Test ID:	1.3.6.1.4.1.25623.1.0.121314
Category:	Gentoo Local Security Checks
Title:	Gentoo Security Advisory GLSA 201412-28
Summary:	Gentoo Linux Local Security Checks GLSA 201412-28
Description:	Summary: Gentoo Linux Local Security Checks GLSA 201412-28 Vulnerability Insight: Multiple vulnerabilities have been discovered in Ruby on Rails. Please review the CVE identifiers referenced below for details. Solution: Update the affected packages to the latest available version. CVSS Score: 10.0 CVSS Vector: AV:N/AC:L/Au:N/C:C/I:C/A:C
Cross-Ref:	Common Vulnerability Exposure (CVE) ID: CVE-2010-3933 http://securitytracker.com/id?1024624 http://secunia.com/advisories/41930 http://www.vupen.com/english/advisories/2010/2719 Common Vulnerability Exposure (CVE) ID: CVE-2011-0446 BugTraq ID: 46291 http://www.securityfocus.com/bid/46291 Debian Security Information: DSA-2247 (Google Search) http://www.debian.org/security/2011/dsa-2247 http://lists.fedoraproject.org/pipermail/package-announce/2011-March/055074.html http://lists.fedoraproject.org/pipermail/package-announce/2011-March/055088.html http://lists.fedoraproject.org/pipermail/package-announce/2011-April/057650.html http://groups.google.com/group/rubyonrails-security/msg/365b8a23b76a6b4a?dmode=source&output=gplain http://www.securitytracker.com/id?1025064 http://secunia.com/advisories/43274 http://secunia.com/advisories/43666 http://www.vupen.com/english/advisories/2011/0587 http://www.vupen.com/english/advisories/2011/0877 Common Vulnerability Exposure (CVE) ID: CVE-2011-0447 http://groups.google.com/group/rubyonrails-security/msg/c22ea1668c0d181c?dmode=source&output=gplain http://www.securitytracker.com/id?1025060 Common Vulnerability Exposure (CVE) ID: CVE-2011-0448 https://github.com/rails/rails/commit/354da43ab0a10b3b7b3f9cb0619aa562c3be8474 http://groups.google.com/group/rubyonrails-security/msg/4e19864cf6ad40ad?dmode=source&output=gplain http://securitytracker.com/id?1025063 http://secunia.com/advisories/43278 Common Vulnerability Exposure (CVE) ID: CVE-2011-0449 http://groups.google.com/group/rubyonrails-security/msg/04345b2e84df5b4f?dmode=source&output=gplain http://securitytracker.com/id?1025061 Common Vulnerability Exposure (CVE) ID: CVE-2011-2929 http://lists.fedoraproject.org/pipermail/package-announce/2011-September/065212.html http://lists.fedoraproject.org/pipermail/package-announce/2011-September/065109.html http://www.openwall.com/lists/oss-security/2011/08/17/1 http://www.openwall.com/lists/oss-security/2011/08/19/11 http://www.openwall.com/lists/oss-security/2011/08/20/1 http://www.openwall.com/lists/oss-security/2011/08/22/13 http://www.openwall.com/lists/oss-security/2011/08/22/14 http://www.openwall.com/lists/oss-security/2011/08/22/5 http://groups.google.com/group/rubyonrails-security/msg/cbbbba6e4f7eaf61?dmode=source&output=gplain Common Vulnerability Exposure (CVE) ID: CVE-2011-2930 Debian Security Information: DSA-2301 (Google Search) http://www.debian.org/security/2011/dsa-2301 http://groups.google.com/group/rubyonrails-security/msg/b1a85d36b0f9dd30?dmode=source&output=gplain Common Vulnerability Exposure (CVE) ID: CVE-2011-2931 http://lists.fedoraproject.org/pipermail/package-announce/2011-September/065137.html http://groups.google.com/group/rubyonrails-security/msg/fd41ab62966e0fd1?dmode=source&output=gplain http://secunia.com/advisories/45921 Common Vulnerability Exposure (CVE) ID: CVE-2011-2932 http://lists.fedoraproject.org/pipermail/package-announce/2011-September/065114.html http://lists.fedoraproject.org/pipermail/package-announce/2011-September/065189.html http://groups.google.com/group/rubyonrails-security/msg/f1d2749773db9f21?dmode=source&output=gplain http://secunia.com/advisories/45917 Common Vulnerability Exposure (CVE) ID: CVE-2011-3186 http://groups.google.com/group/rubyonrails-security/msg/bbe342e43abaa78c?dmode=source&output=gplain Common Vulnerability Exposure (CVE) ID: CVE-2013-0155 http://lists.apple.com/archives/security-announce/2013/Jun/msg00000.html Debian Security Information: DSA-2609 (Google Search) http://www.debian.org/security/2013/dsa-2609 http://ics-cert.us-cert.gov/advisories/ICSA-13-036-01A https://groups.google.com/group/rubyonrails-security/msg/bc6f13dafe130ee9?dmode=source&output=gplain RedHat Security Advisories: RHSA-2013:0154 http://rhn.redhat.com/errata/RHSA-2013-0154.html RedHat Security Advisories: RHSA-2013:0155 http://rhn.redhat.com/errata/RHSA-2013-0155.html SuSE Security Announcement: openSUSE-SU-2013:1904 (Google Search) http://lists.opensuse.org/opensuse-updates/2013-12/msg00079.html SuSE Security Announcement: openSUSE-SU-2013:1906 (Google Search) http://lists.opensuse.org/opensuse-updates/2013-12/msg00081.html SuSE Security Announcement: openSUSE-SU-2013:1907 (Google Search) http://lists.opensuse.org/opensuse-updates/2013-12/msg00082.html SuSE Security Announcement: openSUSE-SU-2014:0009 (Google Search) http://lists.opensuse.org/opensuse-updates/2014-01/msg00003.html Common Vulnerability Exposure (CVE) ID: CVE-2013-0156 APPLE-SA-2013-03-14-1 http://lists.apple.com/archives/security-announce/2013/Mar/msg00002.html DSA-2604 http://www.debian.org/security/2013/dsa-2604 RHSA-2013:0153 http://rhn.redhat.com/errata/RHSA-2013-0153.html RHSA-2013:0154 RHSA-2013:0155 VU#380039 http://www.kb.cert.org/vuls/id/380039 VU#628463 http://www.kb.cert.org/vuls/id/628463 [rubyonrails-security] 20130108 Multiple vulnerabilities in parameter parsing in Action Pack (CVE-2013-0156) https://groups.google.com/group/rubyonrails-security/msg/c1432d0f8c70e89d?dmode=source&output=gplain http://weblog.rubyonrails.org/2013/1/28/Rails-3-0-20-and-2-3-16-have-been-released/ http://www.fujitsu.com/global/support/software/security/products-f/sw-sv-rcve-ror201301e.html http://www.insinuator.net/2013/01/rails-yaml/ https://community.rapid7.com/community/metasploit/blog/2013/01/09/serialization-mischief-in-ruby-land-cve-2013-0156 https://puppet.com/security/cve/cve-2013-0156 Common Vulnerability Exposure (CVE) ID: CVE-2013-0276 52112 http://secunia.com/advisories/52112 52774 http://secunia.com/advisories/52774 57896 http://www.securityfocus.com/bid/57896 90072 http://www.osvdb.org/90072 APPLE-SA-2013-06-04-1 DSA-2620 http://www.debian.org/security/2013/dsa-2620 RHSA-2013:0686 http://rhn.redhat.com/errata/RHSA-2013-0686.html [oss-security] 20130211 Circumvention of attr_protected [CVE-2013-0276] http://www.openwall.com/lists/oss-security/2013/02/11/5 [rubyonrails-security] 20130211 Circumvention of attr_protected [CVE-2013-0276] https://groups.google.com/group/rubyonrails-security/msg/bb44b98a73ef1a06?dmode=source&output=gplain http://support.apple.com/kb/HT5784 http://weblog.rubyonrails.org/2013/2/11/SEC-ANN-Rails-3-2-12-3-1-11-and-2-3-17-have-been-released/ openSUSE-SU-2013:0462 http://lists.opensuse.org/opensuse-updates/2013-03/msg00048.html Common Vulnerability Exposure (CVE) ID: CVE-2013-0277 1028109 http://securitytracker.com/id?1028109 90073 http://www.osvdb.org/90073 [oss-security] 20130211 Serialized Attributes YAML Vulnerability with Rails 2.3 and 3.0 [CVE-2013-0277] http://www.openwall.com/lists/oss-security/2013/02/11/6 [rubyonrails-security] 20130211 Serialized Attributes YAML Vulnerability with Rails 2.3 and 3.0 [CVE-2013-0277] https://groups.google.com/group/rubyonrails-security/msg/302ec7ce90f13837?dmode=source&output=gplain https://puppet.com/security/cve/cve-2013-0277 Common Vulnerability Exposure (CVE) ID: CVE-2013-0333 DSA-2613 http://www.debian.org/security/2013/dsa-2613 RHSA-2013:0201 http://rhn.redhat.com/errata/RHSA-2013-0201.html RHSA-2013:0202 http://rhn.redhat.com/errata/RHSA-2013-0202.html RHSA-2013:0203 http://rhn.redhat.com/errata/RHSA-2013-0203.html [rubyonrails-security] 20130129 Vulnerability in JSON Parser in Ruby on Rails 3.0 and 2.3 https://groups.google.com/group/rubyonrails-security/msg/52179af76915e518?dmode=source&output=gplain https://puppet.com/security/cve/cve-2013-0333 Common Vulnerability Exposure (CVE) ID: CVE-2013-1854 APPLE-SA-2013-10-22-5 http://lists.apple.com/archives/security-announce/2013/Oct/msg00006.html RHSA-2013:0699 http://rhn.redhat.com/errata/RHSA-2013-0699.html RHSA-2014:1863 http://rhn.redhat.com/errata/RHSA-2014-1863.html [ruby-security-ann] 20130318 [CVE-2013-1854] Symbol DoS vulnerability in Active Record https://groups.google.com/group/ruby-security-ann/msg/34e0d780b04308de?dmode=source&output=gplain http://weblog.rubyonrails.org/2013/3/18/SEC-ANN-Rails-3-2-13-3-1-12-and-2-3-18-have-been-released/ openSUSE-SU-2013:0659 http://lists.opensuse.org/opensuse-updates/2013-04/msg00070.html openSUSE-SU-2013:0660 http://lists.opensuse.org/opensuse-updates/2013-04/msg00071.html openSUSE-SU-2013:0664 http://lists.opensuse.org/opensuse-updates/2013-04/msg00075.html openSUSE-SU-2013:0667 http://lists.opensuse.org/opensuse-updates/2013-04/msg00078.html openSUSE-SU-2013:0668 http://lists.opensuse.org/opensuse-updates/2013-04/msg00079.html Common Vulnerability Exposure (CVE) ID: CVE-2013-1855 RHSA-2013:0698 http://rhn.redhat.com/errata/RHSA-2013-0698.html [rubyonrails-security] 20130318 [CVE-2013-1855] XSS vulnerability in sanitize_css in Action Pack https://groups.google.com/group/rubyonrails-security/msg/8ed835a97cdd1afd?dmode=source&output=gplain openSUSE-SU-2013:0661 http://lists.opensuse.org/opensuse-updates/2013-04/msg00072.html openSUSE-SU-2013:0662 http://lists.opensuse.org/opensuse-updates/2013-04/msg00073.html openSUSE-SU-2014:0019 http://lists.opensuse.org/opensuse-updates/2014-01/msg00013.html Common Vulnerability Exposure (CVE) ID: CVE-2013-1856 [rubyonrails-security] 20130318 [CVE-2013-1856] XML Parsing Vulnerability affecting JRuby users https://groups.google.com/group/rubyonrails-security/msg/6c2482d4ed1545e6?dmode=source&output=gplain Common Vulnerability Exposure (CVE) ID: CVE-2013-1857 https://groups.google.com/group/rubyonrails-security/msg/78b9817a5943f6d6?dmode=source&output=gplain RedHat Security Advisories: RHSA-2013:0698 RedHat Security Advisories: RHSA-2014:1863 SuSE Security Announcement: openSUSE-SU-2013:0661 (Google Search) SuSE Security Announcement: openSUSE-SU-2013:0662 (Google Search) SuSE Security Announcement: openSUSE-SU-2014:0019 (Google Search)
Copyright	Copyright (C) 2015 Eero Volotinen

This is only one of 146377 vulnerability tests in our test suite. Find out more about running a complete security audit. To run a free test of this vulnerability against your system, register below.