Security update for rubygem-actionpack-3_2 SUSE Patch security@suse.de SUSE Security Team SUSE-SU-2016:0967-1 Final 1 1 2016-04-07T07:10:35Z current 2016-04-07T07:10:35Z 2016-04-07T07:10:35Z cve-database/bin/generate-cvrf.pl 2017-02-24T01:00:00Z Security update for rubygem-actionpack-3_2 This update for rubygem-actionpack-3_2 fixes the following issues: - CVE-2016-2097: rubygem-actionview: Possible Information Leak Vulnerability in Action View. (bsc#968850) - CVE-2016-2098: rubygem-actionpack: Possible remote code execution vulnerability in Action Pack (bsc#968849) The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0). sdksp4-rubygem-actionpack-3_2-12497,sleslms13-rubygem-actionpack-3_2-12497,slestso13-rubygem-actionpack-3_2-12497,slewyst13-rubygem-actionpack-3_2-12497 Copyright SUSE LLC under the Creative Commons License 4.0 with Attribution (CC-BY-4.0) https://www.suse.com/support/update/announcement/2016/suse-su-20160967-1/ Link for SUSE-SU-2016:0967-1 https://lists.opensuse.org/opensuse-security-announce/2016-04/msg00006.html E-Mail link for SUSE-SU-2016:0967-1 https://www.suse.com/support/security/rating/ SUSE Security Ratings https://bugzilla.suse.com/968849 SUSE Bug 968849 https://bugzilla.suse.com/968850 SUSE Bug 968850 https://www.suse.com/security/cve/CVE-2016-2097/ SUSE CVE CVE-2016-2097 page https://www.suse.com/security/cve/CVE-2016-2098/ SUSE CVE CVE-2016-2098 page SUSE Lifecycle Management Server 1.3 SUSE Linux Enterprise Software Development Kit 11 SP4 SUSE Studio Onsite 1.3 SUSE WebYast 1.3 rubygem-actionpack-3_2-3.2.12-0.26.1 rubygem-actionpack-3_2-3.2.12-0.26.1 as a component of SUSE Lifecycle Management Server 1.3 rubygem-actionpack-3_2-3.2.12-0.26.1 as a component of SUSE Linux Enterprise Software Development Kit 11 SP4 rubygem-actionpack-3_2-3.2.12-0.26.1 as a component of SUSE Studio Onsite 1.3 rubygem-actionpack-3_2-3.2.12-0.26.1 as a component of SUSE WebYast 1.3 Directory traversal vulnerability in Action View in Ruby on Rails before 3.2.22.2 and 4.x before 4.1.14.2 allows remote attackers to read arbitrary files by leveraging an application's unrestricted use of the render method and providing a .. (dot dot) in a pathname. NOTE: this vulnerability exists because of an incomplete fix for CVE-2016-0752. CVE-2016-2097 SUSE Lifecycle Management Server 1.3:rubygem-actionpack-3_2-3.2.12-0.26.1 SUSE Linux Enterprise Software Development Kit 11 SP4:rubygem-actionpack-3_2-3.2.12-0.26.1 SUSE Studio Onsite 1.3:rubygem-actionpack-3_2-3.2.12-0.26.1 SUSE WebYast 1.3:rubygem-actionpack-3_2-3.2.12-0.26.1 moderate 6.8 AV:N/AC:M/Au:N/C:P/I:P/A:P To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2016/suse-su-20160967-1/ https://www.suse.com/security/cve/CVE-2016-2097.html CVE-2016-2097 https://bugzilla.suse.com/963332 SUSE Bug 963332 https://bugzilla.suse.com/968850 SUSE Bug 968850 Action Pack in Ruby on Rails before 3.2.22.2, 4.x before 4.1.14.2, and 4.2.x before 4.2.5.2 allows remote attackers to execute arbitrary Ruby code by leveraging an application's unrestricted use of the render method. CVE-2016-2098 SUSE Lifecycle Management Server 1.3:rubygem-actionpack-3_2-3.2.12-0.26.1 SUSE Linux Enterprise Software Development Kit 11 SP4:rubygem-actionpack-3_2-3.2.12-0.26.1 SUSE Studio Onsite 1.3:rubygem-actionpack-3_2-3.2.12-0.26.1 SUSE WebYast 1.3:rubygem-actionpack-3_2-3.2.12-0.26.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2016/suse-su-20160967-1/ https://www.suse.com/security/cve/CVE-2016-2098.html CVE-2016-2098 https://bugzilla.suse.com/968849 SUSE Bug 968849 https://bugzilla.suse.com/969943 SUSE Bug 969943 https://bugzilla.suse.com/993313 SUSE Bug 993313