CVE-2014-0081
Fixed in a distro release EPSS 4%
Multiple cross-site scripting (XSS) vulnerabilities in actionview/lib/action_view/helpers/number_helper.rb in Ruby on Rails before 3.2.17, 4.0.x before 4.0.3, and 4.1.x before 4.1.0.beta2 allow remote attackers to inject arbitrary web script or HTML via the (1) format, (2) negative_format, or (3) units parameter to the (a) number_to_currency, (b) number_to_percentage, or (c) number_to_human helper.
Products: rubyonrails rails, rubyonrails ruby_on_rails, opensuse, opensuse_project opensuse, redhat cloudforms, redhat enterprise_linux
Fixed upstream
| Ecosystem | Package | Fixed in |
|---|---|---|
| RubyGems | actionpack | 3.2.17 |
| RubyGems | actionpack | 4.0.3 |
| RubyGems | rails | 3.2.17 |
| RubyGems | rails | 4.0.3 |
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Debian 12 | rails | 2.3.14.1 |
| Debian 13 | rails | 2.3.14.1 |
| Debian 14 | rails | 2.3.14.1 |
| Debian 7 | ruby-actionpack-3.2 | 3.2.6-6+deb7u2 |
| Red Hat cloudforms managementengine 5 | cfme | 0:5.2.2.3-1.el6cf |
| Red Hat cloudforms managementengine 5 | cfme-appliance | 0:5.2.2.3-1.el6cf |
| Red Hat cloudforms managementengine 5 | cfme-debuginfo | 0:5.2.2.3-1.el6cf |
| Red Hat cloudforms managementengine 5 | cfme-lib | 0:5.2.2.3-1.el6cf |
| Red Hat cloudforms managementengine 5 | mingw32-cfme-host | 0:5.2.2.3-1.el6cf |
| Red Hat cloudforms managementengine 5 | ruby193-ruby | 0:1.9.3.448-40.1.el6 |
| Red Hat cloudforms managementengine 5 | ruby193-ruby-debuginfo | 0:1.9.3.448-40.1.el6 |
| Red Hat cloudforms managementengine 5 | ruby193-ruby-devel | 0:1.9.3.448-40.1.el6 |
| Red Hat cloudforms managementengine 5 | ruby193-ruby-irb | 0:1.9.3.448-40.1.el6 |
| Red Hat cloudforms managementengine 5 | ruby193-ruby-libs | 0:1.9.3.448-40.1.el6 |
| Red Hat cloudforms managementengine 5 | ruby193-ruby-tcltk | 0:1.9.3.448-40.1.el6 |
| Red Hat cloudforms managementengine 5 | ruby193-rubygem-actionpack | 1:3.2.13-5.el6cf |
| Red Hat cloudforms managementengine 5 | ruby193-rubygem-amq-protocol | 0:1.9.2-3.el6cf |
| Red Hat cloudforms managementengine 5 | ruby193-rubygem-amq-protocol-doc | 0:1.9.2-3.el6cf |
| Red Hat cloudforms managementengine 5 | ruby193-rubygem-bigdecimal | 0:1.1.0-40.1.el6 |
| Red Hat cloudforms managementengine 5 | ruby193-rubygem-bunny | 0:1.0.7-1.el6cf |
| Red Hat cloudforms managementengine 5 | ruby193-rubygem-bunny-doc | 0:1.0.7-1.el6cf |
| Red Hat cloudforms managementengine 5 | ruby193-rubygem-excon | 0:0.31.0-1.el6cf |
| Red Hat cloudforms managementengine 5 | ruby193-rubygem-fog | 0:1.19.0-1.el6cf |
| Red Hat cloudforms managementengine 5 | ruby193-rubygem-io-console | 0:0.3-40.1.el6 |
| Red Hat cloudforms managementengine 5 | ruby193-rubygem-linux_admin | 0:0.7.0-1.el6cf |
| Red Hat cloudforms managementengine 5 | ruby193-rubygem-more_core_extensions | 0:1.1.2-1.el6cf |
| Red Hat cloudforms managementengine 5 | ruby193-rubygem-nokogiri | 0:1.5.6-3.el6cf |
| Red Hat cloudforms managementengine 5 | ruby193-rubygem-nokogiri-debuginfo | 0:1.5.6-3.el6cf |
| Red Hat cloudforms managementengine 5 | ruby193-rubygems | 0:1.8.23-40.1.el6 |
| Red Hat cloudforms managementengine 5 | ruby193-rubygems-devel | 0:1.8.23-40.1.el6 |
| Red Hat rhel software collections 1 | ruby193-rubygem-actionpack | 1:3.2.8-5.3.el6 |
| Red Hat rhel software collections 1 | ruby193-rubygem-actionpack-doc | 1:3.2.8-5.3.el6 |