CVE-2016-6316
Fixed in a distro release EPSS 3%
Cross-site scripting (XSS) vulnerability in Action View in Ruby on Rails 3.x before 3.2.22.3, 4.x before 4.2.7.1, and 5.x before 5.0.0.1 might allow remote attackers to inject arbitrary web script or HTML via text declared as "HTML safe" and used as attribute values in tag handlers.
Products: rubyonrails rails, rubyonrails ruby_on_rails, debian_linux
Fixed upstream
| Ecosystem | Package | Fixed in |
|---|---|---|
| RubyGems | actionview | 3.2.22.3 |
| RubyGems | actionview | 4.2.7.1 |
| RubyGems | actionview | 5.0.0.1 |
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Debian 12 | rails | 2:4.2.7.1-1 |
| Debian 13 | rails | 2:4.2.7.1-1 |
| Debian 14 | rails | 2:4.2.7.1-1 |
| Debian 7 | ruby-actionpack-3.2 | 3.2.6-6+deb7u3 |
| Debian 8 | rails | 2:4.1.8-1+deb8u4 |
| Red Hat rhel software collections 2 | rh-ror41-rubygem-actionview | 0:4.1.5-6.el6 |
| Red Hat rhel software collections 2 | rh-ror41-rubygem-actionview | 0:4.1.5-6.el7 |
| Red Hat rhel software collections 2 | rh-ror41-rubygem-actionview-doc | 0:4.1.5-6.el7 |
| Red Hat rhel software collections 2 | rh-ror41-rubygem-actionview-doc | 0:4.1.5-6.el6 |
| Red Hat rhel software collections 2 | rh-ror42-rubygem-actionpack | 1:4.2.6-3.el7 |
| Red Hat rhel software collections 2 | rh-ror42-rubygem-actionpack-doc | 1:4.2.6-3.el7 |
| Red Hat rhel software collections 2 | rh-ror42-rubygem-actionview | 0:4.2.6-3.el7 |
| Red Hat rhel software collections 2 | rh-ror42-rubygem-actionview-doc | 0:4.2.6-3.el7 |
| Red Hat rhel software collections 2 | rh-ror42-rubygem-activerecord | 1:4.2.6-3.el7 |
| Red Hat rhel software collections 2 | rh-ror42-rubygem-activerecord-doc | 1:4.2.6-3.el7 |
| Red Hat rhel software collections 2 | ror40-rubygem-actionpack | 1:4.0.2-8.el7 |
| Red Hat rhel software collections 2 | ror40-rubygem-actionpack | 1:4.0.2-8.el6 |
| Red Hat rhel software collections 2 | ror40-rubygem-actionpack-doc | 1:4.0.2-8.el6 |
| Red Hat rhel software collections 2 | ror40-rubygem-actionpack-doc | 1:4.0.2-8.el7 |
| Red Hat rhel software collections 2 | ruby193-rubygem-actionpack | 1:3.2.8-20.el6 |
| Red Hat rhel software collections 2 | ruby193-rubygem-actionpack | 1:3.2.8-20.el7 |
| Red Hat rhel software collections 2 | ruby193-rubygem-actionpack-doc | 1:3.2.8-20.el6 |
| Red Hat rhel software collections 2 | ruby193-rubygem-actionpack-doc | 1:3.2.8-20.el7 |
| SUSE Enterprise Storage 3 | rubygem-actionmailer-4_2 | 4.2.9-3.3.1 |
| SUSE Enterprise Storage 3 | rubygem-actionpack-4_2 | 4.2.9-7.3.1 |
| SUSE Enterprise Storage 3 | rubygem-actionview-4_2 | 4.2.9-9.3.1 |
| SUSE Enterprise Storage 3 | rubygem-activejob-4_2 | 4.2.9-3.3.1 |
| SUSE Enterprise Storage 3 | rubygem-activemodel-4_2 | 4.2.9-6.3.1 |
| SUSE Enterprise Storage 3 | rubygem-activerecord-4_2 | 4.2.9-6.3.1 |
| SUSE Enterprise Storage 3 | rubygem-activesupport-4_2 | 4.2.9-7.3.1 |
| SUSE Enterprise Storage 3 | rubygem-rails-4_2 | 4.2.9-3.3.1 |
| SUSE Enterprise Storage 3 | rubygem-rails-html-sanitizer | 1.0.3-8.3.1 |
| SUSE Enterprise Storage 3 | rubygem-railties-4_2 | 4.2.9-3.3.1 |
| SUSE Enterprise Storage 4 | rubygem-actionmailer-4_2 | 4.2.9-3.3.1 |
| SUSE Enterprise Storage 4 | rubygem-actionpack-4_2 | 4.2.9-7.3.1 |
| SUSE Enterprise Storage 4 | rubygem-actionview-4_2 | 4.2.9-9.3.1 |
| SUSE Enterprise Storage 4 | rubygem-activejob-4_2 | 4.2.9-3.3.1 |
| SUSE Enterprise Storage 4 | rubygem-activemodel-4_2 | 4.2.9-6.3.1 |
| SUSE Enterprise Storage 4 | rubygem-activerecord-4_2 | 4.2.9-6.3.1 |
| SUSE Enterprise Storage 4 | rubygem-activesupport-4_2 | 4.2.9-7.3.1 |
| SUSE Enterprise Storage 4 | rubygem-rails-4_2 | 4.2.9-3.3.1 |
| SUSE Enterprise Storage 4 | rubygem-rails-html-sanitizer | 1.0.3-8.3.1 |
| SUSE Enterprise Storage 4 | rubygem-railties-4_2 | 4.2.9-3.3.1 |
| SUSE OpenStack Cloud 6 | rubygem-actionmailer-4_2 | 4.2.9-3.3.1 |
| SUSE OpenStack Cloud 6 | rubygem-actionpack-4_2 | 4.2.9-7.3.1 |
| SUSE OpenStack Cloud 6 | rubygem-actionview-4_2 | 4.2.9-9.3.1 |
| SUSE OpenStack Cloud 6 | rubygem-activejob-4_2 | 4.2.9-3.3.1 |
| SUSE OpenStack Cloud 6 | rubygem-activemodel-4_2 | 4.2.9-6.3.1 |
| SUSE OpenStack Cloud 6 | rubygem-activerecord-4_2 | 4.2.9-6.3.1 |
| SUSE OpenStack Cloud 6 | rubygem-activesupport-4_2 | 4.2.9-7.3.1 |
| SUSE OpenStack Cloud 6 | rubygem-rails-4_2 | 4.2.9-3.3.1 |
| SUSE OpenStack Cloud 6 | rubygem-rails-html-sanitizer | 1.0.3-8.3.1 |
| SUSE OpenStack Cloud 6 | rubygem-railties-4_2 | 4.2.9-3.3.1 |
| SUSE OpenStack Cloud 7 | rubygem-actionmailer-4_2 | 4.2.9-3.3.1 |
| SUSE OpenStack Cloud 7 | rubygem-actionpack-4_2 | 4.2.9-7.3.1 |
| SUSE OpenStack Cloud 7 | rubygem-actionview-4_2 | 4.2.9-9.3.1 |
| SUSE OpenStack Cloud 7 | rubygem-activejob-4_2 | 4.2.9-3.3.1 |
| SUSE OpenStack Cloud 7 | rubygem-activemodel-4_2 | 4.2.9-6.3.1 |
| SUSE OpenStack Cloud 7 | rubygem-activerecord-4_2 | 4.2.9-6.3.1 |
| SUSE OpenStack Cloud 7 | rubygem-activesupport-4_2 | 4.2.9-7.3.1 |
| SUSE OpenStack Cloud 7 | rubygem-rails-4_2 | 4.2.9-3.3.1 |
| SUSE OpenStack Cloud 7 | rubygem-rails-html-sanitizer | 1.0.3-8.3.1 |
| SUSE OpenStack Cloud 7 | rubygem-railties-4_2 | 4.2.9-3.3.1 |