CVE-2016-0752

Directory traversal vulnerability in Action View in Ruby on Rails before 3.2.22.1, 4.0.x and 4.1.x before 4.1.14.1, 4.2.x before 4.2.5.1, and 5.x before 5.0.0.beta1.1 allows remote attackers to read arbitrary files by leveraging an application's unrestricted use of the render method and providing a .. (dot dot) in a pathname.

Directory traversal vulnerability in Action View in Ruby on Rails before 3.2.22.1, 4.0.x and 4.1.x before 4.1.14.1, 4.2.x before 4.2.5.1, and 5.x before 5.0.0.beta1.1 allows remote attackers to read arbitrary files by leveraging an application's unrestricted use of the render method and providing a .. (dot dot) in a pathname.

Directory traversal vulnerability in Action View in Ruby on Rails before 3.2.22.1, 4.0.x and 4.1.x before 4.1.14.1, 4.2.x before 4.2.5.1, and 5.x before 5.0.0.beta1.1 allows remote attackers to read arbitrary files by leveraging an application's unrestricted use of the render method and providing a .. (dot dot) in a pathname.

This update for rubygem-actionview-4_2 fixes the following issues:

• CVE-2016-0752: directory traversal and information leak in Action View (bsc#963332)

This update for rubygem-actionpack-4_2 fixes the following issues:

• CVE-2016-0751: Object Leak DoS (bsc#963331)
• CVE-2015-7581: unbounded memory growth DoS via wildcard controller routes (bsc#963335)
• CVE-2016-0752: directory traversal and information leak in Action View (bsc#963332)
• CVE-2015-7576: Timing attack vulnerability in basic authentication in Action Controller (bsc#963329)

This update for rubygem-actionview-4_1 fixes the following issues:

• CVE-2016-0752: directory traversal and information leak in Action View (bsc#963332)

This update for rubygem-actionpack-3_2 fixes the following issues:

• CVE-2016-0751: Object Leak DoS (bsc#963331)
• CVE-2016-0752: Directory traversal and information leak in Action View (bsc#963332)
• CVE-2015-7576: Timing attack vulnerability in basic authentication in Action Controller (bsc#963329)

This update for rubygem-actionpack-4_1 fixes the following issues:

• CVE-2016-0751: Object Leak DoS (bsc#963331)
• CVE-2015-7581: unbounded memory growth DoS via wildcard controller routes (bsc#963335)
• CVE-2016-0752: directory traversal and information leak in Action View (bsc#963332)
• CVE-2015-7576: Timing attack vulnerability in basic authentication in Action Controller (bsc#963329)

Portus was updated to version 2.0.3, which brings several fixes and enhancements:

• Fixed crono job when a repository could not be found.
• Fixed compatibility issues with Docker 1.10 and Distribution 2.3.
• Handle multiple scopes in token requests.
• Add optional fields to token response.
• Fixed notification events for Distribution v2.3.
• Paginate through the catalog properly.
• Do not remove all the repositories if fetching one fails.
• Fixed SMTP setup.
• Don't let crono overflow the 'log' column on the DB.
• Show the actual LDAP error on invalid login.
• Fixed the location of crono logs.
• Always use relative paths.
• Set RUBYLIB when using portusctl.
• Don't count hidden teams on the admin panel.
• Warn developers on unsupported docker-compose versions.
• Directly invalidate LDAP logins without name and password.
• Don't show the 'I forgot my password' link on LDAP.

The following Rubygems bundled within Portus have been updated to fix security issues:

• CVE-2016-2098: rubygem-actionpack (bsc#969943).
• CVE-2015-7578: rails-html-sanitizer (bsc#963326).
• CVE-2015-7579: rails-html-sanitizer (bsc#963327).
• CVE-2015-7580: rails-html-sanitizer (bsc#963328).
• CVE-2015-7576: rubygem-actionpack, rubygem-activesupport (bsc#963563).
• CVE-2015-7577: rubygem-activerecord (bsc#963604).
• CVE-2016-0751: rugygem-actionpack (bsc#963627).
• CVE-2016-0752: rubygem-actionpack, rubygem-actionview (bsc#963608).
• CVE-2016-0753: rubygem-activemodel, rubygem-activesupport, rubygem-activerecord (bsc#963617).
• CVE-2015-7581: rubygem-actionpack (bsc#963625).

This update provides SUSE Studio Runner 1.3.14, which brings fixes for the following issues:

• bsc#968797: 11 SP3 appliance gets invalid distribution upgrade from SLMS.
• bsc#947225: Second build of appliance will not register to SLMS, wrong product name.
• bsc#983404: UEFI boot missing for SLE11 SP4.
• bsc#972406: Kiwi export config.sh script has /build-custom out of order.
• bsc#981095: Add user 'ldap' to default_users list for assigning owners for overlay files.
• bsc#972425: Runlevel 3 is being ignored in appliance configuration.
• bsc#983999: SLES 12 appliance build does not include gpg keys from base product.
• bsc#979110: SLES 12 will not build for EC2.
• bsc#929102: Plaintext Password Local Disclosure in rubygem-rest-client. (CVE-2015-3448)
• bsc#963741: Security fixes for Rails v3.2.22. (CVE-2015-7576, CVE-2015-7577, CVE-2016-0751, CVE-2016-0752)