libxml2 and libxslt,
+  which are libraries Nokogiri depends on. It was discovered that libxml2 and
+  libxslt incorrectly handled certain malformed documents, which can allow
+  malicious users to cause issues ranging from denial of service to remote code
+  execution attacks.
+
+  For more information, the Ubuntu Security Notice is a good start: 
+  http://www.ubuntu.com/usn/usn-2994-1/
+
+patched_versions:
+  - ">= 1.6.8"
+unaffected_versions:
+  - "< 1.6.0"
+related:
+  cve:
+    - 2016-1762
+    - 2016-1833
+    - 2016-1834
+    - 2016-1835
+    - 2016-1836
+    - 2016-1837
+    - 2016-1838
+    - 2016-1839
+    - 2016-1840
+    - 2016-2073
+    - 2016-3627
+    - 2016-3705
+    - 2016-4447
+    - 2016-4449
+    - 2016-4483
+  url:
+    - https://github.com/sparklemotion/nokogiri/issues/1473
+    - https://github.com/sparklemotion/nokogiri/commit/03d402212707bd5dfa0a21b7de5e91a7f9d90028
+    - https://mail.gnome.org/archives/xml/2016-May/msg00023.html
+    - http://www.ubuntu.com/usn/usn-2994-1/
