CVE-2013-0256

NameCVE-2013-0256
Descriptiondarkfish.js in RDoc 2.3.0 through 3.12 and 4.x before 4.0.0.preview2.1, as used in Ruby, does not properly generate documents, which allows remote attackers to conduct cross-site scripting (XSS) attacks via a crafted URL.
SourceCVE (at NVD; CERT, LWN, oss-sec, fulldisc, bugtraq, EDB, Metasploit, Red Hat, Ubuntu, Gentoo, SuSE, Mageia, GitHub code/issues, web search, more)
ReferencesDLA-235-1
NVD severitymedium (attack range: remote)
Debian Bugs699929

Vulnerable and fixed packages

The table below lists information on source packages.

Source PackageReleaseVersionStatus
ruby1.8 (PTS)wheezy1.8.7.358-7.1+deb7u3fixed
wheezy (security)1.8.7.358-7.1+deb7u4fixed
ruby1.9.1 (PTS)wheezy1.9.3.194-8.1+deb7u5fixed
wheezy (security)1.9.3.194-8.1+deb7u6fixed

The information below is based on the following data on fixed versions.

PackageTypeReleaseFixed VersionUrgencyOriginDebian Bugs
ruby1.8source(unstable)(not affected)
ruby1.9.1source(unstable)1.9.3.194-6low699929
ruby1.9.1sourcesqueeze1.9.2.0-2+deb6u4mediumDLA-235-1

Notes

- ruby1.8 <not-affected> (Only affects 1.9 and 2.0)
http://marc.info/?l=oss-security&m=136021623726440&w=2
https://github.com/rdoc/rdoc/commit/ffa87887ee0517793df7541629a470e331f9fe60

Search for package or bug name: Reporting problems