Gentoo Websites Logo
Go to: Gentoo Home Documentation Forums Lists Bugs Planet Store Wiki Get Gentoo!

Bug 495220

Summary: <dev-ruby/will_paginate-3.0.5: Cross-Site Scripting Vulnerabilities (CVE-2013-6459)
Product: Gentoo Security Reporter: Agostino Sarubbo <ago>
Component: VulnerabilitiesAssignee: Gentoo Security <security>
Status: RESOLVED FIXED    
Severity: trivial CC: ruby
Priority: Normal    
Version: unspecified   
Hardware: All   
OS: Linux   
URL: https://secunia.com/advisories/56180/
Whiteboard: ~4 [noglsa]
Package list:
Runtime testing required: ---

Description Agostino Sarubbo gentoo-dev 2013-12-24 11:53:59 UTC
From ${URL} :

Description

Some vulnerabilities have been reported in the will_paginate gem for Ruby, which can be exploited 
by malicious people to conduct cross-site scripting attacks.

Certain input related to generated pagination links is not properly sanitised before being returned 
to the user. This can be exploited to execute arbitrary HTML and script code in a user's browser 
session in context of an affected site.

The vulnerabilities are reported in version prior to 3.0.5.


Solution:
Update to version 3.0.5.

Further details available to Secunia VIM customers

Provided and/or discovered by:
Reported by the vendor.

Original Advisory:
https://github.com/mislav/will_paginate/releases/tag/v3.0.5
Comment 1 Hans de Graaff gentoo-dev Security 2013-12-24 13:50:12 UTC
will_paginate 3.0.5 is already in the tree for a few months, and I've just remove the older vulnerable versions.

No stable versions.
Comment 2 Chris Reffett (RETIRED) gentoo-dev Security 2013-12-24 14:05:26 UTC
Thank you much, closing noglsa.
Comment 3 GLSAMaker/CVETool Bot gentoo-dev 2014-01-05 02:51:03 UTC
CVE-2013-6459 (http://nvd.nist.gov/nvd.cfm?cvename=CVE-2013-6459):
  Cross-site scripting (XSS) vulnerability in the will_paginate gem before
  3.0.5 for Ruby allows remote attackers to inject arbitrary web script or
  HTML via vectors involving generated pagination links.