Home page logo
/

fulldisclosure logo Full Disclosure mailing list archives

[SECURITY] [DSA 2466-1] rails security update
From: Thijs Kinkhorst <thijs () debian org>
Date: Wed, 9 May 2012 19:30:46 +0200 (CEST)

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

- -------------------------------------------------------------------------
Debian Security Advisory DSA-2466-1                   security () debian org
http://www.debian.org/security/                           Thijs Kinkhorst
May 09, 2012                           http://www.debian.org/security/faq
- -------------------------------------------------------------------------

Package        : rails
Vulnerability  : cross site scripting
Problem type   : remote
Debian-specific: no
CVE ID         : CVE-2012-1099
Debian Bug     : 668607

Sergey Nartimov discovered that in Rails, a Ruby based framework for
web development, when developers generate html options tags manually,
user input concatenated with manually built tags may not be escaped
and an attacker can inject arbitrary HTML into the document.

For the stable distribution (squeeze), this problem has been fixed in
version 2.3.5-1.2+squeeze3.

For the testing distribution (wheezy) and unstable distribution (sid),
this problem has been fixed in version 2.3.14.

We recommend that you upgrade your rails packages.

Further information about Debian Security Advisories, how to apply
these updates to your system and frequently asked questions can be
found at: http://www.debian.org/security/

Mailing list: debian-security-announce () lists debian org
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.12 (GNU/Linux)

iQEcBAEBAgAGBQJPqqmUAAoJEOxfUAG2iX576TAIANWp4utpgGLj6hVuNsrmuYOo
fIxOW0nJDhoDfAUglXZvjkTFP/4z241H9L9MeG0MuSQL0mIbZ3yp8tg8MONWtfUJ
l9TPPucCMukRBNZXAGcL3Q3VQcQDTRVZygDdEE6h7ZCQnXyYYFGaE9XyKpE4iMwQ
ZBxIs3rITS1nqUSGRJqQOXXTA/UsEAAmeTtrwXz0CJuxlml/poFAhiGwVE/WmzyR
06bxelDxSklEpPB9TBCsDNOwIBkNEb5rL+0WkM4C4VZ7A1oKdxougNZhs+QNWxXI
Nup7Wm0XpykwvR6b7n5iWjnO8ACL2eS9p/sivKqIRwcmMzwyFBzJMHKrGE7IFOQ=
=0qiE
-----END PGP SIGNATURE-----

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/


  By Date           By Thread  

Current thread:
  • [SECURITY] [DSA 2466-1] rails security update Thijs Kinkhorst (May 09)
[ Nmap | Sec Tools | Mailing Lists | Site News | About/Contact | Advertising | Privacy ]
AlienVault