Skip to content
OpenAdvisories
High RHSA-2016:1855 2 CVEs

Red Hat Security Advisory: rh-ror42 security update

Published Sep 13, 2024 · Updated Jun 29, 2026

Ecosystem: Red Hat

Fixed packages 6

ReleasePackageFixed in
Red Hat · RHEL 2 rhel_software_collections:2::el7 rh-ror42-rubygem-actionpack 1:4.2.6-3.el7
Red Hat · RHEL 2 rhel_software_collections:2::el7 rh-ror42-rubygem-actionpack-doc 1:4.2.6-3.el7
Red Hat · RHEL 2 rhel_software_collections:2::el7 rh-ror42-rubygem-actionview 0:4.2.6-3.el7
Red Hat · RHEL 2 rhel_software_collections:2::el7 rh-ror42-rubygem-actionview-doc 0:4.2.6-3.el7
Red Hat · RHEL 2 rhel_software_collections:2::el7 rh-ror42-rubygem-activerecord 1:4.2.6-3.el7
Red Hat · RHEL 2 rhel_software_collections:2::el7 rh-ror42-rubygem-activerecord-doc 1:4.2.6-3.el7

Vulnerabilities 2

  • High 7.5
    CVE-2016-6317 Public exploit

    ActiveRecord in Ruby on Rails allows database-query bypass

    Action Record in Ruby on Rails 4.2.x before 4.2.7.1 does not properly consider differences in parameter handling between the Active Record component and the JSON implementation, which allows remote attackers to bypass intended database-query restrictions and …

    rails activerecord Debian RubyGems
  • Medium 6.1
    CVE-2016-6316

    actionview Cross-site Scripting vulnerability

    Cross-site scripting (XSS) vulnerability in Action View in Ruby on Rails 3.x before 3.2.22.3, 4.x before 4.2.7.1, and 5.x before 5.0.0.1 might allow remote attackers to inject arbitrary web script or HTML via text declared as "HTML safe" and used as attribute…

    rails actionview Debian RubyGems

References

  • article
    https://access.redhat.com/security/updates/classification/#moderate
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1365008
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1365017
  • advisory
    https://security.access.redhat.com/data/csaf/v2/advisories/2016/rhsa-2016_1855.json
  • report
    https://access.redhat.com/security/cve/CVE-2016-6316
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2016-6316
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2016-6316
  • article
    https://groups.google.com/forum/#!msg/rubyonrails-security/I-VWr034ouk/gGu2FrCwDAAJ
  • report
    https://access.redhat.com/security/cve/CVE-2016-6317
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2016-6317
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2016-6317
  • article
    https://groups.google.com/forum/#!msg/rubyonrails-security/rgO20zYW33s/gmamLa-wDAAJ