CVE-2013-0277

ActiveRecord in Ruby on Rails before 2.3.17 and 3.x before 3.1.0 allows remote attackers to cause a denial of service or execute arbitrary code via crafted serialized attributes that cause the +serialize+ helper to deserialize arbitrary YAML.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTNIST
10 UNKNOWN
NETWORK
LOW
AV:N/AC:L/Au:N/C:C/I:C/A:C
redhatCNA
---
---
CVEADP
---
---
Base Score
CVSS 3.x
EPSS Score
Percentile: 91%
VendorProductVersion
rubyonrailsrails
3.0.0
rubyonrailsrails
3.0.0:beta
rubyonrailsrails
3.0.0:beta2
rubyonrailsrails
3.0.0:beta3
rubyonrailsrails
3.0.0:beta4
rubyonrailsrails
3.0.0:rc
rubyonrailsrails
3.0.0:rc2
rubyonrailsrails
3.0.1
rubyonrailsrails
3.0.1:pre
rubyonrailsrails
3.0.2
rubyonrailsrails
3.0.2:pre
rubyonrailsrails
3.0.3
rubyonrailsrails
3.0.4:rc1
rubyonrailsrails
3.0.5
rubyonrailsrails
3.0.5:rc1
rubyonrailsrails
3.0.6
rubyonrailsrails
3.0.6:rc1
rubyonrailsrails
3.0.6:rc2
rubyonrailsrails
3.0.7
rubyonrailsrails
3.0.7:rc1
rubyonrailsrails
3.0.7:rc2
rubyonrailsrails
3.0.8
rubyonrailsrails
3.0.8:rc1
rubyonrailsrails
3.0.8:rc2
rubyonrailsrails
3.0.8:rc3
rubyonrailsrails
3.0.8:rc4
rubyonrailsrails
3.0.9
rubyonrailsrails
3.0.9:rc1
rubyonrailsrails
3.0.9:rc2
rubyonrailsrails
3.0.9:rc3
rubyonrailsrails
3.0.9:rc4
rubyonrailsrails
3.0.9:rc5
rubyonrailsrails
3.0.10
rubyonrailsrails
3.0.10:rc1
rubyonrailsrails
3.0.11
rubyonrailsrails
3.0.12
rubyonrailsrails
3.0.12:rc1
rubyonrailsrails
3.0.13
rubyonrailsrails
3.0.13:rc1
rubyonrailsrails
3.0.14
rubyonrailsrails
3.0.16
rubyonrailsrails
3.0.17
rubyonrailsrails
3.0.18
rubyonrailsrails
3.0.19
rubyonrailsrails
3.0.20
rubyonrailsruby_on_rails
3.0.4
rubyonrailsrails
2.3.0
rubyonrailsrails
2.3.1
rubyonrailsrails
2.3.2
rubyonrailsrails
2.3.3
rubyonrailsrails
2.3.4
rubyonrailsrails
2.3.9
rubyonrailsrails
2.3.10
rubyonrailsrails
2.3.11
rubyonrailsrails
2.3.12
rubyonrailsrails
2.3.13
rubyonrailsrails
2.3.14
rubyonrailsrails
2.3.15
rubyonrailsrails
2.3.16
𝑥
= Vulnerable software versions
Debian logo
Debian Releases
Debian Product
Codename
rails
bullseye (security)
2:6.0.3.7+dfsg-2+deb11u2
fixed
bullseye
2:6.0.3.7+dfsg-2+deb11u2
fixed
bookworm
2:6.1.7.3+dfsg-2~deb12u1
fixed
sid
2:6.1.7.3+dfsg-4
fixed
trixie
2:6.1.7.3+dfsg-4
fixed
Ubuntu logo
Ubuntu Releases
Ubuntu Product
Codename
rails
zesty
not-affected
yakkety
not-affected
xenial
not-affected
wily
not-affected
vivid
not-affected
utopic
not-affected
trusty
dne
saucy
not-affected
raring
not-affected
quantal
not-affected
precise
not-affected
oneiric
not-affected
lucid
ignored
hardy
ignored
ruby-activerecord-2.3
zesty
dne
yakkety
dne
xenial
dne
wily
dne
vivid
dne
utopic
dne
trusty
dne
saucy
ignored
raring
ignored
quantal
ignored
precise
ignored
oneiric
ignored
lucid
dne
hardy
dne
ruby-activerecord-3.2
zesty
dne
yakkety
dne
xenial
dne
wily
dne
vivid
dne
utopic
dne
trusty
dne
saucy
not-affected
raring
not-affected
quantal
not-affected
precise
dne
oneiric
dne
lucid
dne
hardy
dne