{"id":"CVE-2016-0751","aliases":["DEBIAN-CVE-2016-0751","DLA-604-1","DSA-3464-1","EUVD-2017-0226","GHSA-ffpv-c4hm-3x6v","RHSA-2016:0296","RHSA-2016:0454","RHSA-2016:0455","SUSE-SU-2016:0457-1","SUSE-SU-2016:0618-1","SUSE-SU-2016:0858-1","SUSE-SU-2016:1146-1","SUSE-SU-2017:0475-1","UBUNTU-CVE-2016-0751"],"status":"published","title":"actionpack is vulnerable to denial of service via a crafted HTTP Accept header","description":"actionpack/lib/action_dispatch/http/mime_type.rb in Action Pack in Ruby on Rails before 3.2.22.1, 4.0.x and 4.1.x before 4.1.14.1, 4.2.x before 4.2.5.1, and 5.x before 5.0.0.beta1.1 does not properly restrict use of the MIME type cache, which allows remote attackers to cause a denial of service (memory consumption) via a crafted HTTP Accept header.","severity":{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-08","score":0.09731,"percentile":0.95552,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-399"],"published":"2016-01-31T00:00:00Z","modified":"2026-10-24T10:31:01Z","fixes":[{"ecosystem":"RubyGems","package":"actionpack","fixed_in":["4.2.5.1","3.2.22.1","4.1.14.1"],"sources":["ghsa","osv"]},{"ecosystem":"Debian:12","package":"rails","fixed_in":["2:4.2.5.1-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"rails","fixed_in":["2:4.2.5.1-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"rails","fixed_in":["2:4.2.5.1-1"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"RubyGems","package":"actionpack","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.2.0"},{"last_affected":"4.2.5.0"},{"fixed":"4.2.5.1"}]}]},{"source":"ghsa","ecosystem":"RubyGems","package":"actionpack","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"3.2.22.0"},{"fixed":"3.2.22.1"}]}]},{"source":"ghsa","ecosystem":"RubyGems","package":"actionpack","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.0.0"},{"last_affected":"4.1.14.0"},{"fixed":"4.1.14.1"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"rails","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:4.2.5.1-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"rails","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:4.2.5.1-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"rails","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:4.2.5.1-1"}]}]},{"source":"osv","ecosystem":"Debian:7","package":"ruby-actionpack-3.2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.6-6+deb7u3"}]}],"versions":["3.2.6-6","3.2.6-6+deb7u1","3.2.6-6+deb7u2"],"bundled":6},{"source":"osv","ecosystem":"Debian:8","package":"rails","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:4.1.8-1+deb8u1"}]}],"versions":["2:4.1.8-1"],"bundled":8},{"source":"osv","ecosystem":"RubyGems","package":"actionpack","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.2.0"},{"fixed":"4.2.5.1"}]}],"versions":["4.2.0","4.2.1","4.2.1.rc1","4.2.1.rc2","4.2.1.rc3","4.2.1.rc4","4.2.2","4.2.3","4.2.3.rc1","4.2.4","4.2.4.rc1","4.2.5","4.2.5.rc1","4.2.5.rc2"]},{"source":"osv","ecosystem":"RubyGems","package":"actionpack","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.22.1"}]}],"versions":["0.9.0","0.9.5","1.0.0","1.0.1","1.1.0","1.10.1","1.10.2","1.11.0","1.11.1","1.11.2","1.12.0","1.12.1","1.12.2","1.12.3","1.12.4","1.12.5","1.13.0","1.13.1","1.13.2","1.13.3","1.13.4","1.13.5","1.13.6","1.2.0","1.3.0","1.3.1","1.4.0","1.5.0","1.5.1","1.6.0","1.7.0","1.8.0","1.8.1","1.9.0","1.9.1","2.0.0","2.0.1","2.0.2","2.0.4","2.0.5","2.1.0","2.1.1","2.1.2","2.2.2","2.2.3","2.3.10","2.3.11","2.3.12","2.3.14","2.3.15","2.3.16","2.3.17","2.3.18","2.3.2","2.3.3","2.3.4","2.3.5","2.3.6","2.3.7","2.3.8","2.3.8.pre1","2.3.9","2.3.9.pre","3.0.0","3.0.0.beta","3.0.0.beta2","3.0.0.beta3","3.0.0.beta4","3.0.0.rc","3.0.0.rc2","3.0.1","3.0.10","3.0.10.rc1","3.0.11","3.0.12","3.0.12.rc1","3.0.13","3.0.13.rc1","3.0.14","3.0.15","3.0.16","3.0.17","3.0.18","3.0.19","3.0.2","3.0.20","3.0.3","3.0.4","3.0.4.rc1","3.0.5","3.0.5.rc1","3.0.6","3.0.6.rc1","3.0.6.rc2","3.0.7","3.0.7.rc1","3.0.7.rc2","3.0.8","3.0.8.rc1","3.0.8.rc2","3.0.8.rc4","3.0.9","3.0.9.rc1","3.0.9.rc3","3.0.9.rc4","3.0.9.rc5","3.1.0","3.1.0.beta1","3.1.0.rc1","3.1.0.rc2","3.1.0.rc3","3.1.0.rc4","3.1.0.rc5","3.1.0.rc6","3.1.0.rc8","3.1.1","3.1.1.rc1","3.1.1.rc2","3.1.1.rc3","3.1.10","3.1.11","3.1.12","3.1.2","3.1.2.rc1","3.1.2.rc2","3.1.3","3.1.4","3.1.4.rc1","3.1.5","3.1.5.rc1","3.1.6","3.1.7","3.1.8","3.1.9","3.2.0","3.2.0.rc1","3.2.0.rc2","3.2.1","3.2.10","3.2.11","3.2.12","3.2.13","3.2.13.rc1","3.2.13.rc2","3.2.14","3.2.14.rc1","3.2.14.rc2","3.2.15","3.2.15.rc1","3.2.15.rc2","3.2.15.rc3","3.2.16","3.2.17","3.2.18","3.2.19","3.2.2","3.2.2.rc1","3.2.20","3.2.21","3.2.22","3.2.3","3.2.3.rc1","3.2.3.rc2","3.2.4","3.2.4.rc1","3.2.5","3.2.6","3.2.7","3.2.7.rc1","3.2.8","3.2.8.rc1","3.2.8.rc2","3.2.9","3.2.9.rc1","3.2.9.rc2","3.2.9.rc3"]},{"source":"osv","ecosystem":"RubyGems","package":"actionpack","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.0.0"},{"fixed":"4.1.14.1"}]}],"versions":["4.0.0","4.0.1","4.0.1.rc1","4.0.1.rc2","4.0.1.rc3","4.0.1.rc4","4.0.10","4.0.10.rc1","4.0.10.rc2","4.0.11","4.0.11.1","4.0.12","4.0.13","4.0.13.rc1","4.0.2","4.0.3","4.0.4","4.0.4.rc1","4.0.5","4.0.6","4.0.6.rc1","4.0.6.rc2","4.0.6.rc3","4.0.7","4.0.8","4.0.9","4.1.0","4.1.0.beta1","4.1.0.beta2","4.1.0.rc1","4.1.0.rc2","4.1.1","4.1.10","4.1.10.rc1","4.1.10.rc2","4.1.10.rc3","4.1.10.rc4","4.1.11","4.1.12","4.1.12.rc1","4.1.13","4.1.13.rc1","4.1.14","4.1.14.rc1","4.1.14.rc2","4.1.2","4.1.2.rc1","4.1.2.rc2","4.1.2.rc3","4.1.3","4.1.4","4.1.5","4.1.6","4.1.6.rc1","4.1.6.rc2","4.1.7","4.1.7.1","4.1.8","4.1.9","4.1.9.rc1"]},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:2::el6","package":"rh-ror41-rubygem-actionpack","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:4.1.5-3.el6"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:2::el6","package":"rh-ror41-rubygem-actionpack-doc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:4.1.5-3.el6"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:2::el6","package":"rh-ror41-rubygem-actionview","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.1.5-4.el6"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:2::el6","package":"rh-ror41-rubygem-actionview-doc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.1.5-4.el6"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:2::el6","package":"rh-ror41-rubygem-activemodel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.1.5-2.el6"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:2::el6","package":"rh-ror41-rubygem-activemodel-doc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.1.5-2.el6"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:2::el6","package":"rh-ror41-rubygem-activerecord","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:4.1.5-2.el6"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:2::el6","package":"rh-ror41-rubygem-activerecord-doc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:4.1.5-2.el6"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:2::el6","package":"rh-ror41-rubygem-activesupport","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:4.1.5-3.el6"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:2::el7","package":"rh-ror41-rubygem-actionpack","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:4.1.5-3.el7"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:2::el7","package":"rh-ror41-rubygem-actionpack-doc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:4.1.5-3.el7"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:2::el7","package":"rh-ror41-rubygem-actionview","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.1.5-4.el7"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:2::el7","package":"rh-ror41-rubygem-actionview-doc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.1.5-4.el7"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:2::el7","package":"rh-ror41-rubygem-activemodel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.1.5-2.el7"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:2::el7","package":"rh-ror41-rubygem-activemodel-doc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.1.5-2.el7"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:2::el7","package":"rh-ror41-rubygem-activerecord","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:4.1.5-2.el7"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:2::el7","package":"rh-ror41-rubygem-activerecord-doc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:4.1.5-2.el7"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:2::el7","package":"rh-ror41-rubygem-activesupport","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:4.1.5-3.el7"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:2::el6","package":"ror40-rubygem-actionpack","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:4.0.2-7.el6"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:2::el6","package":"ror40-rubygem-actionpack-doc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:4.0.2-7.el6"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:2::el6","package":"ror40-rubygem-activerecord","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:4.0.2-6.el6"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:2::el6","package":"ror40-rubygem-activerecord-doc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:4.0.2-6.el6"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:2::el6","package":"ror40-rubygem-activesupport","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:4.0.2-4.el6"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:2::el7","package":"ror40-rubygem-actionpack","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:4.0.2-7.el7"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:2::el7","package":"ror40-rubygem-actionpack-doc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:4.0.2-7.el7"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:2::el7","package":"ror40-rubygem-activerecord","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:4.0.2-6.el7"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:2::el7","package":"ror40-rubygem-activerecord-doc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:4.0.2-6.el7"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:2::el7","package":"ror40-rubygem-activesupport","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:4.0.2-4.el7"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:2::el6","package":"ruby193-rubygem-actionpack","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:3.2.8-16.el6"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:2::el6","package":"ruby193-rubygem-actionpack-doc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:3.2.8-16.el6"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:2::el6","package":"ruby193-rubygem-activerecord","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:3.2.8-11.el6"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:2::el6","package":"ruby193-rubygem-activerecord-doc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:3.2.8-11.el6"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:2::el6","package":"ruby193-rubygem-activesupport","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:3.2.8-6.el6"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:2::el7","package":"ruby193-rubygem-actionpack","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:3.2.8-16.el7"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:2::el7","package":"ruby193-rubygem-actionpack-doc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:3.2.8-16.el7"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:2::el7","package":"ruby193-rubygem-activerecord","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:3.2.8-11.el7"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:2::el7","package":"ruby193-rubygem-activerecord-doc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:3.2.8-11.el7"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:2::el7","package":"ruby193-rubygem-activesupport","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:3.2.8-6.el7"}]}],"bundled":6},{"source":"osv","ecosystem":"SUSE:Enterprise Storage 2.1","package":"rubygem-actionpack-4_2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2.2-6.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Software Development Kit 11 SP4","package":"rubygem-actionpack-3_2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.12-0.23.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Lifecycle Management Server 1.3","package":"rubygem-actionpack-3_2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.12-0.23.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Studio Onsite 1.3","package":"rubygem-actionpack-3_2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.12-0.23.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:WebYast 1.3","package":"rubygem-actionpack-3_2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.12-0.23.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 5","package":"rubygem-actionpack-4_1","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.1.9-9.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Containers 12","package":"portus","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.3-2.4"}]}],"bundled":10},{"source":"osv","ecosystem":"SUSE:Studio Onsite 1.3","package":"libjansson","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.1-0.9.11.6"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Studio Onsite 1.3","package":"qemu-ext2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.1.1-0.9.4.19"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Studio Onsite 1.3","package":"rubygem-bundler19","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.7.0-0.13.10"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Studio Onsite 1.3","package":"studio-help","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.20-0.6.9"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Studio Onsite 1.3","package":"susestudio","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.14-52.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Studio Onsite Runner 1.3","package":"libjansson","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.1-0.9.11.6"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Studio Onsite Runner 1.3","package":"qemu-ext2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.1.1-0.9.4.19"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Studio Onsite Runner 1.3","package":"rubygem-bundler19","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.7.0-0.13.10"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Studio Onsite Runner 1.3","package":"studio-help","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.20-0.6.9"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Studio Onsite Runner 1.3","package":"susestudio","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.14-52.1"}]}],"bundled":5}],"products":[{"vendor":"rubyonrails","product":"rails"},{"vendor":"rubyonrails","product":"ruby_on_rails"}],"references":[{"url":"http://lists.opensuse.org/opensuse-updates/2016-02/msg00043.html","tags":["vendor-advisory","x_refsource_SUSE","x_transferred","web"]},{"url":"http://lists.opensuse.org/opensuse-updates/2016-02/msg00034.html","tags":["vendor-advisory","x_refsource_SUSE","x_transferred","web"]},{"url":"http://lists.fedoraproject.org/pipermail/package-announce/2016-February/178043.html","tags":["vendor-advisory","x_refsource_FEDORA","x_transferred","web"]},{"url":"https://groups.google.com/forum/message/raw?msg=ruby-security-ann/9oLY_FCzvoc/5CDXbvpYEgAJ","tags":["mailing-list","x_refsource_MLIST","x_transferred","web"]},{"url":"http://lists.fedoraproject.org/pipermail/package-announce/2016-February/178067.html","tags":["vendor-advisory","x_refsource_FEDORA","x_transferred","web"]},{"url":"http://lists.opensuse.org/opensuse-security-announce/2016-04/msg00053.html","tags":["vendor-advisory","x_refsource_SUSE","x_transferred","web"]},{"url":"http://www.securityfocus.com/bid/81800","tags":["vdb-entry","x_refsource_BID","x_transferred","web"]},{"url":"http://www.securitytracker.com/id/1034816","tags":["vdb-entry","x_refsource_SECTRACK","x_transferred","web"]},{"url":"http://www.openwall.com/lists/oss-security/2016/01/25/9","tags":["mailing-list","x_refsource_MLIST","x_transferred","web"]},{"url":"http://www.debian.org/security/2016/dsa-3464","tags":["vendor-advisory","x_refsource_DEBIAN","x_transferred","advisory","web"]},{"url":"http://rhn.redhat.com/errata/RHSA-2016-0296.html","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred","advisory","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2016-0751","tags":["advisory"]},{"url":"https://github.com/rails/rails/commit/127967b735813cd4f263df7a50426d74e7e9cc17","tags":["web"]},{"url":"https://github.com/rails/rails/commit/221937c8ba1d291430ceddebbd4bdef7d3cb47d6","tags":["web"]},{"url":"https://github.com/rails/rails/commit/37047b779a177b911c7161052cfc34a30e1db0af","tags":["web"]},{"url":"https://github.com/rubysec/ruby-advisory-db/blob/master/gems/actionpack/CVE-2016-0751.yml","tags":["web"]},{"url":"https://groups.google.com/forum/#!topic/rubyonrails-security/9oLY_FCzvoc","tags":["web"]},{"url":"https://web.archive.org/web/20160128201702/http://www.securitytracker.com/id/1034816","tags":["web"]},{"url":"https://web.archive.org/web/20200227181647/http://www.securityfocus.com/bid/81800","tags":["web"]},{"url":"https://github.com/advisories/GHSA-ffpv-c4hm-3x6v"},{"url":"https://security-tracker.debian.org/tracker/CVE-2016-0751","tags":["advisory"]},{"url":"https://github.com/rails/rails","tags":["package"]},{"url":"https://access.redhat.com/errata/RHSA-2016:0296","tags":["advisory"]},{"url":"https://access.redhat.com/security/updates/classification/#important","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1301933","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1301946","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1301957","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1301963","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1301973","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1301981","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2016/rhsa-2016_0296.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2015-7576","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2015-7576","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2015-7576","tags":["advisory"]},{"url":"http://weblog.rubyonrails.org/2016/1/25/Rails-5-0-0-beta1-1-4-2-5-1-4-1-14-1-3-2-22-1-and-rails-html-sanitizer-1-0-3-have-been-released/","tags":["article"]},{"url":"https://groups.google.com/forum/#!msg/rubyonrails-security/ANv0HDHEC3k/mt7wNGxbFQAJ","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2015-7577","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2015-7577","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2015-7577","tags":["advisory"]},{"url":"https://groups.google.com/forum/#!msg/rubyonrails-security/cawsWcQ6c8g/tegZtYdbFQAJ","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2015-7581","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2015-7581","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2015-7581","tags":["advisory"]},{"url":"https://groups.google.com/forum/#!msg/rubyonrails-security/dthJ5wL69JE/YzPnFelbFQAJ","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2016-0751","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2016-0751","tags":["advisory","report"]},{"url":"https://groups.google.com/forum/#!msg/rubyonrails-security/9oLY_FCzvoc/w9oI9XxbFQAJ","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2016-0752","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2016-0752","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2016-0752","tags":["advisory"]},{"url":"https://groups.google.com/forum/#!msg/rubyonrails-security/335P1DcLG00/OfB9_LhbFQAJ","tags":["article"]},{"url":"https://nvisium.com/blog/2016/01/26/rails-dynamic-render-to-rce-cve-2016-0752/","tags":["article"]},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2016-0753","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2016-0753","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2016-0753","tags":["advisory"]},{"url":"https://groups.google.com/forum/#!msg/rubyonrails-security/6jQVC1geukQ/8oYETcxbFQAJ","tags":["article"]},{"url":"https://access.redhat.com/errata/RHSA-2016:0454","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1310043","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1310054","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2016/rhsa-2016_0454.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2016-2097","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2016-2097","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2016-2097","tags":["advisory"]},{"url":"https://groups.google.com/forum/#!msg/rubyonrails-security/ddY6HgqB2z4/we0RasMZIAAJ","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2016-2098","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2016-2098","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2016-2098","tags":["advisory"]},{"url":"https://groups.google.com/forum/#!msg/rubyonrails-security/ly-IH-fxr_Q/WLoOhcMZIAAJ","tags":["article"]},{"url":"https://access.redhat.com/errata/RHSA-2016:0455","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2016/rhsa-2016_0455.json","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2016/suse-su-20160457-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/963329","tags":["report"]},{"url":"https://bugzilla.suse.com/963331","tags":["report"]},{"url":"https://bugzilla.suse.com/963332","tags":["report"]},{"url":"https://bugzilla.suse.com/963335","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2015-7576","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-7581","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-0751","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-0752","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2016/suse-su-20160618-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2016/suse-su-20160858-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2016/suse-su-20161146-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/963326","tags":["report"]},{"url":"https://bugzilla.suse.com/963327","tags":["report"]},{"url":"https://bugzilla.suse.com/963328","tags":["report"]},{"url":"https://bugzilla.suse.com/963563","tags":["report"]},{"url":"https://bugzilla.suse.com/963604","tags":["report"]},{"url":"https://bugzilla.suse.com/963608","tags":["report"]},{"url":"https://bugzilla.suse.com/963617","tags":["report"]},{"url":"https://bugzilla.suse.com/963625","tags":["report"]},{"url":"https://bugzilla.suse.com/963627","tags":["report"]},{"url":"https://bugzilla.suse.com/969943","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2015-7577","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-7578","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-7579","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-7580","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-0753","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-2098","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2017/suse-su-20170475-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/870697","tags":["report"]},{"url":"https://bugzilla.suse.com/887489","tags":["report"]},{"url":"https://bugzilla.suse.com/929102","tags":["report"]},{"url":"https://bugzilla.suse.com/942185","tags":["report"]},{"url":"https://bugzilla.suse.com/947225","tags":["report"]},{"url":"https://bugzilla.suse.com/963741","tags":["report"]},{"url":"https://bugzilla.suse.com/968797","tags":["report"]},{"url":"https://bugzilla.suse.com/969322","tags":["report"]},{"url":"https://bugzilla.suse.com/972406","tags":["report"]},{"url":"https://bugzilla.suse.com/972425","tags":["report"]},{"url":"https://bugzilla.suse.com/974130","tags":["report"]},{"url":"https://bugzilla.suse.com/979110","tags":["report"]},{"url":"https://bugzilla.suse.com/979124","tags":["report"]},{"url":"https://bugzilla.suse.com/981095","tags":["report"]},{"url":"https://bugzilla.suse.com/983404","tags":["report"]},{"url":"https://bugzilla.suse.com/983999","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2015-3448","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2016-0751","tags":["report"]},{"url":"https://marc.info/?l=oss-security\u0026m=145375035828624\u0026w=2","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2016-0751","description":"actionpack/lib/action_dispatch/http/mime_type.rb in Action Pack in Ruby on Rails before 3.2.22.1, 4.0.x and 4.1.x before 4.1.14.1, 4.2.x before 4.2.5.1, and 5.x before 5.0.0.beta1.1 does not properly restrict use of the MIME type cache, which allows remote attackers to cause a denial of service (memory consumption) via a crafted HTTP Accept header.","status":"published","published":"2016-02-16T02:00:00Z","modified":"2024-08-05T22:30:03.975Z","updated_at":"2026-11-02T14:33:37.12286Z"}],"euvd":[{"id":"EUVD-2017-0226","description":"actionpack/lib/action_dispatch/http/mime_type.rb in Action Pack in Ruby on Rails before 3.2.22.1, 4.0.x and 4.1.x before 4.1.14.1, 4.2.x before 4.2.5.1, and 5.x before 5.0.0.beta1.1 does not properly restrict use of the MIME type cache, which allows remote attackers to cause a denial of service (memory consumption) via a crafted HTTP Accept header.","status":"published","published":"2016-02-16T02:00:00Z","modified":"2024-08-05T22:30:03Z","updated_at":"2026-11-03T02:23:00.426765Z"}],"ghsa":[{"id":"GHSA-ffpv-c4hm-3x6v","title":"actionpack is vulnerable to denial of service via a crafted HTTP Accept header","description":"actionpack/lib/action_dispatch/http/mime_type.rb in Action Pack in Ruby on Rails before 3.2.22.1, 4.0.x and 4.1.x before 4.1.14.1, 4.2.x before 4.2.5.1, and 5.x before 5.0.0.beta1.1 does not properly restrict use of the MIME type cache, which allows remote attackers to cause a denial of service (memory consumption) via a crafted HTTP Accept header.","status":"published","published":"2017-10-24T18:33:35Z","modified":"2023-07-31T21:08:47Z","cvss":[{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T14:36:58.760727Z"}],"nvd":[{"id":"CVE-2016-0751","description":"actionpack/lib/action_dispatch/http/mime_type.rb in Action Pack in Ruby on Rails before 3.2.22.1, 4.0.x and 4.1.x before 4.1.14.1, 4.2.x before 4.2.5.1, and 5.x before 5.0.0.beta1.1 does not properly restrict use of the MIME type cache, which allows remote attackers to cause a denial of service (memory consumption) via a crafted HTTP Accept header.","status":"published","published":"2016-02-16T02:59:05.877Z","modified":"2026-06-17T00:38:08.893Z","cvss":[{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"primary"},{"version":"2.0","score":5,"vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","level":"medium","assessor":"primary"}],"cwes":["CWE-399"],"updated_at":"2026-11-02T14:03:22.479119Z"}],"osv":[{"id":"CVE-2016-0751","description":"actionpack/lib/action_dispatch/http/mime_type.rb in Action Pack in Ruby on Rails before 3.2.22.1, 4.0.x and 4.1.x before 4.1.14.1, 4.2.x before 4.2.5.1, and 5.x before 5.0.0.beta1.1 does not properly restrict use of the MIME type cache, which allows remote attackers to cause a denial of service (memory consumption) via a crafted HTTP Accept header.","status":"published","published":"2016-02-16T02:59:05.877Z","modified":"2026-10-24T10:31:01.97743066Z","cvss":[{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:44:01.531338Z"},{"id":"DEBIAN-CVE-2016-0751","description":"actionpack/lib/action_dispatch/http/mime_type.rb in Action Pack in Ruby on Rails before 3.2.22.1, 4.0.x and 4.1.x before 4.1.14.1, 4.2.x before 4.2.5.1, and 5.x before 5.0.0.beta1.1 does not properly restrict use of the MIME type cache, which allows remote attackers to cause a denial of service (memory consumption) via a crafted HTTP Accept header.","status":"published","published":"2016-02-16T02:59:05.877Z","modified":"2026-09-22T07:00:13.157770381Z","cvss":[{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:45:27.323751Z"},{"id":"GHSA-ffpv-c4hm-3x6v","title":"actionpack is vulnerable to denial of service via a crafted HTTP Accept header","description":"actionpack/lib/action_dispatch/http/mime_type.rb in Action Pack in Ruby on Rails before 3.2.22.1, 4.0.x and 4.1.x before 4.1.14.1, 4.2.x before 4.2.5.1, and 5.x before 5.0.0.beta1.1 does not properly restrict use of the MIME type cache, which allows remote attackers to cause a denial of service (memory consumption) via a crafted HTTP Accept header.","status":"published","published":"2017-10-24T18:33:35Z","modified":"2024-11-29T05:50:00.093043Z","cvss":[{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:46:46.39441Z"},{"id":"UBUNTU-CVE-2016-0751","description":"actionpack/lib/action_dispatch/http/mime_type.rb in Action Pack in Ruby on Rails before 3.2.22.1, 4.0.x and 4.1.x before 4.1.14.1, 4.2.x before 4.2.5.1, and 5.x before 5.0.0.beta1.1 does not properly restrict use of the MIME type cache, which allows remote attackers to cause a denial of service (memory consumption) via a crafted HTTP Accept header.","status":"withdrawn","published":"2016-02-16T02:59:00Z","modified":"2025-07-16T07:33:47.116767Z","cvss":[{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:54:11.100633Z"},{"id":"DLA-604-1","title":"ruby-actionpack-3.2 - security update","status":"published","published":"2016-08-28T00:00:00Z","modified":"2026-03-09T02:09:15.25132Z","updated_at":"2026-11-02T15:46:13.207219Z"},{"id":"DSA-3464-1","title":"rails - security update","status":"published","published":"2016-01-31T00:00:00Z","modified":"2026-03-09T01:23:14.489999Z","updated_at":"2026-11-02T15:46:16.199525Z"},{"id":"RHSA-2016:0296","title":"Red Hat Security Advisory: rh-ror41 security update","status":"published","published":"2024-09-13T12:26:48Z","modified":"2026-06-29T10:11:32Z","updated_at":"2026-11-02T15:53:03.734507Z"},{"id":"RHSA-2016:0454","title":"Red Hat Security Advisory: ror40 security update","status":"published","published":"2024-09-13T12:26:58Z","modified":"2026-06-29T10:11:55Z","updated_at":"2026-11-02T15:53:03.734507Z"},{"id":"RHSA-2016:0455","title":"Red Hat Security Advisory: ruby193 security update","status":"published","published":"2024-09-13T12:27:04Z","modified":"2026-06-29T10:11:56Z","updated_at":"2026-11-02T15:53:03.734507Z"},{"id":"SUSE-SU-2016:0457-1","title":"Security update for rubygem-actionpack-4_2","description":"\nThis update for rubygem-actionpack-4_2 fixes the following issues:\n\n- CVE-2016-0751: Object Leak DoS (bsc#963331)\n- CVE-2015-7581: unbounded memory growth DoS via wildcard controller routes (bsc#963335) \n- CVE-2016-0752: directory traversal and information leak in Action View (bsc#963332) \n- CVE-2015-7576: Timing attack vulnerability in basic authentication in Action Controller (bsc#963329)\n","status":"published","published":"2016-02-15T13:25:35Z","modified":"2026-02-04T02:15:47.93325Z","updated_at":"2026-11-02T15:53:43.030986Z"},{"id":"SUSE-SU-2016:0618-1","title":"Security update for rubygem-actionpack-3_2","description":"\nThis update for rubygem-actionpack-3_2 fixes the following issues:\n\n- CVE-2016-0751: Object Leak DoS (bsc#963331)\n- CVE-2016-0752: Directory traversal and information leak in Action View (bsc#963332)\n- CVE-2015-7576: Timing attack vulnerability in basic authentication in Action Controller (bsc#963329)\n","status":"published","published":"2016-03-01T13:50:54Z","modified":"2026-02-04T04:39:00.950323Z","updated_at":"2026-11-02T15:53:43.030986Z"},{"id":"SUSE-SU-2016:0858-1","title":"Security update for rubygem-actionpack-4_1","description":"\nThis update for rubygem-actionpack-4_1 fixes the following issues:\n\n- CVE-2016-0751: Object Leak DoS (bsc#963331)\n- CVE-2015-7581: unbounded memory growth DoS via wildcard controller routes (bsc#963335) \n- CVE-2016-0752: directory traversal and information leak in Action View (bsc#963332) \n- CVE-2015-7576: Timing attack vulnerability in basic authentication in Action Controller (bsc#963329)\n","status":"published","published":"2016-03-22T16:21:44Z","modified":"2026-02-04T04:06:07.047805Z","updated_at":"2026-11-02T15:53:43.030986Z"},{"id":"SUSE-SU-2016:1146-1","title":"Security update for portus","description":"\nPortus was updated to version 2.0.3, which brings several fixes and enhancements:\n\n- Fixed crono job when a repository could not be found.\n- Fixed compatibility issues with Docker 1.10 and Distribution 2.3.\n- Handle multiple scopes in token requests.\n- Add optional fields to token response.\n- Fixed notification events for Distribution v2.3.\n- Paginate through the catalog properly.\n- Do not remove all the repositories if fetching one fails.\n- Fixed SMTP setup.\n- Don't let crono overflow the 'log' column on the DB.\n- Show the actual LDAP error on invalid login.\n- Fixed the location of crono logs.\n- Always use relative paths.\n- Set RUBYLIB when using portusctl.\n- Don't count hidden teams on the admin panel.\n- Warn developers on unsupported docker-compose versions.\n- Directly invalidate LDAP logins without name and password.\n- Don't show the 'I forgot my password' link on LDAP.\n\nThe following Rubygems bundled within Portus have been updated to fix security\nissues:\n\n- CVE-2016-2098: rubygem-actionpack (bsc#969943).\n- CVE-2015-7578: rails-html-sanitizer (bsc#963326).\n- CVE-2015-7579: rails-html-sanitizer (bsc#963327).\n- CVE-2015-7580: rails-html-sanitizer (bsc#963328).\n- CVE-2015-7576: rubygem-actionpack, rubygem-activesupport (bsc#963563).\n- CVE-2015-7577: rubygem-activerecord (bsc#963604).\n- CVE-2016-0751: rugygem-actionpack (bsc#963627).\n- CVE-2016-0752: rubygem-actionpack, rubygem-actionview (bsc#963608).\n- CVE-2016-0753: rubygem-activemodel, rubygem-activesupport, rubygem-activerecord (bsc#963617).\n- CVE-2015-7581: rubygem-actionpack (bsc#963625).\n","status":"published","published":"2016-04-25T14:28:51Z","modified":"2026-02-04T03:47:46.041833Z","updated_at":"2026-11-02T15:53:43.438985Z"},{"id":"SUSE-SU-2017:0475-1","title":"Security update for susestudio","description":"\nThis update provides SUSE Studio Runner 1.3.14, which brings fixes for the following issues:\n\n- bsc#968797: 11 SP3 appliance gets invalid distribution upgrade from SLMS.\n- bsc#947225: Second build of appliance will not register to SLMS, wrong product name.\n- bsc#983404: UEFI boot missing for SLE11 SP4.\n- bsc#972406: Kiwi export config.sh script has /build-custom out of order.\n- bsc#981095: Add user 'ldap' to default_users list for assigning owners for overlay files.\n- bsc#972425: Runlevel 3 is being ignored in appliance configuration.\n- bsc#983999: SLES 12 appliance build does not include gpg keys from base product.\n- bsc#979110: SLES 12 will not build for EC2.\n- bsc#929102: Plaintext Password Local Disclosure in rubygem-rest-client. (CVE-2015-3448)\n- bsc#963741: Security fixes for Rails v3.2.22. (CVE-2015-7576, CVE-2015-7577, CVE-2016-0751,\n  CVE-2016-0752)\n","status":"published","published":"2017-02-16T00:19:16Z","modified":"2026-02-04T04:39:40.971383Z","updated_at":"2026-11-02T15:53:43.83457Z"}]}}