Lucene search
Debian Security Bug TrackerDEBIANCVE:CVE-2013-0175HistoryApr 25, 2013 - 11:55 p.m.
CVE-2013-0175
2013-04-2523:55:00
Debian Security Bug Tracker
security-tracker.debian.org
20
7.5 High
CVSS2
Access Vector
NETWORK
Access Complexity
LOW
Authentication
NONE
Confidentiality Impact
PARTIAL
Integrity Impact
PARTIAL
Availability Impact
PARTIAL
AV:N/AC:L/Au:N/C:P/I:P/A:P
0.057 Low
EPSS
Percentile
93.2%
multi_xml gem 0.5.2 for Ruby, as used in Grape before 0.2.6 and possibly other products, does not properly restrict casts of string values, which allows remote attackers to conduct object-injection attacks and execute arbitrary code, or cause a denial of service (memory and CPU consumption) involving nested XML entity references, by leveraging support for (1) YAML type conversion or (2) Symbol type conversion, a similar vulnerability to CVE-2013-0156.
| OS | Version | Architecture | Package | Version | Filename |
|---|---|---|---|---|---|
| Debian | 12 | all | ruby-multi-xml | < 0.6.0-1 | ruby-multi-xml_0.6.0-1_all.deb |
| Debian | 11 | all | ruby-multi-xml | < 0.6.0-1 | ruby-multi-xml_0.6.0-1_all.deb |
| Debian | 10 | all | ruby-multi-xml | < 0.6.0-1 | ruby-multi-xml_0.6.0-1_all.deb |
| Debian | 999 | all | ruby-multi-xml | < 0.6.0-1 | ruby-multi-xml_0.6.0-1_all.deb |
| Debian | 13 | all | ruby-multi-xml | < 0.6.0-1 | ruby-multi-xml_0.6.0-1_all.deb |
Related
cve
cve
prion
prion
github
github
Improper Input Validation in multi_xml
2017-10-24 18:33:37
actionpack Improper Input Validation vulnerability
2017-10-24 18:33:37
nori contains Improper Input Validation
2017-10-24 18:33:37
osv
osv
Improper Input Validation in multi_xml
2017-10-24 18:33:37
actionpack Improper Input Validation vulnerability
2017-10-24 18:33:37
rails - insufficient input validation
2013-01-09 00:00:00
packetstorm
packetstorm
Ruby On Rails XML Processor YAML Deserialization Code Execution
2013-01-11 00:00:00
Ruby on Rails JSON Processor YAML Deserialization Code Execution
2013-01-29 00:00:00
nessus
nessus
RHEL 6 : Ruby on Rails (RHSA-2013:0153)
2018-12-06 00:00:00
Debian DLA-172-1 : libextlib-ruby security update
2015-03-26 00:00:00
Debian DSA-2604-1 : rails - insufficient input validation
2013-01-10 00:00:00
metasploit
metasploit
Ruby on Rails XML Processor YAML Deserialization Scanner
2013-01-09 18:50:38
Ruby on Rails JSON Processor YAML Deserialization Scanner
2013-02-11 22:48:44
Ruby on Rails XML Processor YAML Deserialization Code Execution
2013-01-10 05:10:13
redhat
redhat
(RHSA-2013:0153) Critical: Ruby on Rails security update
2013-01-10 00:00:00
(RHSA-2013:0154) Critical: Ruby on Rails security update
2013-01-10 20:37:00
openvas
openvas
Debian: Security Advisory (DSA-2604-1)
2013-01-08 00:00:00
Ruby on Rails XML Processor YAML Deserialization RCE Vulnerability
2013-01-18 00:00:00
Fedora Update for rubygem-multi_xml FEDORA-2013-0839
2013-01-28 00:00:00
fedora
fedora
[SECURITY] Fedora 18 Update: rubygem-multi_xml-0.4.1-5.fc18
2013-01-24 22:37:23
[SECURITY] Fedora 17 Update: rubygem-multi_xml-0.4.1-4.fc17
2013-01-25 21:43:09
[SECURITY] Fedora 18 Update: rubygem-activesupport-3.2.8-2.fc18
2013-01-20 03:40:48
saint
saint
Ruby on Rails XML Processor YAML Deserialization
2013-02-15 00:00:00
Ruby on Rails XML Processor YAML Deserialization
2013-02-15 00:00:00
Ruby on Rails XML Processor YAML Deserialization
2013-02-15 00:00:00
veracode
veracode
debian
debian
[SECURITY] [DLA 172-1] libextlib-ruby security update
2015-03-14 19:01:22
[SECURITY] [DSA 2604-1] rails security update
2013-01-09 19:17:20
cert
cert
Ruby on Rails Action Pack framework insecurely typecasts YAML and Symbol XML parameters
2013-01-08 00:00:00
Ruby on Rails 3.0 and 2.3 JSON Parser vulnerability
2013-01-28 00:00:00
checkpoint_advisories
checkpoint_advisories
zdt
zdt
Action Pack Multiple Vulnerabilities
2013-01-09 00:00:00
Ruby On Rails XML Processor YAML Deserialization Code Execution
2013-01-11 00:00:00
kitploit
kitploit
threatpost
threatpost
Exploit Code, Metasploit Module Out for Ruby on Rails Flaws
2013-01-10 15:01:40
Ruby on Rails Exploit Harvests IRC Botnet
2013-05-28 18:56:05
Some Versions of Ruby on Rails Vulnerable to New Parsing Attack
2013-01-29 17:47:51
thn
thn
Ruby on Rails exploit could hijack unpatched servers for botnet
2013-05-31 03:53:00
Ruby on Rails exploit could hijack unpatched servers for botnet
2013-05-30 16:53:00
seebug
seebug
Ruby on Rails XML Processor YAML Deserialization Code Execution
2014-07-01 00:00:00
Ruby on Rails JSON Processor YAML Deserialization Code Execution
2013-02-03 00:00:00
ubuntucve
ubuntucve
debiancve
debiancve
gitlab
gitlab
Multiple vulnerabilities in parameter parsing in Action Pack
2013-01-13 00:00:00
rubygems
rubygems
Ruby Gem nori Parameter Parsing Remote Code Execution
2013-01-09 20:00:00
CVE-2013-0156 rubygem-activesupport: Multiple vulnerabilities in parameter parsing in ActionPack
2013-01-07 20:00:00
CVE-2013-0333 rubygem-activesupport: json to yaml parsing
2013-01-27 20:00:00
exploitdb
exploitdb
ics
ics
freebsd
freebsd
rubygem-rails -- multiple vulnerabilities
2013-01-08 00:00:00
puppet27 and puppet -- multiple vulnerabilities
2013-03-13 00:00:00
nmap
nmap
http-vuln-cve2013-0156 NSE Script
2013-04-25 03:15:33
suse
suse
ruby on rails to 2.3.16 (important)
2013-02-12 10:10:39
ruby on rails to 2.3.16 (important)
2013-02-12 11:04:29
Security update for Ruby on Rails (important)
2013-04-03 20:06:19
ibm
ibm
securityvulns
securityvulns
Apple Mac OS X multiple security vulnerabilities
2013-03-24 00:00:00
gentoo
gentoo
Ruby on Rails: Multiple vulnerabilities
2014-12-14 00:00:00
7.5 High
CVSS2
Access Vector
NETWORK
Access Complexity
LOW
Authentication
NONE
Confidentiality Impact
PARTIAL
Integrity Impact
PARTIAL
Availability Impact
PARTIAL
AV:N/AC:L/Au:N/C:P/I:P/A:P
0.057 Low
EPSS
Percentile
93.2%
Related for DEBIANCVE:CVE-2013-0175