A mruby security update has been released for Arch Linux.

ASA-202107-10: mruby: arbitrary code execution

Arch Linux Security Advisory ASA-202107-10
=========================================
Severity: Medium
Date : 2021-07-01
CVE-ID : CVE-2020-36401
Package : mruby
Type : arbitrary code execution
Remote : Yes
Link :   https://security.archlinux.org/AVG-2116

Summary
======
The package mruby before version 3.0.0-1 is vulnerable to arbitrary
code execution.

Resolution
=========
Upgrade to 3.0.0-1.

# pacman -Syu "mruby>=3.0.0-1"

The problem has been fixed upstream in version 3.0.0.

Workaround
=========
None.

Description
==========
mruby 2.1.2 has a double free in mrb_default_allocf (called from
mrb_free and obj_free).

Impact
=====
An attacker could execute arbitrary code through a use after free.

References
=========
  https://github.com/google/oss-fuzz-vulns/blob/main/vulns/mruby/OSV-2020-744.yaml
  https://bugs.chromium.org/p/oss-fuzz/issues/detail?id#801
  https://github.com/mruby/mruby/commit/97319697c8f9f6ff27b32589947e1918e3015503
  https://security.archlinux.org/CVE-2020-36401