CVE-2012-1099

NameCVE-2012-1099
DescriptionCross-site scripting (XSS) vulnerability in actionpack/lib/action_view/helpers/form_options_helper.rb in the select helper in Ruby on Rails 3.0.x before 3.0.12, 3.1.x before 3.1.4, and 3.2.x before 3.2.2 allows remote attackers to inject arbitrary web script or HTML via vectors involving certain generation of OPTION elements within SELECT elements.
SourceCVE (at NVD; oss-sec, fulldisc, OSVDB, EDB, Metasploit, Red Hat, Ubuntu, Gentoo, SuSE, Mageia, more)
ReferencesDSA-2466-1
NVD severitymedium (attack range: remote, user-initiated)
Debian Bugs668607
Debian/oldstablenot vulnerable.
Debian/stablenot vulnerable.
Debian/testingnot vulnerable.
Debian/unstablenot vulnerable.

Vulnerable and fixed packages

The table below lists information on source packages.

Source PackageReleaseVersionStatus
rails (PTS)squeeze (security), squeeze2.3.5-1.2+squeeze8fixed
wheezy2:2.3.14.2fixed
sid, jessie2:4.1.8-1fixed
ruby-actionpack-2.3 (PTS)wheezy2.3.14-5fixed

The information below is based on the following data on fixed versions.

PackageTypeReleaseFixed VersionUrgencyOriginDebian Bugs
railssource(unstable)2.3.14medium
railssourcesqueeze2.3.5-1.2+squeeze3mediumDSA-2466-1
ruby-actionpack-2.3source(unstable)2.3.14-3medium668607

Notes

(code lives within ruby-actionpack in unstable)

Search for package or bug name: Reporting problems