Overly broad permissions can turn one compromised account into a much larger security problem. Learn how to reduce unnecessary access, review privileges, and apply least privilege across modern Linux systems. Review Linux Privileges×

Alerts This Week
Warning Icon 1 521
Alerts This Week
Warning Icon 1 521

Debian: DSA-2929-2 Urgent: Ruby Action Pack Security Issues Lead to Outages

debian
Calendar Grey May 16, 2014
Scroller Debian
A series of critical vulnerabilities addressed in Debian patch DSA-2930-1; users are advised to update for enhanced protection.
Several vulnerabilities were discovered in Action Pack, a compononent of Ruby o Rails
Topics%20covered

Topics Covered

security advisory directory traversal Debian cross-site scripting DoS action pack

Summary

Several vulnerabilities were discovered in Action Pack, a compononent
of Ruby o Rails.

CVE-2014-0081

actionview/lib/action_view/helpers/number_helper.rb contains
multiple cross-site scripting vulnerabilities

CVE-2014-0082

actionpack/lib/action_view/template/text.rb performs symbol
interning on MIME type strings, allowing remote denial-of-service
attacks via increased memory consumption.

CVE-2014-0130

A directory traversal vulnerability in
actionpack/lib/abstract_controller/base.rb allows remote attackers to read arbitrary files.

For the stable distribution (wheezy), these problems have been fixed in
version 3.2.6-6+deb7u2.

We recommend that you upgrade your ruby-actionpack-3.2 packages.

Further information about Debian Security Advisories, how to apply
these updates to your system and frequently asked questions can be
found at: http://www.debian.org/security/



Severity
critical
Lowest
Low
Medium
High
Critical

Package: ruby-actionpack-3.2
CVE ID: CVE-2014-0081 CVE-2014-0082 CVE-2014-0130

Topics%20covered

Topics Covered

security advisory directory traversal Debian cross-site scripting DoS action pack

Get the latest News and Insights

Get the latest Linux and open source security news straight to your inbox.