Red Hat Security Advisory

RHSA-2014:0215

cfme security, bug fix, and enhancement update

Released 2014-03-11 · Red Hat rating Critical · View on Red Hat →

Fixed in

Management Engine cfme-5.2.2.3-1.el6cf, cfme-appliance-5.2.2.3-1.el6cf, cfme-lib-5.2.2.3-1.el6cf +20

Fixes 5 records

TI-2013-03637 CVE-2013-4164 · GHSA-j98q-m2w8-57rc

Heap-based buffer overflow in Ruby 1.8, 1.9 before 1.9.3-p484, 2.0 before 2.0.0-p353, 2.1…

MEDIUM 56

Heap-based buffer overflow in Ruby 1.8, 1.9 before 1.9.3-p484, 2.0 before 2.0.0-p353, 2.1 before 2.1.0 preview2, and trunk before revision 43780 allows context-dependent attackers to cause a denial of service (segmentati…

CVSS 2.0MEDIUM 6.8 Network No auth Interaction — EPSS 0.34968 Published 2013-11-23 Partial fix CWE-119

TI-2014-00053 CVE-2014-0057 · GHSA-6m4c-55qp-f477

The x_button method in the ServiceController (vmdb/app/controllers/service_controller.rb)…

LOW 36

The x_button method in the ServiceController (vmdb/app/controllers/service_controller.rb) in Red Hat CloudForms 3.0 Management Engine 5.2 allows remote attackers to execute arbitrary methods via unspecified vectors.

CVSS 2.0HIGH 7.5 Network No auth Interaction — EPSS 0.01587 Published 2014-03-18 Fixed CWE-94

TI-2014-00077 CVE-2014-0082 · GHSA-7cgp-c3g7-qvrw

actionpack/lib/action_view/template/text.rb in Action View in Ruby on Rails 3.x before…

LOW 32

actionpack/lib/action_view/template/text.rb in Action View in Ruby on Rails 3.x before 3.2.17 converts MIME type strings to symbols during use of the :text option to the render method, which allows remote attackers to ca…

CVSS 2.0MEDIUM 5.0 Network No auth Interaction — EPSS 0.06193 Published 2014-02-20 Partial fix · 3.2.17 CWE-20

TI-2013-00121 CVE-2013-0186 · GHSA-p5jr-6623-mc6j

Cross-site scripting in ManageIQ EVM

LOW 29

Multiple cross-site scripting (XSS) vulnerabilities in ManageIQ EVM allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00914 Published 2019-11-01 Fixed CWE-79

TI-2014-00076 CVE-2014-0081 · GHSA-m46p-ggm5-5j83

Multiple cross-site scripting (XSS) vulnerabilities in…

LOW 27

Multiple cross-site scripting (XSS) vulnerabilities in actionview/lib/action_view/helpers/number_helper.rb in Ruby on Rails before 3.2.17, 4.0.x before 4.0.3, and 4.1.x before 4.1.0.beta2 allow remote attackers to inject…

CVSS 2.0MEDIUM 4.3 Network No auth Interaction — EPSS 0.04032 Published 2014-02-20 Partial fix · 3.2.17, 4.0.3 CWE-79