Vulnerability Details CVE-2013-4389
Multiple format string vulnerabilities in log_subscriber.rb files in the log subscriber component in Action Mailer in Ruby on Rails 3.x before 3.2.15 allow remote attackers to cause a denial of service via a crafted e-mail address that is improperly handled during construction of a log message.
Exploit prediction scoring system (EPSS) score
EPSS Score 0.013
EPSS Ranking 78.9%
CVSS Severity
CVSS v2 Score 4.3
References
- http://lists.opensuse.org/opensuse-updates/2013-12/msg00091.html
- http://lists.opensuse.org/opensuse-updates/2013-12/msg00094.html
- http://lists.opensuse.org/opensuse-updates/2014-01/msg00003.html
- http://www.debian.org/security/2014/dsa-2887
- http://www.debian.org/security/2014/dsa-2888
- https://groups.google.com/forum/message/raw?msg=ruby-security-ann/yvlR1Vx44c8/elKJkpO2KVgJ
- http://lists.opensuse.org/opensuse-updates/2013-12/msg00091.html
- http://lists.opensuse.org/opensuse-updates/2013-12/msg00094.html
- http://lists.opensuse.org/opensuse-updates/2014-01/msg00003.html
- http://www.debian.org/security/2014/dsa-2887
- http://www.debian.org/security/2014/dsa-2888
- https://groups.google.com/forum/message/raw?msg=ruby-security-ann/yvlR1Vx44c8/elKJkpO2KVgJ
Products affected by CVE-2013-4389
-
cpe:2.3:a:rubyonrails:rails:3.0.0
-
cpe:2.3:a:rubyonrails:rails:3.0.1
-
cpe:2.3:a:rubyonrails:rails:3.0.10
-
cpe:2.3:a:rubyonrails:rails:3.0.11
-
cpe:2.3:a:rubyonrails:rails:3.0.12
-
cpe:2.3:a:rubyonrails:rails:3.0.13
-
cpe:2.3:a:rubyonrails:rails:3.0.14
-
cpe:2.3:a:rubyonrails:rails:3.0.15
-
cpe:2.3:a:rubyonrails:rails:3.0.16
-
cpe:2.3:a:rubyonrails:rails:3.0.17
-
cpe:2.3:a:rubyonrails:rails:3.0.18
-
cpe:2.3:a:rubyonrails:rails:3.0.19
-
cpe:2.3:a:rubyonrails:rails:3.0.2
-
cpe:2.3:a:rubyonrails:rails:3.0.20
-
cpe:2.3:a:rubyonrails:rails:3.0.3
-
cpe:2.3:a:rubyonrails:rails:3.0.4
-
cpe:2.3:a:rubyonrails:rails:3.0.5
-
cpe:2.3:a:rubyonrails:rails:3.0.6
-
cpe:2.3:a:rubyonrails:rails:3.0.7
-
cpe:2.3:a:rubyonrails:rails:3.0.8
-
cpe:2.3:a:rubyonrails:rails:3.0.9
-
cpe:2.3:a:rubyonrails:rails:3.1.0
-
cpe:2.3:a:rubyonrails:rails:3.1.1
-
cpe:2.3:a:rubyonrails:rails:3.1.10
-
cpe:2.3:a:rubyonrails:rails:3.1.11
-
cpe:2.3:a:rubyonrails:rails:3.1.12
-
cpe:2.3:a:rubyonrails:rails:3.1.2
-
cpe:2.3:a:rubyonrails:rails:3.1.3
-
cpe:2.3:a:rubyonrails:rails:3.1.4
-
cpe:2.3:a:rubyonrails:rails:3.1.5
-
cpe:2.3:a:rubyonrails:rails:3.1.6
-
cpe:2.3:a:rubyonrails:rails:3.1.7
-
cpe:2.3:a:rubyonrails:rails:3.1.8
-
cpe:2.3:a:rubyonrails:rails:3.1.9
-
cpe:2.3:a:rubyonrails:rails:3.2.0
-
cpe:2.3:a:rubyonrails:rails:3.2.1
-
cpe:2.3:a:rubyonrails:rails:3.2.10
-
cpe:2.3:a:rubyonrails:rails:3.2.11
-
cpe:2.3:a:rubyonrails:rails:3.2.12
-
cpe:2.3:a:rubyonrails:rails:3.2.13
-
cpe:2.3:a:rubyonrails:rails:3.2.14
-
cpe:2.3:a:rubyonrails:rails:3.2.2
-
cpe:2.3:a:rubyonrails:rails:3.2.3
-
cpe:2.3:a:rubyonrails:rails:3.2.4
-
cpe:2.3:a:rubyonrails:rails:3.2.5
-
cpe:2.3:a:rubyonrails:rails:3.2.6
-
cpe:2.3:a:rubyonrails:rails:3.2.7
-
cpe:2.3:a:rubyonrails:rails:3.2.8
-
cpe:2.3:a:rubyonrails:rails:3.2.9
-
cpe:2.3:o:debian:debian_linux:7.0
-
cpe:2.3:o:opensuse:opensuse:12.2
-
cpe:2.3:o:opensuse:opensuse:12.3
-
cpe:2.3:o:opensuse:opensuse:13.1