-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1
Debian Security Advisory DSA-2620-1 firstname.lastname@example.org http://www.debian.org/security/ Florian Weimer February 12, 2013 http://www.debian.org/security/faq
Package : rails Vulnerability : several Problem type : remote Debian-specific: no CVE ID : CVE-2013-0276 CVE-2013-0277
Two vulnerabilities were discovered in Ruby on Rails, a Ruby framework for web application development.
CVE-2013-0276 The blacklist provided by the attr_protected method could be bypassed with crafted requests, having an application-specific impact.
CVE-2013-0277 In some applications, the +serialize+ helper in ActiveRecord could be tricked into deserializing arbitrary YAML data, possibly leading to remote code execution.
For the stable distribution (squeeze), these problems have been fixed in version 2.3.5-1.2+squeeze7.
We recommend that you upgrade your rails packages.
Further information about Debian Security Advisories, how to apply these updates to your system and frequently asked questions can be found at: http://www.debian.org/security/
Mailing list: email@example.com -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.10 (GNU/Linux)
iQEcBAEBAgAGBQJRGrHZAAoJEL97/wQC1SS+MioH/3mCWr/isUqOa4xgITK7PheV hlWnwSBhKK9Yc6s25Nb6tK1qUgsiHTWOviEmKuMoEPWQicj9JNvl8C5sf8iiFGlM swAgdN43TZY7s7ohZuttW6bnvJRiWxLcP60qlVlN2IBGsdxY2kGz25L7l3wOEqsp wluacV5sUBBDAi9HJ2Fle3PvW3LbVv4HthpHyILXONgm97dCgB8ZjFRqWm50piIo 5QTZjrcGmCdjWwLKzd/s+xwoaMF1keU7lRsMlEBicESb4h8qd4fKOXxbDjO3MdSR sH71oJgihBzC2GYTNjwjSia1KeOhkaSwBAuZqvf4ihsovKiwiQ7Ajh1eJkJkCbA= =wTxl -----END PGP SIGNATURE-----