FreeBSD VuXML: Documenting security issues in FreeBSD and the FreeBSD Ports Collection

rubygem-rails -- multiple vulnerabilities

Affected packages
	rubygem-rails	<	3.2.8
	rubygem-actionpack	<	3.2.8
	rubygem-activesupport	<	3.2.8

Details

VuXML ID	31db9a18-e289-11e1-a57d-080027a27dbf
Discovery	2012-08-08
Entry	2012-08-10

Rails core team reports:

This version contains three important security fixes, please upgrade immediately.

One of security fixes impacts all users and is related to HTML escaping code. The other two fixes impacts people using select_tag's prompt option and strip_tags helper from ActionPack.

CVE-2012-3463 Potential XSS Vulnerability in select_tag prompt.

CVE-2012-3464 Potential XSS Vulnerability in the HTML escaping code.

CVE-2012-3465 XSS Vulnerability in strip_tags.

[source]

References

CVE Name	CVE-2012-3463
CVE Name	CVE-2012-3464
CVE Name	CVE-2012-3465
URL	http://weblog.rubyonrails.org/2012/8/9/ann-rails-3-2-8-has-been-released/
URL	https://groups.google.com/d/msg/rubyonrails-security/FgVEtBajcTY/tYLS1JJTu38J
URL	https://groups.google.com/d/msg/rubyonrails-security/fV3QUToSMSw/eHBSFOUYHpYJ
URL	https://groups.google.com/d/msg/rubyonrails-security/kKGNeMrnmiY/r2yM7xy-G48J