Overly broad permissions can turn one compromised account into a much larger security problem. Learn how to reduce unnecessary access, review privileges, and apply least privilege across modern Linux systems. Review Linux Privileges×
An update that solves one vulnerability can now be installed.. # ruby3.4-rubygem-actionview-8.0-8.0.1-1.1 on GA media Announcement ID: openSUSE-SU-2025:14673-1 Rating: moderate Cross-References: * CVE-2024-54133 Affected Products: * openSUSE Tumbleweed An update that solves one vulnerability can now be installed. ## Description: These are all security issues fixed in the ruby3.4-rubygem-actionview-8.0-8.0.1-1.1 package on the GA media of openSUSE Tumbleweed. ## Package List: * openSUSE Tumbleweed: * ruby3.4-rubygem-actionview-8.0 8.0.1-1.1 ## References: * https://www.suse.com/security/cve/CVE-2024-54133.html . The latest version of ruby3.4-rubygem-actionview-8.0-8.0.1-1.1 available on openSUSE Tumbleweed resolves several moderate security vulnerabilities.. openSUSE Tumbleweed, ruby3.4, rubygem, actionview, security update. . Severity: Medium. LinuxSecurity.com Team
Ruby on Rails security upgrade: - Versions-7-0-7-2-6-1-7-6-have-been-released - incorrect file permissions on encrypted files. Exploit not known.. -------------------------------------------------------------------------------- Fedora Update Notification FEDORA-2023-4f0bb4ff5e 2023-09-15 18:36:13.240099 -------------------------------------------------------------------------------- Name : rubygem-actionview Product : Fedora 39 Version : 7.0.7.2 Release : 1.fc39 URL : https://rubyonrails.org/ Summary : Rendering framework putting the V in MVC (part of Rails) Description : Simple, battle-tested conventions and helpers for building web pages. -------------------------------------------------------------------------------- Update Information: Ruby on Rails security upgrade: - Versions-7-0-7-2-6-1-7-6-have-been-released - incorrect file permissions on encrypted files. Exploit not known. -------------------------------------------------------------------------------- ChangeLog: * Mon Aug 28 2023 Pavel Valena - 7.0.7.2-1 - Update to actionview 7.0.7.2. -------------------------------------------------------------------------------- This update can be installed with the "dnf" update program. Use su -c 'dnf upgrade --advisory FEDORA-2023-4f0bb4ff5e' at the command line. For more information, refer to the dnf documentation available at https://dnf.readthedocs.io/en/latest/command_ref.html All packages are signed with the Fedora Project GPG key. More details on the GPG keys used by the Fedora Project can be found at https://fedoraproject.org/security/ -------------------------------------------------------------------------------- _______________________________________________ package-announce mailing list --
Upgrade to Ruby on Rails 6.0.3.3. Fixes CVEs: #1877568 #1831529 #1852381. --------------------------------------------------------------------------------Fedora Update Notification FEDORA-2020-4dd34860a3 2020-10-05 00:15:05.246453 --------------------------------------------------------------------------------Name : rubygem-actionview Product : Fedora 33 Version : 6.0.3.3 Release : 1.fc33 URL : https://rubyonrails.org/ Summary : Rendering framework putting the V in MVC (part of Rails) Description : Simple, battle-tested conventions and helpers for building web pages. --------------------------------------------------------------------------------Update Information: Upgrade to Ruby on Rails 6.0.3.3. Fixes CVEs: #1877568 #1831529 #1852381 --------------------------------------------------------------------------------ChangeLog: * Tue Sep 22 2020 Pavel Valena - 6.0.3.3-1 - Update to actionview 6.0.3.3. Resolves: rhbz#1877500 --------------------------------------------------------------------------------References: [ 1 ] Bug #1831529 - CVE-2020-5267 rubygem-actionview: views that use the `j` or `escape_javascript` methods are susceptible to XSS attacks [fedora-all] https://bugzilla.redhat.com/show_bug.cgi?id=1831529 [ 2 ] Bug #1852381 - CVE-2020-8185 rubygem-rails: untrusted users able to run pending migrations in production [fedora-all] https://bugzilla.redhat.com/show_bug.cgi?id=1852381 [ 3 ] Bug #1877568 - CVE-2020-15169 rubygem-actionview: rubygem-activeview: Cross-site scripting in translation helpers [fedora-all] https://bugzilla.redhat.com/show_bug.cgi?id=1877568 --------------------------------------------------------------------------------This update can be installed with the "dnf" update program. Use su -c 'dnf upgrade --advisory FEDORA-2020-4dd34860a3' at the command line. For more information, refer to the dnf documentation available at https://dnf.readthedocs.io/en/latest/command_ref.html Allpackages are signed with the Fedora Project GPG key. More details on the GPG keys used by the Fedora Project can be found at https://fedoraproject.org/security/ --------------------------------------------------------------------------------_______________________________________________ package-announce mailing list --
An update that fixes one vulnerability is now available.. openSUSE Security Update: Security update for rubygem-actionview-5_1 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2020:0627-1 Rating: moderate References: #1167240 Cross-References: CVE-2020-5267 Affected Products: openSUSE Leap 15.1 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for rubygem-actionview-5_1 fixes the following issues: - CVE-2020-5267: Fixed an XSS vulnerability in ActionView's JavaScript literal escape helpers (bsc#1167240). This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2020-627=1 Package List: - openSUSE Leap 15.1 (x86_64): ruby2.5-rubygem-actionview-5_1-5.1.4-lp151.3.3.1 ruby2.5-rubygem-actionview-doc-5_1-5.1.4-lp151.3.3.1 References: https://www.suse.com/security/cve/CVE-2020-5267.html https://bugzilla.suse.com/1167240 -- . A critical patch for rubygem-actionview-5_1 has been released to resolve an XSS vulnerability. Ensure prompt rectification of security weaknesses.. openSUSE ActionView Patch, XSS Update, ActionView Security Fix, openSUSE Vulnerability Management. . LinuxSecurity.com Team
An update that fixes one vulnerability is now available. . SUSE Security Update: Security update for rubygem-actionview-4_2 ______________________________________________________________________________ Announcement ID: SUSE-SU-2020:0954-1 Rating: moderate References: #1167240 Cross-References: CVE-2020-5267 Affected Products: SUSE OpenStack Cloud Crowbar 9 SUSE OpenStack Cloud Crowbar 8 SUSE OpenStack Cloud 7 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for rubygem-actionview-4_2 fixes the following issues: - CVE-2020-5267: Fixed an XSS vulnerability in ActionView (bsc#1167240). Patch Instructions: To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - SUSE OpenStack Cloud Crowbar 9: zypper in -t patch SUSE-OpenStack-Cloud-Crowbar-9-2020-954=1 - SUSE OpenStack Cloud Crowbar 8: zypper in -t patch SUSE-OpenStack-Cloud-Crowbar-8-2020-954=1 - SUSE OpenStack Cloud 7: zypper in -t patch SUSE-OpenStack-Cloud-7-2020-954=1 Package List: - SUSE OpenStack Cloud Crowbar 9 (x86_64): ruby2.1-rubygem-actionview-4_2-4.2.9-9.6.1 - SUSE OpenStack Cloud Crowbar 8 (x86_64): ruby2.1-rubygem-actionview-4_2-4.2.9-9.6.1 - SUSE OpenStack Cloud 7 (aarch64 s390x x86_64): ruby2.1-rubygem-actionview-4_2-4.2.9-9.6.1 References: https://www.suse.com/security/cve/CVE-2020-5267.html https://bugzilla.suse.com/1167240 _______________________________________________ sle-security-updates mailing list
Update Ruby on Rails to 5.2.3. Fixes CVE-2019-5418 CVE-2019-5419 CVE-2019-5420.. --------------------------------------------------------------------------------Fedora Update Notification FEDORA-2019-1cfe24db5c 2019-05-10 00:46:38.157347 --------------------------------------------------------------------------------Name : rubygem-actionview Product : Fedora 30 Version : 5.2.3 Release : 2.fc30 URL : https://rubyonrails.org/ Summary : Rendering framework putting the V in MVC (part of Rails) Description : Simple, battle-tested conventions and helpers for building web pages. --------------------------------------------------------------------------------Update Information: Update Ruby on Rails to 5.2.3. Fixes CVE-2019-5418 CVE-2019-5419 CVE-2019-5420. --------------------------------------------------------------------------------ChangeLog: * Thu Mar 28 2019 Pavel Valena - 5.2.3-2 - Enable tests. * Thu Mar 28 2019 Pavel Valena - 5.2.3-1 - Update to Action View 5.2.3. * Mon Mar 18 2019 Pavel Valena - 5.2.2.1-2 - Enable tests. * Thu Mar 14 2019 Pavel Valena - 5.2.2.1-1 - Update to Action View 5.2.2.1. --------------------------------------------------------------------------------References: [ 1 ] Bug #1689161 - CVE-2019-5418 CVE-2019-5419 rubygem-actionview: various flaws [fedora-all] https://bugzilla.redhat.com/show_bug.cgi?id=1689161 [ 2 ] Bug #1689155 - CVE-2019-5420 rubygem-rails: Weak secret token leading to possible code execution [fedora-all] https://bugzilla.redhat.com/show_bug.cgi?id=1689155 --------------------------------------------------------------------------------This update can be installed with the "dnf" update program. Use su -c 'dnf upgrade --advisory FEDORA-2019-1cfe24db5c' at the command line. For more information, refer to the dnf documentation available at https://dnf.readthedocs.io/en/latest/command_ref.html All packages are signed with the Fedora Project GPG key. More details on the GPGkeys used by the Fedora Project can be found at https://fedoraproject.org/security/ --------------------------------------------------------------------------------_______________________________________________ package-announce mailing list --
Updated rh-ror41-rubygem-actionview packages that fix two security issues are now available for Red Hat Software Collections. Red Hat Product Security has rated this update as having Important security impact. Common Vulnerability Scoring System (CVSS) base scores, which give. -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 ==================================================================== Red Hat Security Advisory Synopsis: Important: rh-ror41 security update Advisory ID: RHSA-2016:0456-01 Product: Red Hat Software Collections Advisory URL: https://access.redhat.com/errata/RHSA-2016:0456.html Issue date: 2016-03-15 CVE Names: CVE-2016-2097 CVE-2016-2098 ==================================================================== 1. Summary: Updated rh-ror41-rubygem-actionview packages that fix two security issues are now available for Red Hat Software Collections. Red Hat Product Security has rated this update as having Important security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section. 2. Relevant releases/architectures: Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 6) - noarch Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 7) - noarch Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 6.6) - noarch Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 6.7) - noarch Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.1) - noarch Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.2) - noarch Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 6) - noarch Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 7) - noarch 3. Description: The rh-ror41 collection provides Ruby on Rails version 4.1. Ruby on Rails is a model-view-controller (MVC)framework for web application development. The following issues were corrected in rubygem-actionview: A directory traversal flaw was found in the way the Action View component searched for templates for rendering. If an application passed untrusted input to the 'render' method, a remote, unauthenticated attacker could use this flaw to render unexpected files and, possibly, execute arbitrary code. (CVE-2016-2097) A code injection flaw was found in the way the Action View component searched for templates for rendering. If an application passed untrusted input to the 'render' method, a remote, unauthenticated attacker could use this flaw to execute arbitrary code. (CVE-2016-2098) Red Hat would like to thank the Ruby on Rails project for reporting these issues. Upstream acknowledges Jyoti Singh and Tobias Kraze (makandra) as original reporters of CVE-2016-2097, and Tobias Kraze (makandra) and joernchen (Phenoelit) as original reporters of CVE-2016-2098. All rh-ror41 collection rubygem-actionview packages users are advised to upgrade to these updated packages, which contain backported patches to correct these issues. All running applications using the rh-ror41 collection must be restarted for this update to take effect. 4. Solution: Before applying this update, make sure all previously released errata relevant to your system have been applied. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258 5. Bugs fixed (https://bugzilla.redhat.com/): 1310043 - CVE-2016-2097 rubygem-actionview, rubygem-actionpack: directory traversal in Action View, incomplete CVE-2016-0752 fix 1310054 - CVE-2016-2098 rubygem-actionview, rubygem-actionpack: code injection vulnerability in Action View 6. Package List: Red Hat Software Collections for Red Hat Enterprise Linux Server (v.6): Source: rh-ror41-rubygem-actionpack-4.1.5-4.el6.src.rpm rh-ror41-rubygem-actionview-4.1.5-5.el6.src.rpm noarch: rh-ror41-rubygem-actionpack-4.1.5-4.el6.noarch.rpm rh-ror41-rubygem-actionpack-doc-4.1.5-4.el6.noarch.rpm rh-ror41-rubygem-actionview-4.1.5-5.el6.noarch.rpm rh-ror41-rubygem-actionview-doc-4.1.5-5.el6.noarch.rpm Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 6.6): Source: rh-ror41-rubygem-actionpack-4.1.5-4.el6.src.rpm rh-ror41-rubygem-actionview-4.1.5-5.el6.src.rpm noarch: rh-ror41-rubygem-actionpack-4.1.5-4.el6.noarch.rpm rh-ror41-rubygem-actionpack-doc-4.1.5-4.el6.noarch.rpm rh-ror41-rubygem-actionview-4.1.5-5.el6.noarch.rpm rh-ror41-rubygem-actionview-doc-4.1.5-5.el6.noarch.rpm Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 6.7): Source: rh-ror41-rubygem-actionpack-4.1.5-4.el6.src.rpm rh-ror41-rubygem-actionview-4.1.5-5.el6.src.rpm noarch: rh-ror41-rubygem-actionpack-4.1.5-4.el6.noarch.rpm rh-ror41-rubygem-actionpack-doc-4.1.5-4.el6.noarch.rpm rh-ror41-rubygem-actionview-4.1.5-5.el6.noarch.rpm rh-ror41-rubygem-actionview-doc-4.1.5-5.el6.noarch.rpm Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 6): Source: rh-ror41-rubygem-actionpack-4.1.5-4.el6.src.rpm rh-ror41-rubygem-actionview-4.1.5-5.el6.src.rpm noarch: rh-ror41-rubygem-actionpack-4.1.5-4.el6.noarch.rpm rh-ror41-rubygem-actionpack-doc-4.1.5-4.el6.noarch.rpm rh-ror41-rubygem-actionview-4.1.5-5.el6.noarch.rpm rh-ror41-rubygem-actionview-doc-4.1.5-5.el6.noarch.rpm Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 7): Source: rh-ror41-rubygem-actionpack-4.1.5-4.el7.src.rpm rh-ror41-rubygem-actionview-4.1.5-5.el7.src.rpm noarch: rh-ror41-rubygem-actionpack-4.1.5-4.el7.noarch.rpm rh-ror41-rubygem-actionpack-doc-4.1.5-4.el7.noarch.rpm rh-ror41-rubygem-actionview-4.1.5-5.el7.noarch.rpm rh-ror41-rubygem-actionview-doc-4.1.5-5.el7.noarch.rpm Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v.7.1): Source: rh-ror41-rubygem-actionpack-4.1.5-4.el7.src.rpm rh-ror41-rubygem-actionview-4.1.5-5.el7.src.rpm noarch: rh-ror41-rubygem-actionpack-4.1.5-4.el7.noarch.rpm rh-ror41-rubygem-actionpack-doc-4.1.5-4.el7.noarch.rpm rh-ror41-rubygem-actionview-4.1.5-5.el7.noarch.rpm rh-ror41-rubygem-actionview-doc-4.1.5-5.el7.noarch.rpm Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.2): Source: rh-ror41-rubygem-actionpack-4.1.5-4.el7.src.rpm rh-ror41-rubygem-actionview-4.1.5-5.el7.src.rpm noarch: rh-ror41-rubygem-actionpack-4.1.5-4.el7.noarch.rpm rh-ror41-rubygem-actionpack-doc-4.1.5-4.el7.noarch.rpm rh-ror41-rubygem-actionview-4.1.5-5.el7.noarch.rpm rh-ror41-rubygem-actionview-doc-4.1.5-5.el7.noarch.rpm Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 7): Source: rh-ror41-rubygem-actionpack-4.1.5-4.el7.src.rpm rh-ror41-rubygem-actionview-4.1.5-5.el7.src.rpm noarch: rh-ror41-rubygem-actionpack-4.1.5-4.el7.noarch.rpm rh-ror41-rubygem-actionpack-doc-4.1.5-4.el7.noarch.rpm rh-ror41-rubygem-actionview-4.1.5-5.el7.noarch.rpm rh-ror41-rubygem-actionview-doc-4.1.5-5.el7.noarch.rpm These packages are GPG signed by Red Hat for security. Our key and details on how to verify the signature are available from https://access.redhat.com/security/team/key 7. References: https://access.redhat.com/security/cve/CVE-2016-2097 https://access.redhat.com/security/cve/CVE-2016-2098 https://access.redhat.com/security/updates/classification#important 8. Contact: The Red Hat security contact is . More contact details at https://access.redhat.com/security/team/contact Copyright 2016 Red Hat, Inc. -----BEGIN PGP SIGNATURE----- Version: GnuPG v1 iD8DBQFW6HnzXlSAg2UNWIIRAgxMAKCR7+/qPcNAVkC4vb58Ju9UWsErmwCeMhcI ytvB5H2ZlgjleYDrUnkCF+U=kOmc -----END PGP SIGNATURE----- -- Enterprise-watch-list mailing list
Get the latest Linux and open source security news straight to your inbox.