Home > Vulnerability Database > CVE-2016-0751

Mend.io Vulnerability Database

CVE-2016-0751

Good to know:

Date: February 15, 2016

actionpack/lib/action_dispatch/http/mime_type.rb in Action Pack in Ruby on Rails before 3.2.22.1, 4.0.x and 4.1.x before 4.1.14.1, 4.2.x before 4.2.5.1, and 5.x before 5.0.0.beta1.1 does not properly restrict use of the MIME type cache, which allows remote attackers to cause a denial of service (memory consumption) via a crafted HTTP Accept header.

Language: Ruby

Severity Score

7.5

Related Resources (22)

Url: https://web.archive.org/web/20160128201702/http://www.securitytracker.com/id/1034816

Url: https://github.com/advisories/GHSA-m53f-rhq8-q6hf

Url: https://github.com/rails/rails/commit/37047b779a177b911c7161052cfc34a30e1db0af

Url: http://rhn.redhat.com/errata/RHSA-2016-0296.html

Url: http://www.securityfocus.com/bid/81800

Url: https://web.archive.org/web/20200227181647/http://www.securityfocus.com/bid/81800

Url: http://lists.opensuse.org/opensuse-updates/2016-02/msg00034.html

Url: http://www.debian.org/security/2016/dsa-3464

Url: http://www.securitytracker.com/id/1034816

Url: https://groups.google.com/forum/message/raw?msg=ruby-security-ann/9oLY_FCzvoc/5CDXbvpYEgAJ

Url: http://www.openwall.com/lists/oss-security/2016/01/25/9

Url: https://github.com/rails/rails

Url: https://github.com/rubysec/ruby-advisory-db/blob/master/gems/actionpack/CVE-2016-0751.yml

Url: https://groups.google.com/forum/#!topic/rubyonrails-security/9oLY_FCzvoc

Url: https://github.com/rails/rails/commit/221937c8ba1d291430ceddebbd4bdef7d3cb47d6

Url: https://nvd.nist.gov/vuln/detail/CVE-2016-0751

Url: http://lists.opensuse.org/opensuse-security-announce/2016-04/msg00053.html

Url: http://lists.fedoraproject.org/pipermail/package-announce/2016-February/178043.html

Url: https://github.com/rails/rails/commit/127967b735813cd4f263df7a50426d74e7e9cc17

Url: http://lists.opensuse.org/opensuse-updates/2016-02/msg00043.html

Url: http://lists.fedoraproject.org/pipermail/package-announce/2016-February/178067.html

Url: https://www.mend.io/vulnerability-database/CVE-2016-0751

Severity Score

7.5

Weakness Type (CWE)

Resource Management Errors

CWE-399

Top Fix

Upgrade Version

Upgrade to version 3.2.22.1,4.1.14.1,4.2.5.1,5.0.0.beta1.1

Learn More

CVSS v3.1

Base Score:	7.5
Attack Vector (AV):	NETWORK
Attack Complexity (AC):	LOW
Privileges Required (PR):	NONE
User Interaction (UI):	NONE
Scope (S):	UNCHANGED
Confidentiality (C):	NONE
Integrity (I):	NONE
Availability (A):	HIGH

CVSS v2

Base Score:	5.0
Access Vector (AV):	NETWORK
Access Complexity (AC):	LOW
Authentication (AU):	NONE
Confidentiality (C):	NONE
Integrity (I):	NONE
Availability (A):	PARTIAL
Additional information:

Mend.io Vulnerability Database

We found results for “”

CVE-2016-0751

Good to know:

Date: February 15, 2016

Language: Ruby

Severity Score

Related Resources (22)

Severity Score

Weakness Type (CWE)

Top Fix

Upgrade Version

CVSS v3.1

CVSS v2

Do you need more information?