{"id":"CVE-2016-6316","aliases":["DEBIAN-CVE-2016-6316","DLA-604-1","DSA-3651-1","EUVD-2017-0281","GHSA-pc3m-v286-2jwj","RHSA-2016:1855","RHSA-2016:1856","RHSA-2016:1857","RHSA-2016:1858","SUSE-SU-2017:2716-1"],"status":"published","title":"actionview Cross-site Scripting vulnerability","description":"Cross-site scripting (XSS) vulnerability in Action View in Ruby on Rails 3.x before 3.2.22.3, 4.x before 4.2.7.1, and 5.x before 5.0.0.1 might allow remote attackers to inject arbitrary web script or HTML via text declared as \"HTML safe\" and used as attribute values in tag handlers.","severity":{"version":"3.0","score":6.1,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-08","score":0.03438,"percentile":0.89052,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-79"],"published":"2016-08-25T00:00:00Z","modified":"2026-10-24T10:30:33Z","fixes":[{"ecosystem":"RubyGems","package":"actionview","fixed_in":["3.2.22.3","4.2.7.1","5.0.0.1"],"sources":["ghsa","osv"]},{"ecosystem":"Debian:12","package":"rails","fixed_in":["2:4.2.7.1-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"rails","fixed_in":["2:4.2.7.1-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"rails","fixed_in":["2:4.2.7.1-1"],"sources":["osv"]},{"ecosystem":"Debian:8","package":"rails","fixed_in":["2:4.1.8-1+deb8u4"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_software_collections:2::el6","package":"rh-ror41-rubygem-actionview","fixed_in":["0:4.1.5-6.el6"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_software_collections:2::el6","package":"rh-ror41-rubygem-actionview-doc","fixed_in":["0:4.1.5-6.el6"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_software_collections:2::el7","package":"rh-ror41-rubygem-actionview","fixed_in":["0:4.1.5-6.el7"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_software_collections:2::el7","package":"rh-ror41-rubygem-actionview-doc","fixed_in":["0:4.1.5-6.el7"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_software_collections:2::el6","package":"ror40-rubygem-actionpack","fixed_in":["1:4.0.2-8.el6"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_software_collections:2::el6","package":"ror40-rubygem-actionpack-doc","fixed_in":["1:4.0.2-8.el6"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_software_collections:2::el7","package":"ror40-rubygem-actionpack","fixed_in":["1:4.0.2-8.el7"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_software_collections:2::el7","package":"ror40-rubygem-actionpack-doc","fixed_in":["1:4.0.2-8.el7"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_software_collections:2::el6","package":"ruby193-rubygem-actionpack","fixed_in":["1:3.2.8-20.el6"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_software_collections:2::el6","package":"ruby193-rubygem-actionpack-doc","fixed_in":["1:3.2.8-20.el6"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_software_collections:2::el7","package":"ruby193-rubygem-actionpack","fixed_in":["1:3.2.8-20.el7"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_software_collections:2::el7","package":"ruby193-rubygem-actionpack-doc","fixed_in":["1:3.2.8-20.el7"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"RubyGems","package":"actionview","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.0.0"},{"last_affected":"3.2.22.2"},{"fixed":"3.2.22.3"}]}]},{"source":"ghsa","ecosystem":"RubyGems","package":"actionview","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.0.0"},{"last_affected":"4.2.7"},{"fixed":"4.2.7.1"}]}]},{"source":"ghsa","ecosystem":"RubyGems","package":"actionview","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.0.0"},{"last_affected":"5.0.0"},{"fixed":"5.0.0.1"}]}],"versions":["5.0.0"]},{"source":"osv","ecosystem":"Debian:12","package":"rails","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:4.2.7.1-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"rails","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:4.2.7.1-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"rails","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:4.2.7.1-1"}]}]},{"source":"osv","ecosystem":"Debian:7","package":"ruby-actionpack-3.2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.6-6+deb7u3"}]}],"versions":["3.2.6-6","3.2.6-6+deb7u1","3.2.6-6+deb7u2"],"bundled":6},{"source":"osv","ecosystem":"Debian:8","package":"rails","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:4.1.8-1+deb8u4"}]}],"versions":["2:4.1.8-1","2:4.1.8-1+deb8u1","2:4.1.8-1+deb8u2","2:4.1.8-1+deb8u3"]},{"source":"osv","ecosystem":"RubyGems","package":"actionview","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.0.0"},{"fixed":"3.2.22.3"}]}]},{"source":"osv","ecosystem":"RubyGems","package":"actionview","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.0.0"},{"fixed":"4.2.7.1"}]}],"versions":["4.1.0","4.1.0.beta1","4.1.0.beta2","4.1.0.rc1","4.1.0.rc2","4.1.1","4.1.10","4.1.10.rc1","4.1.10.rc2","4.1.10.rc3","4.1.10.rc4","4.1.11","4.1.12","4.1.12.rc1","4.1.13","4.1.13.rc1","4.1.14","4.1.14.1","4.1.14.2","4.1.14.rc1","4.1.14.rc2","4.1.15","4.1.15.rc1","4.1.16","4.1.16.rc1","4.1.2","4.1.2.rc1","4.1.2.rc2","4.1.2.rc3","4.1.3","4.1.4","4.1.5","4.1.6","4.1.6.rc1","4.1.6.rc2","4.1.7","4.1.7.1","4.1.8","4.1.9","4.1.9.rc1","4.2.0","4.2.0.beta1","4.2.0.beta2","4.2.0.beta3","4.2.0.beta4","4.2.0.rc1","4.2.0.rc2","4.2.0.rc3","4.2.1","4.2.1.rc1","4.2.1.rc2","4.2.1.rc3","4.2.1.rc4","4.2.2","4.2.3","4.2.3.rc1","4.2.4","4.2.4.rc1","4.2.5","4.2.5.1","4.2.5.2","4.2.5.rc1","4.2.5.rc2","4.2.6","4.2.6.rc1","4.2.7","4.2.7.rc1"]},{"source":"osv","ecosystem":"RubyGems","package":"actionview","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.0.0"},{"fixed":"5.0.0.1"}]}],"versions":["5.0.0"]},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:2::el7","package":"rh-ror42-rubygem-actionpack","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:4.2.6-3.el7"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:2::el7","package":"rh-ror42-rubygem-actionpack-doc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:4.2.6-3.el7"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:2::el7","package":"rh-ror42-rubygem-actionview","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.2.6-3.el7"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:2::el7","package":"rh-ror42-rubygem-actionview-doc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.2.6-3.el7"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:2::el7","package":"rh-ror42-rubygem-activerecord","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:4.2.6-3.el7"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:2::el7","package":"rh-ror42-rubygem-activerecord-doc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:4.2.6-3.el7"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:2::el6","package":"rh-ror41-rubygem-actionview","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.1.5-6.el6"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:2::el6","package":"rh-ror41-rubygem-actionview-doc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.1.5-6.el6"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:2::el7","package":"rh-ror41-rubygem-actionview","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.1.5-6.el7"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:2::el7","package":"rh-ror41-rubygem-actionview-doc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.1.5-6.el7"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:2::el6","package":"ror40-rubygem-actionpack","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:4.0.2-8.el6"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:2::el6","package":"ror40-rubygem-actionpack-doc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:4.0.2-8.el6"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:2::el7","package":"ror40-rubygem-actionpack","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:4.0.2-8.el7"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:2::el7","package":"ror40-rubygem-actionpack-doc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:4.0.2-8.el7"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:2::el6","package":"ruby193-rubygem-actionpack","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:3.2.8-20.el6"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:2::el6","package":"ruby193-rubygem-actionpack-doc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:3.2.8-20.el6"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:2::el7","package":"ruby193-rubygem-actionpack","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:3.2.8-20.el7"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:2::el7","package":"ruby193-rubygem-actionpack-doc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:3.2.8-20.el7"}]}]},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 6","package":"rubygem-actionmailer-4_2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2.9-3.3.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 6","package":"rubygem-actionpack-4_2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2.9-7.3.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 6","package":"rubygem-actionview-4_2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2.9-9.3.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 6","package":"rubygem-activejob-4_2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2.9-3.3.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 6","package":"rubygem-activemodel-4_2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2.9-6.3.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 6","package":"rubygem-activerecord-4_2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2.9-6.3.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 6","package":"rubygem-activesupport-4_2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2.9-7.3.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 6","package":"rubygem-rails-4_2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2.9-3.3.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 6","package":"rubygem-rails-html-sanitizer","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.3-8.3.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 6","package":"rubygem-railties-4_2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2.9-3.3.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 7","package":"rubygem-actionmailer-4_2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2.9-3.3.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 7","package":"rubygem-actionpack-4_2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2.9-7.3.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 7","package":"rubygem-actionview-4_2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2.9-9.3.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 7","package":"rubygem-activejob-4_2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2.9-3.3.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 7","package":"rubygem-activemodel-4_2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2.9-6.3.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 7","package":"rubygem-activerecord-4_2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2.9-6.3.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 7","package":"rubygem-activesupport-4_2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2.9-7.3.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 7","package":"rubygem-rails-4_2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2.9-3.3.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 7","package":"rubygem-rails-html-sanitizer","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.3-8.3.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 7","package":"rubygem-railties-4_2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2.9-3.3.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Enterprise Storage 3","package":"rubygem-actionmailer-4_2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2.9-3.3.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Enterprise Storage 3","package":"rubygem-actionpack-4_2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2.9-7.3.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Enterprise Storage 3","package":"rubygem-actionview-4_2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2.9-9.3.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Enterprise Storage 3","package":"rubygem-activejob-4_2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2.9-3.3.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Enterprise Storage 3","package":"rubygem-activemodel-4_2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2.9-6.3.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Enterprise Storage 3","package":"rubygem-activerecord-4_2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2.9-6.3.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Enterprise Storage 3","package":"rubygem-activesupport-4_2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2.9-7.3.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Enterprise Storage 3","package":"rubygem-rails-4_2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2.9-3.3.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Enterprise Storage 3","package":"rubygem-rails-html-sanitizer","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.3-8.3.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Enterprise Storage 3","package":"rubygem-railties-4_2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2.9-3.3.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Enterprise Storage 4","package":"rubygem-actionmailer-4_2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2.9-3.3.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Enterprise Storage 4","package":"rubygem-actionpack-4_2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2.9-7.3.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Enterprise Storage 4","package":"rubygem-actionview-4_2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2.9-9.3.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Enterprise Storage 4","package":"rubygem-activejob-4_2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2.9-3.3.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Enterprise Storage 4","package":"rubygem-activemodel-4_2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2.9-6.3.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Enterprise Storage 4","package":"rubygem-activerecord-4_2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2.9-6.3.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Enterprise Storage 4","package":"rubygem-activesupport-4_2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2.9-7.3.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Enterprise Storage 4","package":"rubygem-rails-4_2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2.9-3.3.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Enterprise Storage 4","package":"rubygem-rails-html-sanitizer","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.3-8.3.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Enterprise Storage 4","package":"rubygem-railties-4_2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2.9-3.3.1"}]}],"bundled":3}],"products":[{"vendor":"debian","product":"debian_linux"},{"vendor":"rubyonrails","product":"rails"},{"vendor":"rubyonrails","product":"ruby_on_rails"}],"references":[{"url":"http://rhn.redhat.com/errata/RHSA-2016-1856.html","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred","advisory","web"]},{"url":"https://puppet.com/security/cve/cve-2016-6316","tags":["x_refsource_CONFIRM","x_transferred","web"]},{"url":"http://www.securityfocus.com/bid/92430","tags":["vdb-entry","x_refsource_BID","x_transferred","web"]},{"url":"http://rhn.redhat.com/errata/RHSA-2016-1855.html","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred","advisory","web"]},{"url":"http://www.openwall.com/lists/oss-security/2016/08/11/3","tags":["mailing-list","x_refsource_MLIST","x_transferred","Third Party Advisory","advisory","web"]},{"url":"http://rhn.redhat.com/errata/RHSA-2016-1858.html","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred","advisory","web"]},{"url":"http://rhn.redhat.com/errata/RHSA-2016-1857.html","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred","advisory","web"]},{"url":"http://weblog.rubyonrails.org/2016/8/11/Rails-5-0-0-1-4-2-7-2-and-3-2-22-3-have-been-released/","tags":["x_refsource_CONFIRM","x_transferred","Release Notes","Vendor Advisory","advisory"]},{"url":"https://groups.google.com/forum/#%21topic/ruby-security-ann/8B2iV2tPRSE","tags":["mailing-list","x_refsource_MLIST","x_transferred","web"]},{"url":"http://www.debian.org/security/2016/dsa-3651","tags":["vendor-advisory","x_refsource_DEBIAN","x_transferred","Third Party Advisory","advisory","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2016-6316","tags":["advisory"]},{"url":"https://groups.google.com/forum/#!topic/ruby-security-ann/8B2iV2tPRSE","tags":["web"]},{"url":"https://web.archive.org/web/20200227202008/http://www.securityfocus.com/bid/92430","tags":["web"]},{"url":"https://web.archive.org/web/20200812154343/https://puppet.com/security/cve/cve-2016-6316","tags":["web"]},{"url":"https://github.com/rubysec/ruby-advisory-db/blob/master/gems/actionpack/CVE-2016-6316.yml","tags":["web"]},{"url":"https://groups.google.com/forum/#!topic/rubyonrails-security/I-VWr034ouk","tags":["web"]},{"url":"https://github.com/advisories/GHSA-pc3m-v286-2jwj"},{"url":"https://security-tracker.debian.org/tracker/CVE-2016-6316","tags":["advisory"]},{"url":"http://weblog.rubyonrails.org/2016/8/11/Rails-5-0-0-1-4-2-7-2-and-3-2-22-3-have-been-released","tags":["web"]},{"url":"https://access.redhat.com/errata/RHSA-2016:1855","tags":["advisory"]},{"url":"https://access.redhat.com/security/updates/classification/#moderate","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1365008","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1365017","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2016/rhsa-2016_1855.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2016-6316","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2016-6316","tags":["advisory"]},{"url":"https://groups.google.com/forum/#!msg/rubyonrails-security/I-VWr034ouk/gGu2FrCwDAAJ","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2016-6317","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2016-6317","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2016-6317","tags":["advisory"]},{"url":"https://groups.google.com/forum/#!msg/rubyonrails-security/rgO20zYW33s/gmamLa-wDAAJ","tags":["article"]},{"url":"https://access.redhat.com/errata/RHSA-2016:1856","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2016/rhsa-2016_1856.json","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2016:1857","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2016/rhsa-2016_1857.json","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2016:1858","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2016/rhsa-2016_1858.json","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2017/suse-su-20172716-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1055962","tags":["report"]},{"url":"https://bugzilla.suse.com/968849","tags":["report"]},{"url":"https://bugzilla.suse.com/993302","tags":["report"]},{"url":"https://bugzilla.suse.com/993313","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2016-2098","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-6316","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-6317","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2016-6316","description":"Cross-site scripting (XSS) vulnerability in Action View in Ruby on Rails 3.x before 3.2.22.3, 4.x before 4.2.7.1, and 5.x before 5.0.0.1 might allow remote attackers to inject arbitrary web script or HTML via text declared as \"HTML safe\" and used as attribute values in tag handlers.","status":"published","published":"2016-09-07T19:00:00Z","modified":"2024-08-06T01:29:18.216Z","updated_at":"2026-11-02T14:33:34.815789Z"}],"euvd":[{"id":"EUVD-2017-0281","description":"Cross-site scripting (XSS) vulnerability in Action View in Ruby on Rails 3.x before 3.2.22.3, 4.x before 4.2.7.1, and 5.x before 5.0.0.1 might allow remote attackers to inject arbitrary web script or HTML via text declared as \"HTML safe\" and used as attribute values in tag handlers.","status":"published","published":"2016-09-07T19:00:00Z","modified":"2024-08-06T01:29:18Z","updated_at":"2026-11-03T02:22:39.91691Z"}],"ghsa":[{"id":"GHSA-pc3m-v286-2jwj","title":"actionview Cross-site Scripting vulnerability","description":"Cross-site scripting (XSS) vulnerability in Action View in Ruby on Rails 3.x before 3.2.22.3, 4.x before 4.2.7.1, and 5.x before 5.0.0.1 might allow remote attackers to inject arbitrary web script or HTML via text declared as \"HTML safe\" and used as attribute values in tag handlers.","status":"published","published":"2017-10-24T18:33:35Z","modified":"2023-11-06T05:05:11Z","cvss":[{"version":"3.0","score":6.1,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:37:14.234712Z"}],"nvd":[{"id":"CVE-2016-6316","description":"Cross-site scripting (XSS) vulnerability in Action View in Ruby on Rails 3.x before 3.2.22.3, 4.x before 4.2.7.1, and 5.x before 5.0.0.1 might allow remote attackers to inject arbitrary web script or HTML via text declared as \"HTML safe\" and used as attribute values in tag handlers.","status":"published","published":"2016-09-07T19:28:10.067Z","modified":"2026-06-17T00:50:48.897Z","cvss":[{"version":"3.0","score":6.1,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium","assessor":"primary"},{"version":"2.0","score":4.3,"vector":"AV:N/AC:M/Au:N/C:N/I:P/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:03:29.893676Z"}],"osv":[{"id":"CVE-2016-6316","description":"Cross-site scripting (XSS) vulnerability in Action View in Ruby on Rails 3.x before 3.2.22.3, 4.x before 4.2.7.1, and 5.x before 5.0.0.1 might allow remote attackers to inject arbitrary web script or HTML via text declared as \"HTML safe\" and used as attribute values in tag handlers.","status":"published","published":"2016-09-07T19:28:10.067Z","modified":"2026-10-24T10:30:33.882594028Z","cvss":[{"version":"3.0","score":6.1,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T15:44:02.776224Z"},{"id":"DEBIAN-CVE-2016-6316","description":"Cross-site scripting (XSS) vulnerability in Action View in Ruby on Rails 3.x before 3.2.22.3, 4.x before 4.2.7.1, and 5.x before 5.0.0.1 might allow remote attackers to inject arbitrary web script or HTML via text declared as \"HTML safe\" and used as attribute values in tag handlers.","status":"published","published":"2016-09-07T19:28:10.067Z","modified":"2026-09-22T07:02:09.898007037Z","cvss":[{"version":"3.0","score":6.1,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T15:45:27.910042Z"},{"id":"GHSA-pc3m-v286-2jwj","title":"actionview Cross-site Scripting vulnerability","description":"Cross-site scripting (XSS) vulnerability in Action View in Ruby on Rails 3.x before 3.2.22.3, 4.x before 4.2.7.1, and 5.x before 5.0.0.1 might allow remote attackers to inject arbitrary web script or HTML via text declared as \"HTML safe\" and used as attribute values in tag handlers.","status":"published","published":"2017-10-24T18:33:35Z","modified":"2024-02-20T05:28:07.186543Z","cvss":[{"version":"3.0","score":6.1,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T15:46:52.891208Z"},{"id":"RHSA-2016:1855","title":"Red Hat Security Advisory: rh-ror42 security update","status":"published","published":"2024-09-13T14:37:18Z","modified":"2026-06-29T10:13:43Z","cvss":[{"version":"3.0","score":6.1,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T15:53:03.734507Z"},{"id":"RHSA-2016:1856","title":"Red Hat Security Advisory: rh-ror41-rubygem-actionview security update","status":"published","published":"2024-09-13T11:05:16Z","modified":"2026-06-29T10:13:44Z","cvss":[{"version":"3.0","score":6.1,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T15:53:03.734507Z"},{"id":"RHSA-2016:1857","title":"Red Hat Security Advisory: ror40-rubygem-actionpack security update","status":"published","published":"2024-09-13T11:05:22Z","modified":"2026-06-29T10:13:44Z","cvss":[{"version":"3.0","score":6.1,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T15:53:03.734507Z"},{"id":"RHSA-2016:1858","title":"Red Hat Security Advisory: ruby193-rubygem-actionpack security update","status":"published","published":"2024-09-13T11:05:28Z","modified":"2026-06-29T10:13:45Z","cvss":[{"version":"3.0","score":6.1,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T15:53:03.734507Z"},{"id":"DLA-604-1","title":"ruby-actionpack-3.2 - security update","status":"published","published":"2016-08-28T00:00:00Z","modified":"2026-03-09T02:09:15.25132Z","updated_at":"2026-11-02T15:46:13.207219Z"},{"id":"DSA-3651-1","title":"rails - security update","status":"published","published":"2016-08-25T00:00:00Z","modified":"2026-03-09T01:20:19.994162Z","updated_at":"2026-11-02T15:46:16.199525Z"},{"id":"SUSE-SU-2017:2716-1","title":"Security update for the Ruby on Rails stack","description":"This update brings version 4.2.9 of the Ruby on Rails stack to provide the latest fixes and\nimprovements from upstream.\n\nThe following security issues have been fixed by upstream:\n\nrubygem-actionpack-4_2\n\n- CVE-2016-2098: Action Pack in Ruby on Rails allowed remote attackers to execute arbitrary Ruby code by leveraging\n  an application's unrestricted use of the render method (bsc#968849).\n\nrubygem-activerecord-4_2\n\n- CVE-2016-6317: Action Record did not properly consider differences in parameter handling between the Active Record\n  component and the JSON implementation, which allowed remote attackers to bypass intended database-query restrictions\n  and perform NULL checks or trigger missing WHERE clauses via a crafted request (bsc#993313).\n\nrubygem-actionview-4_2\n\n- CVE-2016-6316: Cross-site scripting (XSS) vulnerability in Action View might have allowed remote attackers to inject\n  arbitrary web script or HTML via text declared as 'HTML safe' and used as attribute values in tag handlers\n  (bsc#993302).\n\nAdditionally, the following packages have been updated to version 4.2.9:\n\n- rubygem-rails-4_2\n- rubygem-railties-4_2\n- rubygem-activesupport-4_2\n- rubygem-activerecord-4_2\n- rubygem-activejob-4_2\n- rubygem-actionview-4_2\n- rubygem-actionpack-4_2\n- rubygem-actionmailer-4_2","status":"published","published":"2017-10-12T12:43:34Z","modified":"2026-02-04T02:58:19.631348Z","updated_at":"2026-11-02T15:53:44.209561Z"}]}}