Upstream information
Description
Cross-site scripting (XSS) vulnerability in the strip_tags function in Ruby on Rails before 2.2.s, and 2.3.x before 2.3.5, allows remote attackers to inject arbitrary web script or HTML via vectors involving non-printing ASCII characters, related to HTML::Tokenizer and actionpack/lib/action_controller/vendor/html-scanner/html/node.rb.NVD CVSS v2 Base Score: 4.3 (AV:N/AC:M/Au:N/C:N/I:P/A:N)
Novell/SUSE information
Novell Bugzilla entry: 558879 SUSE Security Advisories:- SUSE-SR:2010:005, published Tue, 23 Feb 2010 14:00:00 +0000
- SUSE-SR:2010:006, published Mon, 15 Mar 2010 11:11:00 +0000
- openSUSE-SU-2010:0186-1, published Fri, 16 Apr 2010 16:11:59 +0200 (CEST)
List of released packages
| Product(s) | Fixed package version(s) | References |
|---|---|---|
| SUSE Linux Enterprise SDK 11 GA |
| sle11-sdk.ia64 sle11-sdk.x86-64 sle11-sdk.s390x sle11-sdk.x86 sle11-sdk.ppc SAT Patch Nr: 1936 |
| openSUSE 11.0 |
| |
| openSUSE 11.1 |
| |
| openSUSE 11.2 |
| |
| SUSE Linux Enterprise SDK 10 SP2 |
| sle10-sp2-sdk.x86 sle10-sp2-sdk.s390x sle10-sp2-sdk.ia64 sle10-sp2-sdk.x86-64 sle10-sp2-sdk.ppc ZYPP Patch Nr: 6872 |
| SUSE Lifecycle Management Server SUSE Studio Onsite SUSE Webyast |
| slms1.x86-64 SAT Patch Nr: 2001 |
| SUSE Linux Enterprise SDK 10 SP3 |
| sle10-sp3-sdk.ia64 sle10-sp3-sdk.ppc sle10-sp3-sdk.x86 sle10-sp3-sdk.s390x sle10-sp3-sdk.x86-64 ZYPP Patch Nr: 6874 |
| SUSE Linux Enterprise SDK 10 SP2 |
| sle10-sp2-sdk.x86-64 sle10-sp2-sdk.x86 sle10-sp2-sdk.ppc sle10-sp2-sdk.s390x sle10-sp2-sdk.ia64 ZYPP Patch Nr: 6877 |
| openSUSE 11.2 |
| |
| SUSE Linux Enterprise SDK 10 SP3 |
| sle10-sp3-sdk.x86 sle10-sp3-sdk.ppc sle10-sp3-sdk.ia64 sle10-sp3-sdk.s390x sle10-sp3-sdk.x86-64 ZYPP Patch Nr: 6878 |