Security update for rubygem-sprockets-2_11 SUSE Patch security@suse.de SUSE Security Team SUSE-SU-2015:0787-1 Final 1 1 2015-04-09T18:13:42Z current 2015-04-09T18:13:42Z 2015-04-09T18:13:42Z cve-database/bin/generate-cvrf.pl 2017-02-24T01:00:00Z Security update for rubygem-sprockets-2_11 This update for rubygem-sprockets-2_11 provides the following security fix: * Arbitrary file existence disclosure (bnc#903658, CVE-2014-7819) Security Issues: * CVE-2014-7819 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-7819> The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0). sleclo50sp3-ruby2.1-rubygem-sprockets-2_11 Copyright SUSE LLC under the Creative Commons License 4.0 with Attribution (CC-BY-4.0) https://www.suse.com/support/update/announcement/2015/suse-su-20150787-1/ Link for SUSE-SU-2015:0787-1 https://lists.suse.com/pipermail/sle-security-updates/2015-April/001362.html E-Mail link for SUSE-SU-2015:0787-1 https://www.suse.com/support/security/rating/ SUSE Security Ratings https://bugzilla.suse.com/903658 SUSE Bug 903658 https://bugzilla.suse.com/926549 SUSE Bug 926549 https://www.suse.com/security/cve/CVE-2014-7819/ SUSE CVE CVE-2014-7819 page SUSE OpenStack Cloud 5 ruby2.1-rubygem-sprockets-2_11-2.11.0-0.9.1 ruby2.1-rubygem-sprockets-2_11-2.11.0-0.9.1 as a component of SUSE OpenStack Cloud 5 Multiple directory traversal vulnerabilities in server.rb in Sprockets before 2.0.5, 2.1.x before 2.1.4, 2.2.x before 2.2.3, 2.3.x before 2.3.3, 2.4.x before 2.4.6, 2.5.x before 2.5.1, 2.6.x and 2.7.x before 2.7.1, 2.8.x before 2.8.3, 2.9.x before 2.9.4, 2.10.x before 2.10.2, 2.11.x before 2.11.3, 2.12.x before 2.12.3, and 3.x before 3.0.0.beta.3, as distributed with Ruby on Rails 3.x and 4.x, allow remote attackers to determine the existence of files outside the application root via a ../ (dot dot slash) sequence with (1) double slashes or (2) URL encoding. CVE-2014-7819 SUSE OpenStack Cloud 5:ruby2.1-rubygem-sprockets-2_11-2.11.0-0.9.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2015/suse-su-20150787-1/ https://www.suse.com/security/cve/CVE-2014-7819.html CVE-2014-7819 https://bugzilla.suse.com/903658 SUSE Bug 903658