Ben Murphy

**Name of the Vulnerable Software and Affected Versions** Joyent SmartOS release-20170803-20170803T064301Z **Description** This issue allows local attackers to escalate privileges on vulnerable installations. An attacker must first obtain the ability to execute low-privileged code on the target system. The specific flaw exists within the DTrace DOF files due to the lack of proper validation of user-supplied data, which can result in a write past the end of an allocated object. This can be leveraged to execute code under the context of the host OS. **Recommendations** For Joyent SmartOS release-20170803-20170803T064301Z, at the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Joyent SmartOS version release-20170803-20170803T064301Z **Description** This issue allows local attackers to escalate privileges on vulnerable installations. An attacker must first obtain the ability to execute low-privileged code on the target system. The flaw exists within the `SMBIOC TREE RELE` ioctl, resulting from the lack of validating the existence of an object prior to performing operations on the object. This can be leveraged to execute code under the context of the host OS. **Recommendations** For Joyent SmartOS version release-20170803-20170803T064301Z, as a temporary workaround, consider disabling the `SMBIOC TREE RELE` ioctl until a patch is available. Restrict access to the vulnerable ioctl to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Joyent Smart Data Center versions prior to agentsshar@1.0.0-release-20160901-20160901T051624Z-g3fd5adf **Description** This issue allows remote attackers to execute arbitrary code on vulnerable installations. An attacker must first obtain the ability to execute low-privileged code on the target system. The flaw exists within the `docker API`, which does not properly validate user-supplied data, allowing for the upload of arbitrary files. An attacker can leverage this to execute arbitrary code under the context of root. **Recommendations** For versions prior to agentsshar@1.0.0-release-20160901-20160901T051624Z-g3fd5adf, consider disabling the `docker API` until a patch is available to prevent the upload of arbitrary files and mitigate the risk of arbitrary code execution. Restrict access to the `docker API` to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** Apple OS X versions prior to 10.11.5 **Description** The issue is caused by an integer overflow in the dtrace implementation in the kernel. This can be exploited by a remote attacker using a specially crafted application, allowing them to execute arbitrary code in a privileged context. **Recommendations** For Apple OS X versions prior to 10.11.5, update to version 10.11.5 or later to resolve the issue. As a temporary workaround, consider restricting the use of the dtrace framework until a patch is available.

**Name of the Vulnerable Software and Affected Versions** rails-html-sanitizer gem versions prior to 1.0.3 Ruby on Rails versions 4.2.x and 5.x **Description** The issue allows remote attackers to inject arbitrary web script or HTML via crafted tag attributes, which can lead to cross-site scripting (XSS) attacks. This occurs due to a vulnerability in the rails-html-sanitizer gem. **Recommendations** For rails-html-sanitizer gem versions prior to 1.0.3, update to version 1.0.3 or later to resolve the issue. For Ruby on Rails versions 4.2.x and 5.x, ensure the rails-html-sanitizer gem is updated to version 1.0.3 or later to mitigate the risk of XSS attacks.

**Name of the Vulnerable Software and Affected Versions** Web Console versions prior to 2.1.3 Ruby on Rails versions 3.x and 4.x **Description** The issue allows remote attackers to bypass the whitelisted ips protection mechanism via a crafted request. This is due to the improper restriction of X-Forwarded-For headers in determining a client's IP address. **Recommendations** For Web Console versions prior to 2.1.3, update to version 2.1.3 or later to resolve the issue. For Ruby on Rails versions 3.x and 4.x, ensure that Web Console is updated to a version that properly restricts the use of X-Forwarded-For headers. As a temporary workaround, consider restricting access to the `request.rb` file until a patch is available.

**Name of the Vulnerable Software and Affected Versions** Redis versions prior to 2.8.21 Redis versions 3.x prior to 3.0.2 **Description** The issue allows remote attackers to execute arbitrary Lua bytecode via the `eval` command. It is related to incorrect data type conversion in the deps/lua/src/ldo.c component of the Redis database management system. Exploitation of the issue may allow a remote attacker to execute arbitrary Lua bytecode using a specially crafted `eval` command. **Recommendations** For Redis versions prior to 2.8.21, update to version 2.8.21 or later. For Redis versions 3.x prior to 3.0.2, update to version 3.0.2 or later. As a temporary workaround, consider restricting access to the `eval` command until a patch is available.

**Name of the Vulnerable Software and Affected Versions** Puppet versions 2.7.x prior to 2.7.23 Puppet versions 3.2.x prior to 3.2.2 Puppet Enterprise versions prior to 2.8.2 **Description** The issue allows remote attackers to instantiate arbitrary Ruby classes and execute arbitrary code via a crafted REST API call, potentially leading to a breach of confidentiality, integrity, and availability of protected information. This can be exploited by an authenticated attacker. **Recommendations** For Puppet versions 2.7.x prior to 2.7.23, update to version 2.7.23 or later. For Puppet versions 3.2.x prior to 3.2.2, update to version 3.2.2 or later. For Puppet Enterprise versions prior to 2.8.2, update to version 2.8.2 or later.

**Name of the Vulnerable Software and Affected Versions** Ruby on Rails versions 3.0.x through 3.1.11 Ruby on Rails versions 3.2.x through 3.2.12 **Description** The issue allows remote attackers to read arbitrary files or cause a denial of service via vectors involving an external DTD or an external entity declaration in conjunction with an entity reference, due to the ActiveSupport::XmlMini JDOM backend not properly restricting the capabilities of the XML parser when JRuby is used. **Recommendations** For Ruby on Rails versions 3.0.x through 3.1.11, update to version 3.1.12 or later. For Ruby on Rails versions 3.2.x through 3.2.12, update to version 3.2.13 or later.

**Name of the Vulnerable Software and Affected Versions** Ruby on Rails versions 2.3.x through 2.3.17 Ruby on Rails versions 3.1.x through 3.1.11 Ruby on Rails versions 3.2.x through 3.2.12 **Description** The issue allows remote attackers to cause a denial of service via crafted input to a where method, due to the Active Record component processing certain queries by converting hash keys to symbols. **Recommendations** For Ruby on Rails versions 2.3.x through 2.3.17, update to version 2.3.18 or later. For Ruby on Rails versions 3.1.x through 3.1.11, update to version 3.1.12 or later. For Ruby on Rails versions 3.2.x through 3.2.12, update to version 3.2.13 or later.

**Name of the Vulnerable Software and Affected Versions** JSON gem versions prior to 1.5.5 JSON gem versions 1.6.x prior to 1.6.8 JSON gem versions 1.7.x prior to 1.7.7 **Description** The issue allows remote attackers to cause a denial of service or bypass the mass assignment protection mechanism via a crafted JSON document. This can trigger the creation of arbitrary Ruby symbols or certain internal objects, potentially leading to attacks such as SQL injection against Ruby on Rails. **Recommendations** For JSON gem versions prior to 1.5.5, update to version 1.5.5 or later. For JSON gem versions 1.6.x prior to 1.6.8, update to version 1.6.8 or later. For JSON gem versions 1.7.x prior to 1.7.7, update to version 1.7.7 or later.

**Name of the Vulnerable Software and Affected Versions** Ruby on Rails versions 2.3.15 and earlier Ruby on Rails versions 3.0.x through 3.0.18 Ruby on Rails versions 3.1.x through 3.1.9 Ruby on Rails versions 3.2.x through 3.2.10 **Description** The issue allows remote attackers to conduct object-injection attacks and execute arbitrary code, or cause a denial of service involving nested XML entity references, by leveraging Action Pack support for YAML type conversion or Symbol type conversion. This is due to the improper restriction of casts of string values in the `active support/core ext/hash/conversions.rb` file. **Recommendations** For Ruby on Rails version 2.3.15 and earlier, update to version 2.3.15 or later. For Ruby on Rails versions 3.0.x through 3.0.18, update to version 3.0.19 or later. For Ruby on Rails versions 3.1.x through 3.1.9, update to version 3.1.10 or later. For Ruby on Rails versions 3.2.x through 3.2.10, update to version 3.2.11 or later.

**Name of the Vulnerable Software and Affected Versions** Ruby on Rails versions 3.0.x through 3.0.12 Ruby on Rails versions 3.1.x through 3.1.4 Ruby on Rails versions 3.2.x through 3.2.3 **Description** The issue is related to the Active Record component, which does not properly handle the passing of request data to a where method in an ActiveRecord class. This allows remote attackers to conduct certain SQL injection attacks via nested query parameters that leverage unintended recursion. **Recommendations** For Ruby on Rails versions 3.0.x through 3.0.12, update to version 3.0.13 or later. For Ruby on Rails versions 3.1.x through 3.1.4, update to version 3.1.5 or later. For Ruby on Rails versions 3.2.x through 3.2.3, update to version 3.2.4 or later.

**Name of the Vulnerable Software and Affected Versions** Ruby on Rails versions prior to 2.3.16 Ruby on Rails versions 3.0.x through 3.0.12 Ruby on Rails versions 3.1.x through 3.1.4 Ruby on Rails versions 3.2.x through 3.2.3 **Description** The issue allows remote attackers to bypass intended database-query restrictions and perform NULL checks via a crafted request. This is due to improper consideration of differences in parameter handling between the Active Record component and the Rack interface. The vulnerability can be exploited by sending certain "[nil]" values in a request. **Recommendations** For Ruby on Rails versions prior to 2.3.16, update to version 2.3.16 or later. For Ruby on Rails versions 3.0.x through 3.0.12, update to version 3.0.13 or later. For Ruby on Rails versions 3.1.x through 3.1.4, update to version 3.1.5 or later. For Ruby on Rails versions 3.2.x through 3.2.3, update to version 3.2.4 or later.

**Name of the Vulnerable Software and Affected Versions** dotCMS versions 1.9 through 1.9.5.1 **Description** The issue allows remote authenticated users to execute arbitrary Java code via crafted templates, specifically (1) XSLT or (2) Velocity templates. **Recommendations** For dotCMS versions 1.9 through 1.9.5.1, update to version 1.9.5.1 or later to resolve the issue.