#201_gem_prelude.diff
#202_gem_default_dir.diff
#203_adjust_base_of_search_path.diff
#900_ri_pager.diff
#902_define_YAML_in_yaml_stringio.rb.diff
#904_linux_target_os.diff
#919_common.mk_tweaks.diff
#931_libruby_suffix.diff
#940_hppa_disable_test_propag_signal.diff
#940_test_thread_mutex_sync_shorter.diff
#940_test_file_exhaustive_fails_as_root.diff
#940_test_priority_fails.diff
#090729_fix_Makefile_deps.diff
#090803_exclude_rdoc.diff
#091207_test_dl_free_func.diff
#100327_r24850_bootstraptest_test_thread.diff
#100503_r27337_rb_string_value_cstr.diff
#100503_r27356_queue_race.diff.diff
#100518_r26515_free_rb_classext.diff
#100518_load_libc_libm.diff
#100518_r23483_suppress_pathname_warning.diff
#100518_r27464_threading_non-nptl.diff
909_update_lib_README.diff
100731_disable-tests.diff
903_skip_base_ruby_check.diff
20100829-rubygems_disable_update_system.diff
20100829-rubygems_default_dir.diff
CVE-2013-1821.patch
CVE-2013-4073.patch
CVE-2013-4164.patch

# 1.9.2.0-2+deb6u3
CVE-2014-4975.patch
CVE-2014-8080.patch
CVE-2014-8090.patch

# 1.9.2.0-2+deb6u4 
CVE-2011-2705.patch
CVE-2015-1855.patch
CVE-2011-0188.patch
CVE-2013-2065.patch
CVE-2013-0256.patch
CVE-2012-4522.patch

# maybe todo

# as of https://redmine.ruby-lang.org/issues/5418
# there doesn't seem to be a fix upstream
# no patch available: CVE-2011-3624

# vulnerability is in OBJ_INFECT(a,b) but OBJ_TAINT(a) is used
# vulnerable code not present:  CVE-2012-4466
# (http://svn.ruby-lang.org/cgi-bin/viewvc.cgi?view=revision&revision=37068)

# CVE-2011-1004
# vulnerability is marked as Minor Issue <no-dsa> 
# patch would change behaviour of ruby, which might not be desired here
# 
# -  # WARNING: You must ensure that *ALL* parent directories are not
# -  # world writable.  Otherwise this method does not work.
# -  # Only exception is temporary directory like /tmp and /var/tmp,
# -  # whose permission is 1777.
# +  # WARNING: You must ensure that *ALL* parent directories cannot be
# +  # moved by other untrusted users.  For example, parent directories
# +  # should not be owned by untrusted users, and should not be world
# +  # writable except when the sticky bit set.
# (http://svn.ruby-lang.org/cgi-bin/viewvc.cgi?revision=30896&view=revision)

CVE-2013-0269.patch
CVE-2012-5371.patch
CVE-2014-6438-prep.patch
CVE-2014-6438-1.patch
CVE-2014-6438-2.patch
CVE-2009-5147.patch
