[SECURITY] [DLA 603-1] ruby-activesupport-3.2 security update

2016-08-2716:25:23

lists.debian.org

5 Medium

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:N/I:N/A:P

0.016 Low

EPSS

Percentile

87.1%

JSON

Package : ruby-activesupport-3.2
Version : 3.2.6-6+deb7u2
CVE ID : CVE-2015-3227

The support and utility classes used by the Rails 3.2 framework allow
remote attackers to cause a denial of service (SystemStackError) via a
large XML document depth.

For Debian 7 "Wheezy", these problems have been fixed in version
3.2.6-6+deb7u2.

Additionally this upload adds 'active_support/security_utils' that will
be used by ruby-actionpack-3.2 to address CVE-2015-7576.

We recommend that you upgrade your ruby-activesupport-3.2 packages.

Further information about Debian LTS security advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://wiki.debian.org/LTS

OSVersionArchitecturePackageVersionFilename
Debian8allruby-railties< 2:4.1.8-1+deb8u1ruby-railties_2:4.1.8-1+deb8u1_all.deb
Debian8allruby-activerecord< 2:4.1.8-1+deb8u1ruby-activerecord_2:4.1.8-1+deb8u1_all.deb
Debian8allruby-actionmailer< 2:4.1.8-1+deb8u1ruby-actionmailer_2:4.1.8-1+deb8u1_all.deb
Debian8allruby-activesupport-2.3< 2:4.1.8-1+deb8u1ruby-activesupport-2.3_2:4.1.8-1+deb8u1_all.deb
Debian8allruby-activesupport< 2:4.1.8-1+deb8u1ruby-activesupport_2:4.1.8-1+deb8u1_all.deb
Debian8allruby-activemodel< 2:4.1.8-1+deb8u1ruby-activemodel_2:4.1.8-1+deb8u1_all.deb
Debian8allruby-actionview< 2:4.1.8-1+deb8u1ruby-actionview_2:4.1.8-1+deb8u1_all.deb
Debian7allruby-activesupport-3.2< 3.2.6-6+deb7u2ruby-activesupport-3.2_3.2.6-6+deb7u2_all.deb
Debian8allrails< 2:4.1.8-1+deb8u1rails_2:4.1.8-1+deb8u1_all.deb
Debian8allruby-actionpack< 2:4.1.8-1+deb8u1ruby-actionpack_2:4.1.8-1+deb8u1_all.deb

OS	Version	Architecture	Package	Version	Filename
Debian	8	all	ruby-railties	< 2:4.1.8-1+deb8u1	ruby-railties_2:4.1.8-1+deb8u1_all.deb
Debian	8	all	ruby-activerecord	< 2:4.1.8-1+deb8u1	ruby-activerecord_2:4.1.8-1+deb8u1_all.deb
Debian	8	all	ruby-actionmailer	< 2:4.1.8-1+deb8u1	ruby-actionmailer_2:4.1.8-1+deb8u1_all.deb
Debian	8	all	ruby-activesupport-2.3	< 2:4.1.8-1+deb8u1	ruby-activesupport-2.3_2:4.1.8-1+deb8u1_all.deb
Debian	8	all	ruby-activesupport	< 2:4.1.8-1+deb8u1	ruby-activesupport_2:4.1.8-1+deb8u1_all.deb
Debian	8	all	ruby-activemodel	< 2:4.1.8-1+deb8u1	ruby-activemodel_2:4.1.8-1+deb8u1_all.deb
Debian	8	all	ruby-actionview	< 2:4.1.8-1+deb8u1	ruby-actionview_2:4.1.8-1+deb8u1_all.deb
Debian	7	all	ruby-activesupport-3.2	< 3.2.6-6+deb7u2	ruby-activesupport-3.2_3.2.6-6+deb7u2_all.deb
Debian	8	all	rails	< 2:4.1.8-1+deb8u1	rails_2:4.1.8-1+deb8u1_all.deb
Debian	8	all	ruby-actionpack	< 2:4.1.8-1+deb8u1	ruby-actionpack_2:4.1.8-1+deb8u1_all.deb