ruby-actionpack-3.2 - security update

Fixed packages 1

Vulnerabilities 5

• Medium —
  CVE-2013-4389

  actionmailer email address processing causes Denial of service

  Multiple format string vulnerabilities in log_subscriber.rb files in the log subscriber component in Action Mailer in Ruby on Rails 3.x before 3.2.15 allow remote attackers to cause a denial of service via a crafted e-mail address that is improperly handled d…

  actionmailer RubyGems
  Oct 17, 2013
• Medium —
  CVE-2013-4491

  actionpack vulnerable to Cross-site Scripting

  Cross-site scripting (XSS) vulnerability in actionpack/lib/action_view/helpers/translation_helper.rb in the internationalization component in Ruby on Rails 3.x before 3.2.16 and 4.x before 4.0.2 allows remote attackers to inject arbitrary web script or HTML v…

  actionpack RubyGems
  Dec 7, 2013
• Medium —
  CVE-2013-6414 Public exploit EPSS 21%

  actionpack Improper Input Validation vulnerability

  actionpack/lib/action_view/lookup_context.rb in Action View in Ruby on Rails 3.x before 3.2.16 and 4.x before 4.0.2 allows remote attackers to cause a denial of service (memory consumption) via a header containing an invalid MIME type that leads to excessive …

  actionpack RubyGems
  Dec 7, 2013
• Medium —
  CVE-2013-6415

  actionpack vulnerable to Cross-site Scripting

  Cross-site scripting (XSS) vulnerability in the number_to_currency helper in actionpack/lib/action_view/helpers/number_helper.rb in Ruby on Rails before 3.2.16 and 4.x before 4.0.2 allows remote attackers to inject arbitrary web script or HTML via the unit pa…

  actionpack RubyGems
  Dec 7, 2013
• Medium —
  CVE-2013-6417

  actionpack allows bypass of database-query restrictions

  actionpack/lib/action_dispatch/http/request.rb in Ruby on Rails before 3.2.16 and 4.x before 4.0.2 does not properly consider differences in parameter handling between the Active Record component and the JSON implementation, which allows remote attackers to b…

  actionpack RubyGems
  Dec 7, 2013