Charlie Somerville

A heap-based buffer overflow issue allows context-dependent attackers to cause a denial of service and possibly execute arbitrary code via a string that is converted to a floating point value. This can be demonstrated using the `to f` method or `JSON.parse`.

The issue arises from the `sanitize css` method in the Action Pack component, which fails to properly handle newline characters. This oversight allows remote attackers to conduct cross-site scripting (XSS) attacks by crafting malicious CSS token sequences.

The issue allows remote attackers to conduct object-injection attacks and execute arbitrary code, or cause a denial of service involving nested XML entity references, by leveraging Action Pack support for YAML type conversion or Symbol type conversion. This is due to the improper restriction of casts of string values in the `active support/core ext/hash/conversions.rb` file.

The issue allows remote attackers to cause a denial of service by leveraging access to an application that uses a `with http digest` helper method. This is demonstrated by the `authenticate or request with http digest` method, which is affected by the `decode credentials` method converting Digest Authentication strings to symbols.