Mondoo

Vulnerability Management
Technology
Services

Solutions

Financial Services
Manufacturing
Healthcare

Resources

Blog
Vulnerability Database
Documentation
GitHub

Company

About
Careers
Partners
Contact

Legal

Privacy
Terms
Imprint

SUSE-SU-2016:0619-1 | Mondoo Vulnerability Intelligence

Vulnerability IntelligenceSUSE-SU-2016:0619-1

SUSE-SU-2016:0619-1

MEDIUM5.3

Security update for rubygem-activerecord-3_2

Published Mar 1, 2016

Modified 10 years ago

Fix available

Details

Description of the patch:

This update for rubygem-activerecord-3_2 fixes the following issues:

CVE-2015-7577: rubygem-activerecord: Nested attributes rejection proc bypass (bsc#963330)

Affected Packages

rubygem-activerecord-3_2

SUSE Lifecycle Management Server 1.3SUSE Linux Enterprise Desktop 11 SP4SUSE Linux Enterprise Server 11 SP4SUSE Linux Enterprise Server for SAP Applications 11 SP4SUSE Linux Enterprise Software Development Kit 11 SP4

Fixed in:

3.2.12-0.15.1

References

ADVISORY

https://bugzilla.suse.com/963330

ADVISORY

https://lists.suse.com/pipermail/sle-security-updates/2016-March/001902.html

ADVISORY

https://www.suse.com/security/cve/CVE-2015-7577/

WEB

https://www.suse.com/support/security/rating/

ADVISORY

https://www.suse.com/support/update/announcement/2016/suse-su-20160619-1/

CVSS Analysis

CVSS v3.0

5.3

Exploitability

Attack Vector

NetworkAV:N

Attack Complexity

LowAC:L

Privileges Required

NonePR:N

User Interaction

NoneUI:N

Scope

UnchangedS:U

Impact

Confidentiality

NoneC:N

Integrity

LowI:L

Availability

NoneA:N

5.3/CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Upstream

CVE-2015-7577

Ecosystems(7)

SUSE Lifecycle Management Server 1.3 SUSE Linux Enterprise Desktop 11 SP4 SUSE Linux Enterprise Server 11 SP4 SUSE Linux Enterprise Server for SAP Applications 11 SP4 SUSE Linux Enterprise Software Development Kit 11 SP4

Timeline

PublishedMar 1, 2016

ModifiedMar 1, 2016