Debian: Security Advisory (DSA-3509-1)

The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2016 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Fedora 23 : rubygem-actionpack-4.2.3-4.fc23 (2016-f486068393)

Security fix for CVE-2015-7581 Security fix for CVE-2016-0751 Security fix for CVE-2015-7576 Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible...

Fedora 22 : rubygem-actionpack-4.2.0-3.fc22 / rubygem-activemodel-4.2.0-2.fc22 (2016-94e71ee673)

Security fix for CVE-2015-7581 CVE-2015-7576 CVE-2016-0751 CVE-2016-0752 CVE-2016-0753 Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible withou...

SUSE-SU-2016:0618-1 Security update for rubygem-actionpack-3_2

This update for rubygem-actionpack-32 fixes the following issues: - CVE-2016-0751: Object Leak DoS bsc963331 - CVE-2016-0752: Directory traversal and information leak in Action View bsc963332 - CVE-2015-7576: Timing attack vulnerability in basic authentication in Action Controller bsc963329...

Fedora Update for rubygem-actionpack FEDORA-2016-94

The remote host is missing an update for the SPDX-FileCopyrightText: 2016 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

[SECURITY] Fedora 23 Update: rubygem-actionpack-4.2.3-4.fc23

Eases web-request routing, handling, and response as a half-way front, half-way page controller. Implemented with specific emphasis on enabling ea sy unit/integration testing that doesn't require a browser...

openSUSE Security Update : rubygem-actionpack-3_2 / rubygem-activesupport-3_2 (openSUSE-2016-160)

This update for rubygem-actionpack-32, rubygem-activesupport-32 fixes the following issues : - CVE-2015-7576: Timing attack vulnerability in basic authentication in Action Controller boo963329 - CVE-2016-0752: directory traversal and information leak in Action View boo963332 - CVE-2016-0751:...

Remote Code Execution (RCE) And Information Disclosure

Actionpack is vulnerable to information disclosure and remote code execution. This vulnerability affects applications which pass user input directly into the render method in an action view controller without verification. Using this vulnerability, attackers can render files from outside the view...

Fedora Update for rubygem-actionpack FEDORA-2014-15371

The remote host is missing an update for the SPDX-FileCopyrightText: 2015 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Fedora 20 : rubygem-actionpack-4.0.0-5.fc20 (2014-15371)

Fixes for CVE-2014-7818 rhbz1163511 and CVE-2014-7829 rhbz1165077 Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing...

Fedora Update for rubygem-actionpack FEDORA-2014-15342

The remote host is missing an update for the SPDX-FileCopyrightText: 2015 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Fedora 21 : rubygem-actionpack-4.1.5-2.fc21 (2014-15342)

Fixes for CVE-2014-7818 rhbz1163511 and CVE-2014-7829 rhbz1165077 Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing...

[SECURITY] Fedora 21 Update: rubygem-actionpack-4.1.5-2.fc21

Eases web-request routing, handling, and response as a half-way front, half-way page controller. Implemented with specific emphasis on enabling ea sy unit/integration testing that doesn't require a browser...

openSUSE Security Update : rubygem-actionpack-3_2 (openSUSE-SU-2014:1515-1)

rubygem-actionpack-32 was updated to fix two security issues. These security issues were fixed : - Arbitrary file existence disclosure CVE-2014-7829. - Arbitrary file existence disclosure CVE-2014-7818. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks i...

rubygem-actionpack: number_to_currency XSS

It was found that the numbertocurrency Action View helper did not properly escape the unit parameter. An attacker could use this flaw to perform a cross-site scripting XSS attack on an application that uses data submitted by a user in the unit parameter...

rubygem-actionpack: directory traversal issue

A directory traversal flaw was found in the way Ruby on Rails handled wildcard segments in routes with implicit rendering. A remote attacker could use this flaw to retrieve arbitrary local files accessible to a Ruby on Rails application using the aforementioned routes via a specially crafted...

CVE-2014-7818

CVE-2014-7818 affects Ruby on Rails Action Pack, with a directory traversal in actionpack/lib/action_dispatch/middleware/static.rb when serve_static_assets is enabled. Affected: Rails 3.x before 3.2.20, 4.0.x before 4.0.11, 4.1.x before 4.1.7, and 4.2.x before 4.2.0.beta3. The underlying flaw all...

Updated ruby-actionpack packages fix security issues

Updated ruby-actionpack and ruby-activerecord packages fix security vulnerabilities: Directory traversal vulnerability in actionpack/lib/abstractcontroller/base.rb in the implicit-render implementation in Ruby on Rails before 4.0.5, when certain route globbing configurations are enabled, allows...

rubygem-actionpack: directory traversal issue

A directory traversal flaw was found in the way Ruby on Rails handled wildcard segments in routes with implicit rendering. A remote attacker could use this flaw to retrieve arbitrary local files accessible to a Ruby on Rails application using the aforementioned routes via a specially crafted...

openSUSE Security Update : rubygem-actionpack-3_2 (openSUSE-SU-2014:0720-1)

fix CVE-2014-0130: rubygem-actionpack: directory traversal issue bnc876714 CVE-2014-0130.patch: contains the fix %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from openSUSE Security Update openSUSE-2014-396. The text...