Skip to content
OpenAdvisories
High 1 exploited CVE RHSA-2016:0296 6 CVEs

Red Hat Security Advisory: rh-ror41 security update

Published Sep 13, 2024 · Updated Jun 29, 2026

Ecosystem: Red Hat

Fixed packages 18

ReleasePackageFixed in
Red Hat · RHEL 2 rhel_software_collections:2::el6 rh-ror41-rubygem-actionpack 1:4.1.5-3.el6
Red Hat · RHEL 2 rhel_software_collections:2::el6 rh-ror41-rubygem-actionpack-doc 1:4.1.5-3.el6
Red Hat · RHEL 2 rhel_software_collections:2::el6 rh-ror41-rubygem-actionview 0:4.1.5-4.el6
Red Hat · RHEL 2 rhel_software_collections:2::el6 rh-ror41-rubygem-actionview-doc 0:4.1.5-4.el6
Red Hat · RHEL 2 rhel_software_collections:2::el6 rh-ror41-rubygem-activemodel 0:4.1.5-2.el6
Red Hat · RHEL 2 rhel_software_collections:2::el6 rh-ror41-rubygem-activemodel-doc 0:4.1.5-2.el6
Red Hat · RHEL 2 rhel_software_collections:2::el6 rh-ror41-rubygem-activerecord 1:4.1.5-2.el6
Red Hat · RHEL 2 rhel_software_collections:2::el6 rh-ror41-rubygem-activerecord-doc 1:4.1.5-2.el6
Red Hat · RHEL 2 rhel_software_collections:2::el6 rh-ror41-rubygem-activesupport 1:4.1.5-3.el6
Red Hat · RHEL 2 rhel_software_collections:2::el7 rh-ror41-rubygem-actionpack 1:4.1.5-3.el7
Red Hat · RHEL 2 rhel_software_collections:2::el7 rh-ror41-rubygem-actionpack-doc 1:4.1.5-3.el7
Red Hat · RHEL 2 rhel_software_collections:2::el7 rh-ror41-rubygem-actionview 0:4.1.5-4.el7
Red Hat · RHEL 2 rhel_software_collections:2::el7 rh-ror41-rubygem-actionview-doc 0:4.1.5-4.el7
Red Hat · RHEL 2 rhel_software_collections:2::el7 rh-ror41-rubygem-activemodel 0:4.1.5-2.el7
Red Hat · RHEL 2 rhel_software_collections:2::el7 rh-ror41-rubygem-activemodel-doc 0:4.1.5-2.el7
Red Hat · RHEL 2 rhel_software_collections:2::el7 rh-ror41-rubygem-activerecord 1:4.1.5-2.el7
Red Hat · RHEL 2 rhel_software_collections:2::el7 rh-ror41-rubygem-activerecord-doc 1:4.1.5-2.el7
Red Hat · RHEL 2 rhel_software_collections:2::el7 rh-ror41-rubygem-activesupport 1:4.1.5-3.el7

Vulnerabilities 6

  • High 7.5
    CVE-2016-0752 Exploited Public exploit EPSS 96%

    Directory traversal vulnerability in Action View in Ruby on Rails

    Directory traversal vulnerability in Action View in Ruby on Rails before 3.2.22.1, 4.0.x and 4.1.x before 4.1.14.1, 4.2.x before 4.2.5.1, and 5.x before 5.0.0.beta1.1 allows remote attackers to read arbitrary files by leveraging an application's unrestricted …

    rails actionpack actionview Debian RubyGems
    KEV Mar 25, 2022
  • High 7.5
    CVE-2015-7581

    actionpack is vulnerable to denial of service because of a wildcard controller route

    actionpack/lib/action_dispatch/routing/route_set.rb in Action Pack in Ruby on Rails 4.x before 4.2.5.1 and 5.x before 5.0.0.beta1.1 allows remote attackers to cause a denial of service (superfluous caching and memory consumption) by leveraging an application'…

    rails actionpack Debian RubyGems
  • High 7.5
    CVE-2016-0751

    actionpack is vulnerable to denial of service via a crafted HTTP Accept header

    actionpack/lib/action_dispatch/http/mime_type.rb in Action Pack in Ruby on Rails before 3.2.22.1, 4.0.x and 4.1.x before 4.1.14.1, 4.2.x before 4.2.5.1, and 5.x before 5.0.0.beta1.1 does not properly restrict use of the MIME type cache, which allows remote at…

    rails actionpack Debian RubyGems
  • Medium 5.3
    CVE-2015-7577

    Active Record Improper Access Control

    activerecord/lib/active_record/nested_attributes.rb in Active Record in Ruby on Rails 3.1.x and 3.2.x before 3.2.22.1, 4.0.x and 4.1.x before 4.1.14.1, 4.2.x before 4.2.5.1, and 5.x before 5.0.0.beta1.1 does not properly implement a certain destroy option, wh…

    rails activerecord Debian RubyGems
  • Medium 5.3
    CVE-2016-0753

    activemodel contains Improper Input Validation

    Active Model in Ruby on Rails 4.1.x before 4.1.14.1, 4.2.x before 4.2.5.1, and 5.x before 5.0.0.beta1.1 supports the use of instance-level writers for class accessors, which allows remote attackers to bypass intended validation steps via crafted parameters.

    rails activemodel Debian RubyGems
  • Low 3.7
    CVE-2015-7576

    actionpack is vulnerable to remote bypass authentication

    The http_basic_authenticate_with method in actionpack/lib/action_controller/metal/http_authentication.rb in the Basic Authentication implementation in Action Controller in Ruby on Rails before 3.2.22.1, 4.0.x and 4.1.x before 4.1.14.1, 4.2.x before 4.2.5.1, a…

    rails actionpack Debian RubyGems

References

  • article
    https://access.redhat.com/security/updates/classification/#important
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1301933
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1301946
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1301957
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1301963
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1301973
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1301981
  • advisory
    https://security.access.redhat.com/data/csaf/v2/advisories/2016/rhsa-2016_0296.json
  • report
    https://access.redhat.com/security/cve/CVE-2015-7576
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2015-7576
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2015-7576
  • article
    http://weblog.rubyonrails.org/2016/1/25/Rails-5-0-0-beta1-1-4-2-5-1-4-1-14-1-3-2-22-1-and-rails-html-sanitizer-1-0-3-have-been-released/
  • article
    https://groups.google.com/forum/#!msg/rubyonrails-security/ANv0HDHEC3k/mt7wNGxbFQAJ
  • report
    https://access.redhat.com/security/cve/CVE-2015-7577
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2015-7577
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2015-7577
  • article
    https://groups.google.com/forum/#!msg/rubyonrails-security/cawsWcQ6c8g/tegZtYdbFQAJ
  • report
    https://access.redhat.com/security/cve/CVE-2015-7581
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2015-7581
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2015-7581
  • article
    https://groups.google.com/forum/#!msg/rubyonrails-security/dthJ5wL69JE/YzPnFelbFQAJ
  • report
    https://access.redhat.com/security/cve/CVE-2016-0751
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2016-0751
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2016-0751
  • article
    https://groups.google.com/forum/#!msg/rubyonrails-security/9oLY_FCzvoc/w9oI9XxbFQAJ
  • report
    https://access.redhat.com/security/cve/CVE-2016-0752
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2016-0752
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2016-0752
  • article
    https://groups.google.com/forum/#!msg/rubyonrails-security/335P1DcLG00/OfB9_LhbFQAJ
  • article
    https://nvisium.com/blog/2016/01/26/rails-dynamic-render-to-rce-cve-2016-0752/
  • article
    https://www.cisa.gov/known-exploited-vulnerabilities-catalog
  • report
    https://access.redhat.com/security/cve/CVE-2016-0753
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2016-0753
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2016-0753
  • article
    https://groups.google.com/forum/#!msg/rubyonrails-security/6jQVC1geukQ/8oYETcxbFQAJ