* SECURITY UPDATE: ReDoS in the vendored Bundler::URI RFC3986 parser - debian/patches/CVE-2023-28755.patch: clamp the greedy quantifiers in Bundler::URI::RFC3986_Parser's RFC3986_URI and RFC3986_relative_ref to possessive form, so an invalid URI no longer backtracks quadratically before raising InvalidURIError. NOTE: the 2.7.8 tarball's own two RFC3986 uri copies are already fixed; the vulnerable parser comes from the ruby-rubygems-bundler-v2.2.24.txz override tree that replaces lib/bundler at build time, so this patch is applied from debian/rules after that substitution and is deliberately NOT listed in debian/patches/series. The vendored version.rb is left at 0.10.0 so the build-time bundler_uri_version assertion still holds. The same patch additionally carries the CVE-2023-36617 follow-up hardening of the leading whitespace quantifiers of both parsers that back URI.parse / URI.split, from upstream ruby/uri 9d7bcef ("Fix quadratic backtracking on invalid port number") and 9010ee2 ("Fix quadratic backtracking on invalid relative URI"), which always ship together: the rfc3986 PORT pattern and the rfc2396 ABS_URI / REL_URI patterns each go from greedy to possessive. No ELSLANG ticket exists for CVE-2023-36617, so it is documented here and in the patch header rather than listed as a tracked id. Applied to all four in-tree copies (lib/uri/rfc3986_parser.rb, lib/uri/rfc2396_parser.rb and both lib/bundler/vendor/uri equivalents), so no copy is left half-patched; the vendored pair carries the override tree's content at that point. Both changes are timing-only -- the accepted and rejected inputs are unchanged -- and upstream's test_rfc2822_parse_relative_uri and test_rfc3986_port_check regression tests are added verbatim to test/uri/test_parser.rb. - CVE-2023-28755 * SECURITY UPDATE: buffer over-read in StringIO#ungetc / #ungetbyte - debian/patches/CVE-2024-27280.patch: compute the expansion in strio_unget_bytes() as cl - (rest < 0 ? pos : len) instead of (rest < 0 ? cl-pos : cl+rest), so pushing back more bytes than the current position no longer over-extends the string and expose uninitialized heap memory through StringIO#string and a later #gets. Adapted byte-identically from upstream ruby/stringio a35268a; upstream's test_ungetc_fill / test_ungetbyte_fill are added to test/stringio/test_stringio.rb and equivalent examples to spec/ruby/library/stringio/ungetc_spec.rb and ungetbyte_spec.rb. STRINGIO_VERSION is deliberately not bumped because the default gemspec filename is derived from it. - CVE-2024-27280 * SECURITY UPDATE: code execution in RDoc via unrestricted deserialisation - debian/patches/CVE-2024-27281.patch: load .rdoc_options with YAML.safe_load and permitted_classes: [RDoc::Options, Symbol], and route all four RDoc::Store Marshal.load call sites through a new private marshal_load helper whose filter proc rejects any object that is not a plain scalar/container, Class, Encoding or an RDoc::-namespaced object. Backported from upstream ruby/rdoc 32ff6ba0 ("Filter marshaled objects"), 60a6d74e ("Use safe_load and safe_load_file for .rdoc_options") and the mandatory follow-up a5de13bf ("Fix NoMethodError for start_with"), i.e. rdoc 6.3.4.1. safe_load_file does not exist in psych 3.1.0, so the .rdoc_options call uses the earlier upstream form YAML.safe_load File.read(...). RDoc::VERSION is deliberately not bumped because the spec pins it. - CVE-2024-27281 * SECURITY UPDATE: arbitrary heap read in the regexp engine - debian/patches/CVE-2024-27282.patch: bail out of Onigmo's forward_search_range() and backward_search_range() when reg->dmin exceeds end - str, so a crafted pattern can no longer advance the search pointer past the end of the subject and match against out-of-bounds heap memory. Also record mem_start_stk[mem] before STACK_PUSH_MEM_END() in OP_MEMORY_END_PUSH_REC, fixing a use-after-free of the backtrack-stack pointer. Taken verbatim from the ruby_3_0 backports of upstream 33e5b47c and 989a2355 (ruby 3.0.7); ruby-2.7.8's regexec.c is identical to 3.0.6's at all three sites. - CVE-2024-27282