ruby-actionpack-4.0: multiple vulnerabilities [CVE-2013-6414 CVE-2013-4491 CVE-2013-6415 CVE-2013-6417 CVE-2013-6416]

Debian Bug report logs - #731290
ruby-actionpack-4.0: multiple vulnerabilities [CVE-2013-6414 CVE-2013-4491 CVE-2013-6415 CVE-2013-6417 CVE-2013-6416]

Toggle useless messages

Message #5 received at submit@bugs.debian.org (full text, mbox, reply):

From: Antonio Terceiro <terceiro@debian.org>

To: Debian Bug Tracking System <submit@bugs.debian.org>

Subject: ruby-actionpack-3.2: multiple vulnerabilities [CVE-2013-6414 CVE-2013-4491 CVE-2013-6415 CVE-2013-6417 CVE-2013-6416]

Date: Tue, 3 Dec 2013 22:06:20 -0300

[Message part 1 (text/plain, inline)]

Package: ruby-actionpack-3.2
Severity: grave
Tags: security upstream patch
Justification: user security hole
Control: clone -1 -2 -3
Control: reassign -2 ruby-actionpack-2.3
Control: retitle -2 ruby-actionpack-2.3: multiple vulnerabilities [CVE-2013-6414 CVE-2013-4491 CVE-2013-6415 CVE-2013-6417 CVE-2013-6416]
Control: reassign -3 ruby-actionpack-4.0
Control: retitle -3 ruby-actionpack-4.0: multiple vulnerabilities [CVE-2013-6414 CVE-2013-4491 CVE-2013-6415 CVE-2013-6417 CVE-2013-6416]

New vulnerabilities were just disclosed in the rubyonrails-security mailing
list. Not all of them apply to all packages and versions, but most of them do.

Fixes fox Rails 2.3 were not provided so they will be a little harder to come
up with.

[CVE-2013-6414] Denial of Service Vulnerability in Action View
https://groups.google.com/forum/#!topic/rubyonrails-security/A-ebV4WxzKg

[CVE-2013-4491] Reflective XSS Vulnerability in Ruby on Rails
https://groups.google.com/forum/#!topic/rubyonrails-security/pLrh6DUw998

[CVE-2013-6415] XSS Vulnerability in number_to_currency
https://groups.google.com/forum/#!topic/rubyonrails-security/9WiRn2nhfq0

[CVE-2013-6417] Incomplete fix to CVE-2013-0155 (Unsafe Query Generation
Risk)
https://groups.google.com/forum/#!topic/rubyonrails-security/niK4drpSHT4

[CVE-2013-6416] XSS Vulnerability in simple_format helper
https://groups.google.com/forum/#!topic/rubyonrails-security/5ZI1-H5OoIM


-- System Information:
Debian Release: jessie/sid
  APT prefers unstable
  APT policy: (500, 'unstable'), (1, 'experimental')
Architecture: amd64 (x86_64)
Foreign Architectures: i386

Kernel: Linux 3.11-1-amd64 (SMP w/4 CPU cores)
Locale: LANG=pt_BR.utf8, LC_CTYPE=pt_BR.utf8 (charmap=UTF-8)
Shell: /bin/sh linked to /bin/dash

Versions of packages ruby-actionpack-3.2 depends on:
ii  ruby                          1:1.9.3
ii  ruby-activemodel-3.2          3.2.13-5
ii  ruby-activerecord-3.2         3.2.13-4
ii  ruby-activesupport-3.2        3.2.13-3
ii  ruby-builder                  3.2.0-1
ii  ruby-erubis                   2.7.0-2
ii  ruby-journey                  1.0.4-1
ii  ruby-rack                     1:1.4.5-1
ii  ruby-rack-cache               1.2-2
ii  ruby-rack-test                0.6.2-1
ii  ruby-sprockets                2.4.3-1
ii  ruby-tzinfo                   1.0.1-1
ii  ruby1.8 [ruby-interpreter]    1.8.7.358-9
ii  ruby1.9.1 [ruby-interpreter]  1.9.3.484-1
ii  ruby2.0 [ruby-interpreter]    2.0.0.353-1

ruby-actionpack-3.2 recommends no packages.

ruby-actionpack-3.2 suggests no packages.

-- no debconf information

-- 
Antonio Terceiro <terceiro@debian.org>

[signature.asc (application/pgp-signature, inline)]

Message #16 received at 731290-done@bugs.debian.org (full text, mbox, reply):

From: Ondřej Surý <ondrej@sury.org>

To: 731290-done@bugs.debian.org

Subject: Re: Bug#731290: ruby-actionpack-4.0: multiple vulnerabilities [CVE-2013-6414 CVE-2013-4491 CVE-2013-6415 CVE-2013-6417 CVE-2013-6416]

Date: Thu, 05 Dec 2013 11:46:44 +0100

Version: 4.0.2-1

-- 
Ondřej Surý <ondrej@sury.org>
Knot DNS (https://www.knot-dns.cz/) – a high-performance DNS server

Send a report that this bug log contains spam.