Candidate: CVE-2015-7578
PublicDate: 2016-02-16 02:59:00 UTC
References:
 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-7578
 https://marc.info/?l=oss-security&m=145375052028672&w=2
Description:
 Cross-site scripting (XSS) vulnerability in the rails-html-sanitizer gem
 before 1.0.3 for Ruby on Rails 4.2.x and 5.x allows remote attackers to
 inject arbitrary web script or HTML via crafted tag attributes.
Ubuntu-Description:
Notes:
Bugs:
Priority: medium
Discovered-by: Ben Murphy
Assigned-to:
CVSS:
 nvd: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N [6.1 MEDIUM]

Patches_ruby-rails-html-sanitizer:
 upstream: https://marc.info/?l=oss-security&m=145375052028672&w=2
upstream_ruby-rails-html-sanitizer: released (1.0.3)
precise_ruby-rails-html-sanitizer: DNE
precise/esm_ruby-rails-html-sanitizer: DNE
trusty_ruby-rails-html-sanitizer: DNE
trusty/esm_ruby-rails-html-sanitizer: DNE
vivid_ruby-rails-html-sanitizer: DNE
vivid/stable-phone-overlay_ruby-rails-html-sanitizer: DNE
vivid/ubuntu-core_ruby-rails-html-sanitizer: DNE
wily_ruby-rails-html-sanitizer: ignored (reached end-of-life)
xenial_ruby-rails-html-sanitizer: not-affected (1.0.3-2)
yakkety_ruby-rails-html-sanitizer: ignored (reached end-of-life)
zesty_ruby-rails-html-sanitizer: ignored (reached end-of-life)
artful_ruby-rails-html-sanitizer: ignored (reached end-of-life)
bionic_ruby-rails-html-sanitizer: not-affected (1.0.3-2)
cosmic_ruby-rails-html-sanitizer: not-affected (1.0.3-2)
devel_ruby-rails-html-sanitizer: not-affected (1.0.3-2)