CVE-2016-0751
rubygem-actionpack: possible object leak and denial of service attack in Action Pack
Severity Score
7.5
*CVSS v3
Exploit Likelihood
*EPSS
Affected Versions
*CPE
Public Exploits
0
*Multiple Sources
Exploited in Wild
-
*KEV
Decision
-
*SSVC
Descriptions
actionpack/lib/action_dispatch/http/mime_type.rb in Action Pack in Ruby on Rails before 3.2.22.1, 4.0.x and 4.1.x before 4.1.14.1, 4.2.x before 4.2.5.1, and 5.x before 5.0.0.beta1.1 does not properly restrict use of the MIME type cache, which allows remote attackers to cause a denial of service (memory consumption) via a crafted HTTP Accept header.
actionpack/lib/action_dispatch/http/mime_type.rb en Action Pack en Ruby on Rails en versiones anteriores a 3.2.22.1, 4.0.x y 4.1.x en versiones anteriores a 4.1.14.1, 4.2.x en versiones anteriores a 4.2.5.1 y 5.x en versiones anteriores a 5.0.0.beta1.1 no restringe adecuadamente el uso de la caché de tipo MIME, lo que permite a atacantes remotos causar una denegación de servicio (consumo de memoria) a través de una cabecera HTTP Accept manipulada.
A flaw was found in the way the Action Pack component performed MIME type lookups. Since queries were cached in a global cache of MIME types, an attacker could use this flaw to grow the cache indefinitely, potentially resulting in a denial of service.
The rh-ror41 collection provides Ruby on Rails version 4.1. Ruby on Rails is a model-view-controller framework for web application development. The following issue was corrected in rubygem-actionpack and rubygem-actionview: A directory traversal flaw was found in the way the Action View component searched for templates for rendering. If an application passed untrusted input to the 'render' method, a remote, unauthenticated attacker could use this to render unexpected files and, possibly, execute arbitrary code.
*Credits:
N/A
CVSS Scores
Attack Vector
Attack Complexity
Privileges Required
User Interaction
Scope
Confidentiality
Integrity
Availability
Attack Vector
Attack Complexity
Authentication
Confidentiality
Integrity
Availability
Attack Vector
Attack Complexity
Authentication
Confidentiality
Integrity
Availability
* Common Vulnerability Scoring System
SSVC
- Decision:-
Exploitation
Automatable
Tech. Impact
* Organization's Worst-case Scenario
Timeline
- 2015-12-16 CVE Reserved
- 2016-02-01 CVE Published
- 2024-08-05 CVE Updated
- 2025-04-02 EPSS Updated
- ---------- Exploited in Wild
- ---------- KEV Due Date
- ---------- First Exploit
CWE
- CWE-399: Resource Management Errors
- CWE-770: Allocation of Resources Without Limits or Throttling
CAPEC
References (13)
| URL | Tag | Source |
|---|---|---|
| http://www.openwall.com/lists/oss-security/2016/01/25/9 | Mailing List |
|
| http://www.securityfocus.com/bid/81800 | Vdb Entry | |
| http://www.securitytracker.com/id/1034816 | Vdb Entry | |
| https://groups.google.com/forum/message/raw?msg=ruby-security-ann/9oLY_FCzvoc/5CDXbvpYEgAJ | Mailing List |
| URL | Date | SRC |
|---|
| URL | Date | SRC |
|---|
Affected Vendors, Products, and Versions
| Vendor | Product | Version | Other | Status | ||||||
|---|---|---|---|---|---|---|---|---|---|---|
| Vendor | Product | Version | Other | Status | <-- --> | Vendor | Product | Version | Other | Status |
| Rubyonrails Search vendor "Rubyonrails" | Rails Search vendor "Rubyonrails" for product "Rails" | 4.0.0 Search vendor "Rubyonrails" for product "Rails" and version "4.0.0" | - |
Affected
| ||||||
| Rubyonrails Search vendor "Rubyonrails" | Rails Search vendor "Rubyonrails" for product "Rails" | 4.0.0 Search vendor "Rubyonrails" for product "Rails" and version "4.0.0" | beta |
Affected
| ||||||
| Rubyonrails Search vendor "Rubyonrails" | Rails Search vendor "Rubyonrails" for product "Rails" | 4.0.0 Search vendor "Rubyonrails" for product "Rails" and version "4.0.0" | rc1 |
Affected
| ||||||
| Rubyonrails Search vendor "Rubyonrails" | Rails Search vendor "Rubyonrails" for product "Rails" | 4.0.0 Search vendor "Rubyonrails" for product "Rails" and version "4.0.0" | rc2 |
Affected
| ||||||
| Rubyonrails Search vendor "Rubyonrails" | Rails Search vendor "Rubyonrails" for product "Rails" | 4.0.1 Search vendor "Rubyonrails" for product "Rails" and version "4.0.1" | - |
Affected
| ||||||
| Rubyonrails Search vendor "Rubyonrails" | Rails Search vendor "Rubyonrails" for product "Rails" | 4.0.1 Search vendor "Rubyonrails" for product "Rails" and version "4.0.1" | rc1 |
Affected
| ||||||
| Rubyonrails Search vendor "Rubyonrails" | Rails Search vendor "Rubyonrails" for product "Rails" | 4.0.1 Search vendor "Rubyonrails" for product "Rails" and version "4.0.1" | rc2 |
Affected
| ||||||
| Rubyonrails Search vendor "Rubyonrails" | Rails Search vendor "Rubyonrails" for product "Rails" | 4.0.1 Search vendor "Rubyonrails" for product "Rails" and version "4.0.1" | rc3 |
Affected
| ||||||
| Rubyonrails Search vendor "Rubyonrails" | Rails Search vendor "Rubyonrails" for product "Rails" | 4.0.1 Search vendor "Rubyonrails" for product "Rails" and version "4.0.1" | rc4 |
Affected
| ||||||
| Rubyonrails Search vendor "Rubyonrails" | Rails Search vendor "Rubyonrails" for product "Rails" | 4.0.2 Search vendor "Rubyonrails" for product "Rails" and version "4.0.2" | - |
Affected
| ||||||
| Rubyonrails Search vendor "Rubyonrails" | Rails Search vendor "Rubyonrails" for product "Rails" | 4.0.3 Search vendor "Rubyonrails" for product "Rails" and version "4.0.3" | - |
Affected
| ||||||
| Rubyonrails Search vendor "Rubyonrails" | Rails Search vendor "Rubyonrails" for product "Rails" | 4.0.4 Search vendor "Rubyonrails" for product "Rails" and version "4.0.4" | - |
Affected
| ||||||
| Rubyonrails Search vendor "Rubyonrails" | Rails Search vendor "Rubyonrails" for product "Rails" | 4.0.5 Search vendor "Rubyonrails" for product "Rails" and version "4.0.5" | - |
Affected
| ||||||
| Rubyonrails Search vendor "Rubyonrails" | Rails Search vendor "Rubyonrails" for product "Rails" | 4.0.6 Search vendor "Rubyonrails" for product "Rails" and version "4.0.6" | - |
Affected
| ||||||
| Rubyonrails Search vendor "Rubyonrails" | Rails Search vendor "Rubyonrails" for product "Rails" | 4.0.6 Search vendor "Rubyonrails" for product "Rails" and version "4.0.6" | rc1 |
Affected
| ||||||
| Rubyonrails Search vendor "Rubyonrails" | Rails Search vendor "Rubyonrails" for product "Rails" | 4.0.6 Search vendor "Rubyonrails" for product "Rails" and version "4.0.6" | rc2 |
Affected
| ||||||
| Rubyonrails Search vendor "Rubyonrails" | Rails Search vendor "Rubyonrails" for product "Rails" | 4.0.6 Search vendor "Rubyonrails" for product "Rails" and version "4.0.6" | rc3 |
Affected
| ||||||
| Rubyonrails Search vendor "Rubyonrails" | Rails Search vendor "Rubyonrails" for product "Rails" | 4.0.7 Search vendor "Rubyonrails" for product "Rails" and version "4.0.7" | - |
Affected
| ||||||
| Rubyonrails Search vendor "Rubyonrails" | Rails Search vendor "Rubyonrails" for product "Rails" | 4.0.8 Search vendor "Rubyonrails" for product "Rails" and version "4.0.8" | - |
Affected
| ||||||
| Rubyonrails Search vendor "Rubyonrails" | Rails Search vendor "Rubyonrails" for product "Rails" | 4.0.9 Search vendor "Rubyonrails" for product "Rails" and version "4.0.9" | - |
Affected
| ||||||
| Rubyonrails Search vendor "Rubyonrails" | Rails Search vendor "Rubyonrails" for product "Rails" | 4.0.10 Search vendor "Rubyonrails" for product "Rails" and version "4.0.10" | - |
Affected
| ||||||
| Rubyonrails Search vendor "Rubyonrails" | Rails Search vendor "Rubyonrails" for product "Rails" | 4.0.10 Search vendor "Rubyonrails" for product "Rails" and version "4.0.10" | rc1 |
Affected
| ||||||
| Rubyonrails Search vendor "Rubyonrails" | Rails Search vendor "Rubyonrails" for product "Rails" | 4.1.0 Search vendor "Rubyonrails" for product "Rails" and version "4.1.0" | - |
Affected
| ||||||
| Rubyonrails Search vendor "Rubyonrails" | Rails Search vendor "Rubyonrails" for product "Rails" | 4.1.0 Search vendor "Rubyonrails" for product "Rails" and version "4.1.0" | beta1 |
Affected
| ||||||
| Rubyonrails Search vendor "Rubyonrails" | Rails Search vendor "Rubyonrails" for product "Rails" | 4.1.1 Search vendor "Rubyonrails" for product "Rails" and version "4.1.1" | - |
Affected
| ||||||
| Rubyonrails Search vendor "Rubyonrails" | Rails Search vendor "Rubyonrails" for product "Rails" | 4.1.2 Search vendor "Rubyonrails" for product "Rails" and version "4.1.2" | - |
Affected
| ||||||
| Rubyonrails Search vendor "Rubyonrails" | Rails Search vendor "Rubyonrails" for product "Rails" | 4.1.2 Search vendor "Rubyonrails" for product "Rails" and version "4.1.2" | rc1 |
Affected
| ||||||
| Rubyonrails Search vendor "Rubyonrails" | Rails Search vendor "Rubyonrails" for product "Rails" | 4.1.2 Search vendor "Rubyonrails" for product "Rails" and version "4.1.2" | rc2 |
Affected
| ||||||
| Rubyonrails Search vendor "Rubyonrails" | Rails Search vendor "Rubyonrails" for product "Rails" | 4.1.2 Search vendor "Rubyonrails" for product "Rails" and version "4.1.2" | rc3 |
Affected
| ||||||
| Rubyonrails Search vendor "Rubyonrails" | Rails Search vendor "Rubyonrails" for product "Rails" | 4.1.3 Search vendor "Rubyonrails" for product "Rails" and version "4.1.3" | - |
Affected
| ||||||
| Rubyonrails Search vendor "Rubyonrails" | Rails Search vendor "Rubyonrails" for product "Rails" | 4.1.4 Search vendor "Rubyonrails" for product "Rails" and version "4.1.4" | - |
Affected
| ||||||
| Rubyonrails Search vendor "Rubyonrails" | Rails Search vendor "Rubyonrails" for product "Rails" | 4.1.5 Search vendor "Rubyonrails" for product "Rails" and version "4.1.5" | - |
Affected
| ||||||
| Rubyonrails Search vendor "Rubyonrails" | Rails Search vendor "Rubyonrails" for product "Rails" | 4.1.6 Search vendor "Rubyonrails" for product "Rails" and version "4.1.6" | rc1 |
Affected
| ||||||
| Rubyonrails Search vendor "Rubyonrails" | Rails Search vendor "Rubyonrails" for product "Rails" | 4.1.7 Search vendor "Rubyonrails" for product "Rails" and version "4.1.7" | - |
Affected
| ||||||
| Rubyonrails Search vendor "Rubyonrails" | Rails Search vendor "Rubyonrails" for product "Rails" | 4.1.8 Search vendor "Rubyonrails" for product "Rails" and version "4.1.8" | - |
Affected
| ||||||
| Rubyonrails Search vendor "Rubyonrails" | Rails Search vendor "Rubyonrails" for product "Rails" | 4.1.9 Search vendor "Rubyonrails" for product "Rails" and version "4.1.9" | - |
Affected
| ||||||
| Rubyonrails Search vendor "Rubyonrails" | Rails Search vendor "Rubyonrails" for product "Rails" | 4.1.10 Search vendor "Rubyonrails" for product "Rails" and version "4.1.10" | - |
Affected
| ||||||
| Rubyonrails Search vendor "Rubyonrails" | Rails Search vendor "Rubyonrails" for product "Rails" | 4.1.12 Search vendor "Rubyonrails" for product "Rails" and version "4.1.12" | - |
Affected
| ||||||
| Rubyonrails Search vendor "Rubyonrails" | Rails Search vendor "Rubyonrails" for product "Rails" | 4.1.13 Search vendor "Rubyonrails" for product "Rails" and version "4.1.13" | - |
Affected
| ||||||
| Rubyonrails Search vendor "Rubyonrails" | Rails Search vendor "Rubyonrails" for product "Rails" | 4.2.0 Search vendor "Rubyonrails" for product "Rails" and version "4.2.0" | beta1 |
Affected
| ||||||
| Rubyonrails Search vendor "Rubyonrails" | Rails Search vendor "Rubyonrails" for product "Rails" | 4.2.0 Search vendor "Rubyonrails" for product "Rails" and version "4.2.0" | beta2 |
Affected
| ||||||
| Rubyonrails Search vendor "Rubyonrails" | Rails Search vendor "Rubyonrails" for product "Rails" | 4.2.0 Search vendor "Rubyonrails" for product "Rails" and version "4.2.0" | beta3 |
Affected
| ||||||
| Rubyonrails Search vendor "Rubyonrails" | Rails Search vendor "Rubyonrails" for product "Rails" | 4.2.0 Search vendor "Rubyonrails" for product "Rails" and version "4.2.0" | beta4 |
Affected
| ||||||
| Rubyonrails Search vendor "Rubyonrails" | Rails Search vendor "Rubyonrails" for product "Rails" | 4.2.0 Search vendor "Rubyonrails" for product "Rails" and version "4.2.0" | rc1 |
Affected
| ||||||
| Rubyonrails Search vendor "Rubyonrails" | Rails Search vendor "Rubyonrails" for product "Rails" | 4.2.0 Search vendor "Rubyonrails" for product "Rails" and version "4.2.0" | rc2 |
Affected
| ||||||
| Rubyonrails Search vendor "Rubyonrails" | Rails Search vendor "Rubyonrails" for product "Rails" | 4.2.0 Search vendor "Rubyonrails" for product "Rails" and version "4.2.0" | rc3 |
Affected
| ||||||
| Rubyonrails Search vendor "Rubyonrails" | Rails Search vendor "Rubyonrails" for product "Rails" | 4.2.1 Search vendor "Rubyonrails" for product "Rails" and version "4.2.1" | - |
Affected
| ||||||
| Rubyonrails Search vendor "Rubyonrails" | Rails Search vendor "Rubyonrails" for product "Rails" | 4.2.1 Search vendor "Rubyonrails" for product "Rails" and version "4.2.1" | rc1 |
Affected
| ||||||
| Rubyonrails Search vendor "Rubyonrails" | Rails Search vendor "Rubyonrails" for product "Rails" | 4.2.1 Search vendor "Rubyonrails" for product "Rails" and version "4.2.1" | rc2 |
Affected
| ||||||
| Rubyonrails Search vendor "Rubyonrails" | Rails Search vendor "Rubyonrails" for product "Rails" | 4.2.1 Search vendor "Rubyonrails" for product "Rails" and version "4.2.1" | rc3 |
Affected
| ||||||
| Rubyonrails Search vendor "Rubyonrails" | Rails Search vendor "Rubyonrails" for product "Rails" | 4.2.1 Search vendor "Rubyonrails" for product "Rails" and version "4.2.1" | rc4 |
Affected
| ||||||
| Rubyonrails Search vendor "Rubyonrails" | Rails Search vendor "Rubyonrails" for product "Rails" | 4.2.2 Search vendor "Rubyonrails" for product "Rails" and version "4.2.2" | - |
Affected
| ||||||
| Rubyonrails Search vendor "Rubyonrails" | Rails Search vendor "Rubyonrails" for product "Rails" | 4.2.3 Search vendor "Rubyonrails" for product "Rails" and version "4.2.3" | - |
Affected
| ||||||
| Rubyonrails Search vendor "Rubyonrails" | Rails Search vendor "Rubyonrails" for product "Rails" | 4.2.3 Search vendor "Rubyonrails" for product "Rails" and version "4.2.3" | rc1 |
Affected
| ||||||
| Rubyonrails Search vendor "Rubyonrails" | Rails Search vendor "Rubyonrails" for product "Rails" | 4.2.4 Search vendor "Rubyonrails" for product "Rails" and version "4.2.4" | - |
Affected
| ||||||
| Rubyonrails Search vendor "Rubyonrails" | Rails Search vendor "Rubyonrails" for product "Rails" | 4.2.4 Search vendor "Rubyonrails" for product "Rails" and version "4.2.4" | rc1 |
Affected
| ||||||
| Rubyonrails Search vendor "Rubyonrails" | Rails Search vendor "Rubyonrails" for product "Rails" | 4.2.5 Search vendor "Rubyonrails" for product "Rails" and version "4.2.5" | - |
Affected
| ||||||
| Rubyonrails Search vendor "Rubyonrails" | Rails Search vendor "Rubyonrails" for product "Rails" | 4.2.5 Search vendor "Rubyonrails" for product "Rails" and version "4.2.5" | rc1 |
Affected
| ||||||
| Rubyonrails Search vendor "Rubyonrails" | Rails Search vendor "Rubyonrails" for product "Rails" | 4.2.5 Search vendor "Rubyonrails" for product "Rails" and version "4.2.5" | rc2 |
Affected
| ||||||
| Rubyonrails Search vendor "Rubyonrails" | Rails Search vendor "Rubyonrails" for product "Rails" | 5.0.0 Search vendor "Rubyonrails" for product "Rails" and version "5.0.0" | beta1 |
Affected
| ||||||
| Rubyonrails Search vendor "Rubyonrails" | Ruby On Rails Search vendor "Rubyonrails" for product "Ruby On Rails" | <= 3.2.22 Search vendor "Rubyonrails" for product "Ruby On Rails" and version " <= 3.2.22" | - |
Affected
| ||||||
| Rubyonrails Search vendor "Rubyonrails" | Ruby On Rails Search vendor "Rubyonrails" for product "Ruby On Rails" | 4.0.10 Search vendor "Rubyonrails" for product "Ruby On Rails" and version "4.0.10" | rc2 |
Affected
| ||||||
| Rubyonrails Search vendor "Rubyonrails" | Ruby On Rails Search vendor "Rubyonrails" for product "Ruby On Rails" | 4.0.11 Search vendor "Rubyonrails" for product "Ruby On Rails" and version "4.0.11" | - |
Affected
| ||||||
| Rubyonrails Search vendor "Rubyonrails" | Ruby On Rails Search vendor "Rubyonrails" for product "Ruby On Rails" | 4.0.11.1 Search vendor "Rubyonrails" for product "Ruby On Rails" and version "4.0.11.1" | - |
Affected
| ||||||
| Rubyonrails Search vendor "Rubyonrails" | Ruby On Rails Search vendor "Rubyonrails" for product "Ruby On Rails" | 4.0.12 Search vendor "Rubyonrails" for product "Ruby On Rails" and version "4.0.12" | - |
Affected
| ||||||
| Rubyonrails Search vendor "Rubyonrails" | Ruby On Rails Search vendor "Rubyonrails" for product "Ruby On Rails" | 4.0.13 Search vendor "Rubyonrails" for product "Ruby On Rails" and version "4.0.13" | - |
Affected
| ||||||
| Rubyonrails Search vendor "Rubyonrails" | Ruby On Rails Search vendor "Rubyonrails" for product "Ruby On Rails" | 4.0.13 Search vendor "Rubyonrails" for product "Ruby On Rails" and version "4.0.13" | rc1 |
Affected
| ||||||
| Rubyonrails Search vendor "Rubyonrails" | Ruby On Rails Search vendor "Rubyonrails" for product "Ruby On Rails" | 4.1.11 Search vendor "Rubyonrails" for product "Ruby On Rails" and version "4.1.11" | - |
Affected
| ||||||