Converted /security/ to markdown.

Author: postmodern

security/index.html

@@ -0,0 +1,59 @@
+---
+layout: page
+title: Security
+---
+
+Here you will find information about security issues of Ruby.
+
+## <a name="label-0" id="label-0">Reporting Security Vulnerabilities</a>
+
+<!-- RDLabel: "Reporting Security Vulnerabilities" -->
+
+Security vulnerabilities should be reported via an email to
+[email protected] ([the PGP public key](/security.asc)), which is a
+private mailing list. Reported problems will be published after fixes.
+
+## <a name="label-1" id="label-1">Known issues</a>
+
+<!-- RDLabel: "Known issues" -->
+
+Here are recent issues.
+
+* [Exception methods can bypass $SAFE][1] published at 18 Feb, 2011.
+* [FileUtils is vulnerable to symlink race attacks][2] published at 18
+  Feb, 2011.
+* [XSS in WEBrick (CVE-2010-0541)][3] published at 16 Aug, 2010.
+* [Buffer over-run in ARGF.inplace\_mode=][4] published at 2 Jul, 2010.
+* [WEBrick has an Escape Sequence Injection vulnerability][5] published
+  at 10 Jan, 2010
+* [Heap overflow in String][6] published at 7 Dec, 2009
+* [DoS vulnerability in
+  REXML](/en/news/2008/08/23/dos-vulnerability-in-rexml/) published at
+  23 Aug, 2008
+* [Multiple vulnerabilities in
+  Ruby](/en/news/2008/08/08/multiple-vulnerabilities-in-ruby/) published
+  at 8 Aug, 2008
+* [Arbitrary code execution
+  vulnerabilities](/en/news/2008/06/20/arbitrary-code-execution-vulnerabilities/)
+  published at 20 Jun, 2008
+* [File access vulnerability of
+  WEBrick](/en/news/2008/03/03/webrick-file-access-vulnerability/)
+  published at 3 Mar, 2008
+* [Net::HTTPS
+  Vulnerability](/en/news/2007/10/04/net-https-vulnerability/) published
+  at 4 Oct, 2007
+* [Another DoS Vulnerability in CGI
+  Library](/en/news/2006/12/04/another-dos-vulnerability-in-cgi-library/)
+  published at 4 Dec, 2006
+* [DoS Vulnerability in CGI Library](/en/news/2006/11/03/CVE-2006-5467/)
+  published at 3 Nov, 2006
+* [Ruby vulnerability in the safe level
+  settings](/en/news/2005/10/03/ruby-vulnerability-in-the-safe-level-settings/)
+  published at 2 Oct, 2005
+
+[1]: http://www.ruby-lang.org/en/news/2011/02/18/exception-methods-can-bypass-safe/ 
+[2]: http://www.ruby-lang.org/en/news/2011/02/18/fileutils-is-vulnerable-to-symlink-race-attacks/ 
+[3]: http://www.ruby-lang.org/en/news/2010/08/16/xss-in-webrick-cve-2010-0541/ 
+[4]: http://www.ruby-lang.org/en/news/2010/07/02/ruby-1-9-1-p429-is-released/ 
+[5]: http://www.ruby-lang.org/en/news/2010/01/10/webrick-escape-sequence-injection// 
+[6]: http://www.ruby-lang.org/en/news/2009/12/07/heap-overflow-in-string/