UBUNTU-CVE-2013-0156

See a problem?
Please try reporting it to the source first.
Source
https://ubuntu.com/security/CVE-2013-0156
Import Source
https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2013/UBUNTU-CVE-2013-0156.json
JSON Data
https://api.osv.dev/v1/vulns/UBUNTU-CVE-2013-0156
Related
Published
2013-01-13T22:55:00Z
Modified
2013-01-13T22:55:00Z
Summary
[none]
Details

activesupport/coreext/hash/conversions.rb in Ruby on Rails before 2.3.15, 3.0.x before 3.0.19, 3.1.x before 3.1.10, and 3.2.x before 3.2.11 does not properly restrict casts of string values, which allows remote attackers to conduct object-injection attacks and execute arbitrary code, or cause a denial of service (memory and CPU consumption) involving nested XML entity references, by leveraging Action Pack support for (1) YAML type conversion or (2) Symbol type conversion.

References

Affected packages

Ubuntu:14.04:LTS / ruby-extlib

Package

Name
ruby-extlib
Purl
pkg:deb/ubuntu/ruby-extlib?arch=src?distro=trusty

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
0.9.15-3

Ecosystem specific 

{
    "availability": "No subscription required",
    "ubuntu_priority": "high",
    "binaries": [
        {
            "binary_version": "0.9.15-3",
            "binary_name": "libextlib-ruby"
        },
        {
            "binary_version": "0.9.15-3",
            "binary_name": "libextlib-ruby-doc"
        },
        {
            "binary_version": "0.9.15-3",
            "binary_name": "libextlib-ruby1.8"
        },
        {
            "binary_version": "0.9.15-3",
            "binary_name": "libextlib-ruby1.9.1"
        },
        {
            "binary_version": "0.9.15-3",
            "binary_name": "ruby-extlib"
        }
    ]
}