Gentoo Websites Logo
Go to: Gentoo Home Documentation Forums Lists Bugs Planet Store Wiki Get Gentoo!
Bug 495220 - <dev-ruby/will_paginate-3.0.5: Cross-Site Scripting Vulnerabilities (CVE-2013-6459)
Summary: <dev-ruby/will_paginate-3.0.5: Cross-Site Scripting Vulnerabilities (CVE-2013...
Alias: None
Product: Gentoo Security
Classification: Unclassified
Component: Vulnerabilities (show other bugs)
Hardware: All Linux
: Normal trivial (vote)
Assignee: Gentoo Security
Whiteboard: ~4 [noglsa]
Depends on:
Reported: 2013-12-24 11:53 UTC by Agostino Sarubbo
Modified: 2014-01-05 02:51 UTC (History)
1 user (show)

See Also:
Package list:
Runtime testing required: ---


Note You need to log in before you can comment on or make changes to this bug.
Description Agostino Sarubbo gentoo-dev 2013-12-24 11:53:59 UTC
From ${URL} :


Some vulnerabilities have been reported in the will_paginate gem for Ruby, which can be exploited 
by malicious people to conduct cross-site scripting attacks.

Certain input related to generated pagination links is not properly sanitised before being returned 
to the user. This can be exploited to execute arbitrary HTML and script code in a user's browser 
session in context of an affected site.

The vulnerabilities are reported in version prior to 3.0.5.

Update to version 3.0.5.

Further details available to Secunia VIM customers

Provided and/or discovered by:
Reported by the vendor.

Original Advisory:
Comment 1 Hans de Graaff gentoo-dev 2013-12-24 13:50:12 UTC
will_paginate 3.0.5 is already in the tree for a few months, and I've just remove the older vulnerable versions.

No stable versions.
Comment 2 Chris Reffett (RETIRED) gentoo-dev Security 2013-12-24 14:05:26 UTC
Thank you much, closing noglsa.
Comment 3 GLSAMaker/CVETool Bot gentoo-dev 2014-01-05 02:51:03 UTC
CVE-2013-6459 (
  Cross-site scripting (XSS) vulnerability in the will_paginate gem before
  3.0.5 for Ruby allows remote attackers to inject arbitrary web script or
  HTML via vectors involving generated pagination links.