Oval Definition:	oval:com.ubuntu.trusty:def:20131857000
Revision Date: 2013-03-19 Version: 1 Title: CVE-2013-1857 on Ubuntu 14.04 LTS (trusty) - medium. Description: The sanitize helper in lib/action_controller/vendor/html-scanner/html/sanitizer.rb in the Action Pack component in Ruby on Rails before 2.3.18, 3.0.x and 3.1.x before 3.1.12, and 3.2.x before 3.2.13 does not properly handle encoded : (colon) characters in URLs, which makes it easier for remote attackers to conduct cross-site scripting (XSS) attacks via a crafted scheme name, as demonstrated by including a : sequence. Family: unix Class: vulnerability Status: Reference(s): CVE-2013-1857 Platform(s): Ubuntu 14.04 LTS Product(s): Definition Synopsis Ubuntu 14.04 LTS (trusty) is installed. AND Package Information NOT While related to the CVE in some way, the 'rails' package in trusty is not affected (note: 'contains no code'). OR The 'ruby-actionpack-3.2' package in trusty was vulnerable but has been fixed (note: '3.2.6-6'). OR NOT While related to the CVE in some way, the 'ruby-activerecord-3.2' package in trusty is not affected. OR NOT While related to the CVE in some way, the 'ruby-activesupport-3.2' package in trusty is not affected. OR NOT While related to the CVE in some way, the 'ruby-rails-3.2' package in trusty is not affected.
BACK