{"schema_version":"1.9.0","id":"CVE-2016-6316","published":"2016-09-07T19:28:10.067Z","modified":"2026-09-09T03:30:57.960296119Z","aliases":["GHSA-pc3m-v286-2jwj"],"related":["SUSE-SU-2017:2716-1"],"details":"Cross-site scripting (XSS) vulnerability in Action View in Ruby on Rails 3.x before 3.2.22.3, 4.x before 4.2.7.1, and 5.x before 5.0.0.1 might allow remote attackers to inject arbitrary web script or HTML via text declared as \"HTML safe\" and used as attribute values in tag handlers.","affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/rails/rails","events":[{"introduced":"9891ca89c69732a21743f0349f2995956a7802e7"},{"last_affected":"50e0a6b209d1afe6c2bc3047208e14f13ac3b382"}],"database_specific":{"cpe":["cpe:2.3:a:rubyonrails:rails:3.0.0:*:*:*:*:*:*:*","cpe:2.3:a:rubyonrails:rails:3.0.0:beta2:*:*:*:*:*:*","cpe:2.3:a:rubyonrails:rails:3.0.0:beta3:*:*:*:*:*:*","cpe:2.3:a:rubyonrails:rails:3.0.0:beta4:*:*:*:*:*:*","cpe:2.3:a:rubyonrails:rails:3.0.0:rc:*:*:*:*:*:*","cpe:2.3:a:rubyonrails:rails:3.0.0:rc2:*:*:*:*:*:*","cpe:2.3:a:rubyonrails:rails:3.0.1:*:*:*:*:*:*:*","cpe:2.3:a:rubyonrails:rails:3.0.2:*:*:*:*:*:*:*","cpe:2.3:a:rubyonrails:rails:3.0.3:*:*:*:*:*:*:*","cpe:2.3:a:rubyonrails:rails:3.0.4:rc1:*:*:*:*:*:*","cpe:2.3:a:rubyonrails:rails:3.0.5:*:*:*:*:*:*:*","cpe:2.3:a:rubyonrails:rails:3.0.5:rc1:*:*:*:*:*:*","cpe:2.3:a:rubyonrails:rails:3.0.6:*:*:*:*:*:*:*","cpe:2.3:a:rubyonrails:rails:3.0.6:rc1:*:*:*:*:*:*","cpe:2.3:a:rubyonrails:rails:3.0.6:rc2:*:*:*:*:*:*","cpe:2.3:a:rubyonrails:rails:3.0.7:*:*:*:*:*:*:*","cpe:2.3:a:rubyonrails:rails:3.0.7:rc1:*:*:*:*:*:*","cpe:2.3:a:rubyonrails:rails:3.0.7:rc2:*:*:*:*:*:*","cpe:2.3:a:rubyonrails:rails:3.0.8:*:*:*:*:*:*:*","cpe:2.3:a:rubyonrails:rails:3.0.8:rc1:*:*:*:*:*:*","cpe:2.3:a:rubyonrails:rails:3.0.8:rc2:*:*:*:*:*:*","cpe:2.3:a:rubyonrails:rails:3.0.8:rc3:*:*:*:*:*:*","cpe:2.3:a:rubyonrails:rails:3.0.8:rc4:*:*:*:*:*:*","cpe:2.3:a:rubyonrails:rails:3.0.9:*:*:*:*:*:*:*","cpe:2.3:a:rubyonrails:rails:3.0.9:rc1:*:*:*:*:*:*","cpe:2.3:a:rubyonrails:rails:3.0.9:rc2:*:*:*:*:*:*","cpe:2.3:a:rubyonrails:rails:3.0.9:rc3:*:*:*:*:*:*","cpe:2.3:a:rubyonrails:rails:3.0.9:rc4:*:*:*:*:*:*","cpe:2.3:a:rubyonrails:rails:3.0.9:rc5:*:*:*:*:*:*","cpe:2.3:a:rubyonrails:rails:3.0.10:*:*:*:*:*:*:*","cpe:2.3:a:rubyonrails:rails:3.0.10:rc1:*:*:*:*:*:*","cpe:2.3:a:rubyonrails:rails:3.0.11:*:*:*:*:*:*:*","cpe:2.3:a:rubyonrails:rails:3.0.12:*:*:*:*:*:*:*","cpe:2.3:a:rubyonrails:rails:3.0.12:rc1:*:*:*:*:*:*","cpe:2.3:a:rubyonrails:rails:3.0.13:*:*:*:*:*:*:*","cpe:2.3:a:rubyonrails:rails:3.0.13:rc1:*:*:*:*:*:*","cpe:2.3:a:rubyonrails:rails:3.0.14:*:*:*:*:*:*:*","cpe:2.3:a:rubyonrails:rails:3.0.16:*:*:*:*:*:*:*","cpe:2.3:a:rubyonrails:rails:3.0.17:*:*:*:*:*:*:*","cpe:2.3:a:rubyonrails:rails:3.0.18:*:*:*:*:*:*:*","cpe:2.3:a:rubyonrails:rails:3.0.19:*:*:*:*:*:*:*","cpe:2.3:a:rubyonrails:rails:3.0.20:*:*:*:*:*:*:*","cpe:2.3:a:rubyonrails:rails:3.1.0:*:*:*:*:*:*:*","cpe:2.3:a:rubyonrails:rails:3.1.0:beta1:*:*:*:*:*:*","cpe:2.3:a:rubyonrails:rails:3.1.0:rc1:*:*:*:*:*:*","cpe:2.3:a:rubyonrails:rails:3.1.0:rc2:*:*:*:*:*:*","cpe:2.3:a:rubyonrails:rails:3.1.0:rc3:*:*:*:*:*:*","cpe:2.3:a:rubyonrails:rails:3.1.0:rc4:*:*:*:*:*:*","cpe:2.3:a:rubyonrails:rails:3.1.0:rc5:*:*:*:*:*:*","cpe:2.3:a:rubyonrails:rails:3.1.0:rc6:*:*:*:*:*:*","cpe:2.3:a:rubyonrails:rails:3.1.0:rc7:*:*:*:*:*:*","cpe:2.3:a:rubyonrails:rails:3.1.0:rc8:*:*:*:*:*:*","cpe:2.3:a:rubyonrails:rails:3.1.1:*:*:*:*:*:*:*","cpe:2.3:a:rubyonrails:rails:3.1.1:rc1:*:*:*:*:*:*","cpe:2.3:a:rubyonrails:rails:3.1.1:rc2:*:*:*:*:*:*","cpe:2.3:a:rubyonrails:rails:3.1.1:rc3:*:*:*:*:*:*","cpe:2.3:a:rubyonrails:rails:3.1.2:*:*:*:*:*:*:*","cpe:2.3:a:rubyonrails:rails:3.1.2:rc1:*:*:*:*:*:*","cpe:2.3:a:rubyonrails:rails:3.1.2:rc2:*:*:*:*:*:*","cpe:2.3:a:rubyonrails:rails:3.1.3:*:*:*:*:*:*:*","cpe:2.3:a:rubyonrails:rails:3.1.4:*:*:*:*:*:*:*","cpe:2.3:a:rubyonrails:rails:3.1.4:rc1:*:*:*:*:*:*","cpe:2.3:a:rubyonrails:rails:3.1.5:*:*:*:*:*:*:*","cpe:2.3:a:rubyonrails:rails:3.1.5:rc1:*:*:*:*:*:*","cpe:2.3:a:rubyonrails:rails:3.1.6:*:*:*:*:*:*:*","cpe:2.3:a:rubyonrails:rails:3.1.7:*:*:*:*:*:*:*","cpe:2.3:a:rubyonrails:rails:3.1.8:*:*:*:*:*:*:*","cpe:2.3:a:rubyonrails:rails:3.1.9:*:*:*:*:*:*:*","cpe:2.3:a:rubyonrails:rails:3.1.10:*:*:*:*:*:*:*","cpe:2.3:a:rubyonrails:rails:3.1.12:*:*:*:*:*:*:*","cpe:2.3:a:rubyonrails:rails:3.2.0:*:*:*:*:*:*:*","cpe:2.3:a:rubyonrails:rails:3.2.0:rc1:*:*:*:*:*:*","cpe:2.3:a:rubyonrails:rails:3.2.0:rc2:*:*:*:*:*:*","cpe:2.3:a:rubyonrails:rails:3.2.1:*:*:*:*:*:*:*","cpe:2.3:a:rubyonrails:rails:3.2.2:*:*:*:*:*:*:*","cpe:2.3:a:rubyonrails:rails:3.2.2:rc1:*:*:*:*:*:*","cpe:2.3:a:rubyonrails:rails:3.2.3:*:*:*:*:*:*:*","cpe:2.3:a:rubyonrails:rails:3.2.3:rc1:*:*:*:*:*:*","cpe:2.3:a:rubyonrails:rails:3.2.3:rc2:*:*:*:*:*:*","cpe:2.3:a:rubyonrails:rails:3.2.4:*:*:*:*:*:*:*","cpe:2.3:a:rubyonrails:rails:3.2.4:rc1:*:*:*:*:*:*","cpe:2.3:a:rubyonrails:rails:3.2.5:*:*:*:*:*:*:*","cpe:2.3:a:rubyonrails:rails:3.2.6:*:*:*:*:*:*:*","cpe:2.3:a:rubyonrails:rails:3.2.7:*:*:*:*:*:*:*","cpe:2.3:a:rubyonrails:rails:3.2.7:rc1:*:*:*:*:*:*","cpe:2.3:a:rubyonrails:rails:3.2.8:*:*:*:*:*:*:*","cpe:2.3:a:rubyonrails:rails:3.2.8:rc1:*:*:*:*:*:*","cpe:2.3:a:rubyonrails:rails:3.2.8:rc2:*:*:*:*:*:*","cpe:2.3:a:rubyonrails:rails:3.2.9:*:*:*:*:*:*:*","cpe:2.3:a:rubyonrails:rails:3.2.9:rc1:*:*:*:*:*:*","cpe:2.3:a:rubyonrails:rails:3.2.9:rc2:*:*:*:*:*:*","cpe:2.3:a:rubyonrails:rails:3.2.9:rc3:*:*:*:*:*:*","cpe:2.3:a:rubyonrails:rails:3.2.10:*:*:*:*:*:*:*","cpe:2.3:a:rubyonrails:rails:3.2.11:*:*:*:*:*:*:*","cpe:2.3:a:rubyonrails:rails:3.2.12:*:*:*:*:*:*:*","cpe:2.3:a:rubyonrails:rails:3.2.13:*:*:*:*:*:*:*","cpe:2.3:a:rubyonrails:rails:3.2.13:rc1:*:*:*:*:*:*","cpe:2.3:a:rubyonrails:rails:3.2.13:rc2:*:*:*:*:*:*","cpe:2.3:a:rubyonrails:rails:3.2.15:*:*:*:*:*:*:*","cpe:2.3:a:rubyonrails:rails:3.2.15:rc3:*:*:*:*:*:*","cpe:2.3:a:rubyonrails:rails:3.2.16:*:*:*:*:*:*:*","cpe:2.3:a:rubyonrails:rails:3.2.17:*:*:*:*:*:*:*","cpe:2.3:a:rubyonrails:rails:3.2.18:*:*:*:*:*:*:*","cpe:2.3:a:rubyonrails:rails:3.2.21:*:*:*:*:*:*:*","cpe:2.3:a:rubyonrails:rails:3.2.22.2:*:*:*:*:*:*:*","cpe:2.3:a:rubyonrails:rails:4.0.0:-:*:*:*:*:*:*","cpe:2.3:a:rubyonrails:rails:4.0.0:beta:*:*:*:*:*:*","cpe:2.3:a:rubyonrails:rails:4.0.0:rc1:*:*:*:*:*:*","cpe:2.3:a:rubyonrails:rails:4.0.0:rc2:*:*:*:*:*:*","cpe:2.3:a:rubyonrails:rails:4.0.1:-:*:*:*:*:*:*","cpe:2.3:a:rubyonrails:rails:4.0.1:rc1:*:*:*:*:*:*","cpe:2.3:a:rubyonrails:rails:4.0.1:rc2:*:*:*:*:*:*","cpe:2.3:a:rubyonrails:rails:4.0.1:rc3:*:*:*:*:*:*","cpe:2.3:a:rubyonrails:rails:4.0.1:rc4:*:*:*:*:*:*","cpe:2.3:a:rubyonrails:rails:4.0.2:*:*:*:*:*:*:*","cpe:2.3:a:rubyonrails:rails:4.0.3:*:*:*:*:*:*:*","cpe:2.3:a:rubyonrails:rails:4.0.4:*:*:*:*:*:*:*","cpe:2.3:a:rubyonrails:rails:4.0.4:rc1:*:*:*:*:*:*","cpe:2.3:a:rubyonrails:rails:4.0.5:*:*:*:*:*:*:*","cpe:2.3:a:rubyonrails:rails:4.0.6:*:*:*:*:*:*:*","cpe:2.3:a:rubyonrails:rails:4.0.6:rc1:*:*:*:*:*:*","cpe:2.3:a:rubyonrails:rails:4.0.6:rc2:*:*:*:*:*:*","cpe:2.3:a:rubyonrails:rails:4.0.6:rc3:*:*:*:*:*:*","cpe:2.3:a:rubyonrails:rails:4.0.7:*:*:*:*:*:*:*","cpe:2.3:a:rubyonrails:rails:4.0.8:*:*:*:*:*:*:*","cpe:2.3:a:rubyonrails:rails:4.0.9:*:*:*:*:*:*:*","cpe:2.3:a:rubyonrails:rails:4.0.10:*:*:*:*:*:*:*","cpe:2.3:a:rubyonrails:rails:4.0.10:rc1:*:*:*:*:*:*","cpe:2.3:a:rubyonrails:rails:4.1.0:-:*:*:*:*:*:*","cpe:2.3:a:rubyonrails:rails:4.1.0:beta1:*:*:*:*:*:*","cpe:2.3:a:rubyonrails:rails:4.1.0:beta2:*:*:*:*:*:*","cpe:2.3:a:rubyonrails:rails:4.1.0:rc1:*:*:*:*:*:*","cpe:2.3:a:rubyonrails:rails:4.1.0:rc2:*:*:*:*:*:*","cpe:2.3:a:rubyonrails:rails:4.1.1:*:*:*:*:*:*:*","cpe:2.3:a:rubyonrails:rails:4.1.2:*:*:*:*:*:*:*","cpe:2.3:a:rubyonrails:rails:4.1.2:rc1:*:*:*:*:*:*","cpe:2.3:a:rubyonrails:rails:4.1.2:rc2:*:*:*:*:*:*","cpe:2.3:a:rubyonrails:rails:4.1.2:rc3:*:*:*:*:*:*","cpe:2.3:a:rubyonrails:rails:4.1.3:*:*:*:*:*:*:*","cpe:2.3:a:rubyonrails:rails:4.1.4:*:*:*:*:*:*:*","cpe:2.3:a:rubyonrails:rails:4.1.5:*:*:*:*:*:*:*","cpe:2.3:a:rubyonrails:rails:4.1.6:*:*:*:*:*:*:*","cpe:2.3:a:rubyonrails:rails:4.1.6:rc1:*:*:*:*:*:*","cpe:2.3:a:rubyonrails:rails:4.1.6:rc2:*:*:*:*:*:*","cpe:2.3:a:rubyonrails:rails:4.1.7:*:*:*:*:*:*:*","cpe:2.3:a:rubyonrails:rails:4.1.7.1:*:*:*:*:*:*:*","cpe:2.3:a:rubyonrails:rails:4.1.8:*:*:*:*:*:*:*","cpe:2.3:a:rubyonrails:rails:4.1.9:*:*:*:*:*:*:*","cpe:2.3:a:rubyonrails:rails:4.1.9:rc1:*:*:*:*:*:*","cpe:2.3:a:rubyonrails:rails:4.1.10:*:*:*:*:*:*:*","cpe:2.3:a:rubyonrails:rails:4.1.10:rc1:*:*:*:*:*:*","cpe:2.3:a:rubyonrails:rails:4.1.10:rc2:*:*:*:*:*:*","cpe:2.3:a:rubyonrails:rails:4.1.10:rc3:*:*:*:*:*:*","cpe:2.3:a:rubyonrails:rails:4.1.10:rc4:*:*:*:*:*:*","cpe:2.3:a:rubyonrails:rails:4.1.12:*:*:*:*:*:*:*","cpe:2.3:a:rubyonrails:rails:4.1.12:rc1:*:*:*:*:*:*","cpe:2.3:a:rubyonrails:rails:4.1.13:*:*:*:*:*:*:*","cpe:2.3:a:rubyonrails:rails:4.1.13:rc1:*:*:*:*:*:*","cpe:2.3:a:rubyonrails:rails:4.1.14:*:*:*:*:*:*:*","cpe:2.3:a:rubyonrails:rails:4.1.14:rc1:*:*:*:*:*:*","cpe:2.3:a:rubyonrails:rails:4.1.14:rc2:*:*:*:*:*:*","cpe:2.3:a:rubyonrails:rails:4.1.14.2:*:*:*:*:*:*:*","cpe:2.3:a:rubyonrails:rails:4.1.15:*:*:*:*:*:*:*","cpe:2.3:a:rubyonrails:rails:4.1.15:rc1:*:*:*:*:*:*","cpe:2.3:a:rubyonrails:rails:4.1.16:*:*:*:*:*:*:*","cpe:2.3:a:rubyonrails:rails:4.1.16:rc1:*:*:*:*:*:*","cpe:2.3:a:rubyonrails:rails:4.2.0:*:*:*:*:*:*:*","cpe:2.3:a:rubyonrails:rails:4.2.0:beta1:*:*:*:*:*:*","cpe:2.3:a:rubyonrails:rails:4.2.0:beta2:*:*:*:*:*:*","cpe:2.3:a:rubyonrails:rails:4.2.0:beta3:*:*:*:*:*:*","cpe:2.3:a:rubyonrails:rails:4.2.0:beta4:*:*:*:*:*:*","cpe:2.3:a:rubyonrails:rails:4.2.0:rc1:*:*:*:*:*:*","cpe:2.3:a:rubyonrails:rails:4.2.0:rc2:*:*:*:*:*:*","cpe:2.3:a:rubyonrails:rails:4.2.0:rc3:*:*:*:*:*:*","cpe:2.3:a:rubyonrails:rails:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:rubyonrails:rails:4.2.1:rc1:*:*:*:*:*:*","cpe:2.3:a:rubyonrails:rails:4.2.1:rc2:*:*:*:*:*:*","cpe:2.3:a:rubyonrails:rails:4.2.1:rc3:*:*:*:*:*:*","cpe:2.3:a:rubyonrails:rails:4.2.1:rc4:*:*:*:*:*:*","cpe:2.3:a:rubyonrails:rails:4.2.2:*:*:*:*:*:*:*","cpe:2.3:a:rubyonrails:rails:4.2.3:*:*:*:*:*:*:*","cpe:2.3:a:rubyonrails:rails:4.2.3:rc1:*:*:*:*:*:*","cpe:2.3:a:rubyonrails:rails:4.2.4:*:*:*:*:*:*:*","cpe:2.3:a:rubyonrails:rails:4.2.4:rc1:*:*:*:*:*:*","cpe:2.3:a:rubyonrails:rails:4.2.5:*:*:*:*:*:*:*","cpe:2.3:a:rubyonrails:rails:4.2.5:rc1:*:*:*:*:*:*","cpe:2.3:a:rubyonrails:rails:4.2.5:rc2:*:*:*:*:*:*","cpe:2.3:a:rubyonrails:rails:4.2.5.1:*:*:*:*:*:*:*","cpe:2.3:a:rubyonrails:rails:4.2.5.2:*:*:*:*:*:*:*","cpe:2.3:a:rubyonrails:rails:4.2.6:*:*:*:*:*:*:*","cpe:2.3:a:rubyonrails:rails:4.2.6:rc1:*:*:*:*:*:*","cpe:2.3:a:rubyonrails:rails:4.2.7:*:*:*:*:*:*:*","cpe:2.3:a:rubyonrails:rails:4.2.7:rc1:*:*:*:*:*:*","cpe:2.3:a:rubyonrails:rails:5.0.0:beta1:*:*:*:*:*:*","cpe:2.3:a:rubyonrails:rails:5.0.0:beta1.1:*:*:*:*:*:*","cpe:2.3:a:rubyonrails:rails:5.0.0:beta2:*:*:*:*:*:*","cpe:2.3:a:rubyonrails:rails:5.0.0:beta3:*:*:*:*:*:*","cpe:2.3:a:rubyonrails:rails:5.0.0:beta4:*:*:*:*:*:*","cpe:2.3:a:rubyonrails:rails:5.0.0:rc1:*:*:*:*:*:*","cpe:2.3:a:rubyonrails:rails:5.0.0:rc2:*:*:*:*:*:*"],"extracted_events":[{"introduced":"3.0.0"},{"last_affected":"3.0.0"},{"introduced":"3.0.0-beta2"},{"last_affected":"3.0.0-beta2"},{"introduced":"3.0.0-beta3"},{"last_affected":"3.0.0-beta3"},{"introduced":"3.0.0-beta4"},{"last_affected":"3.0.0-beta4"},{"introduced":"3.0.0-rc"},{"last_affected":"3.0.0-rc"},{"introduced":"3.0.0-rc2"},{"last_affected":"3.0.0-rc2"},{"introduced":"3.0.1"},{"last_affected":"3.0.1"},{"introduced":"3.0.2"},{"last_affected":"3.0.2"},{"introduced":"3.0.3"},{"last_affected":"3.0.3"},{"introduced":"3.0.4-rc1"},{"last_affected":"3.0.4-rc1"},{"introduced":"3.0.5"},{"last_affected":"3.0.5"},{"introduced":"3.0.5-rc1"},{"last_affected":"3.0.5-rc1"},{"introduced":"3.0.6"},{"last_affected":"3.0.6"},{"introduced":"3.0.6-rc1"},{"last_affected":"3.0.6-rc1"},{"introduced":"3.0.6-rc2"},{"last_affected":"3.0.6-rc2"},{"introduced":"3.0.7"},{"last_affected":"3.0.7"},{"introduced":"3.0.7-rc1"},{"last_affected":"3.0.7-rc1"},{"introduced":"3.0.7-rc2"},{"last_affected":"3.0.7-rc2"},{"introduced":"3.0.8"},{"last_affected":"3.0.8"},{"introduced":"3.0.8-rc1"},{"last_affected":"3.0.8-rc1"},{"introduced":"3.0.8-rc2"},{"last_affected":"3.0.8-rc2"},{"introduced":"3.0.8-rc3"},{"last_affected":"3.0.8-rc3"},{"introduced":"3.0.8-rc4"},{"last_affected":"3.0.8-rc4"},{"introduced":"3.0.9"},{"last_affected":"3.0.9"},{"introduced":"3.0.9-rc1"},{"last_affected":"3.0.9-rc1"},{"introduced":"3.0.9-rc2"},{"last_affected":"3.0.9-rc2"},{"introduced":"3.0.9-rc3"},{"last_affected":"3.0.9-rc3"},{"introduced":"3.0.9-rc4"},{"last_affected":"3.0.9-rc4"},{"introduced":"3.0.9-rc5"},{"last_affected":"3.0.9-rc5"},{"introduced":"3.0.10"},{"last_affected":"3.0.10"},{"introduced":"3.0.10-rc1"},{"last_affected":"3.0.10-rc1"},{"introduced":"3.0.11"},{"last_affected":"3.0.11"},{"introduced":"3.0.12"},{"last_affected":"3.0.12"},{"introduced":"3.0.12-rc1"},{"last_affected":"3.0.12-rc1"},{"introduced":"3.0.13"},{"last_affected":"3.0.13"},{"introduced":"3.0.13-rc1"},{"last_affected":"3.0.13-rc1"},{"introduced":"3.0.14"},{"last_affected":"3.0.14"},{"introduced":"3.0.16"},{"last_affected":"3.0.16"},{"introduced":"3.0.17"},{"last_affected":"3.0.17"},{"introduced":"3.0.18"},{"last_affected":"3.0.18"},{"introduced":"3.0.19"},{"last_affected":"3.0.19"},{"introduced":"3.0.20"},{"last_affected":"3.0.20"},{"introduced":"3.1.0"},{"last_affected":"3.1.0"},{"introduced":"3.1.0-beta1"},{"last_affected":"3.1.0-beta1"},{"introduced":"3.1.0-rc1"},{"last_affected":"3.1.0-rc1"},{"introduced":"3.1.0-rc2"},{"last_affected":"3.1.0-rc2"},{"introduced":"3.1.0-rc3"},{"last_affected":"3.1.0-rc3"},{"introduced":"3.1.0-rc4"},{"last_affected":"3.1.0-rc4"},{"introduced":"3.1.0-rc5"},{"last_affected":"3.1.0-rc5"},{"introduced":"3.1.0-rc6"},{"last_affected":"3.1.0-rc6"},{"introduced":"3.1.0-rc7"},{"last_affected":"3.1.0-rc7"},{"introduced":"3.1.0-rc8"},{"last_affected":"3.1.0-rc8"},{"introduced":"3.1.1"},{"last_affected":"3.1.1"},{"introduced":"3.1.1-rc1"},{"last_affected":"3.1.1-rc1"},{"introduced":"3.1.1-rc2"},{"last_affected":"3.1.1-rc2"},{"introduced":"3.1.1-rc3"},{"last_affected":"3.1.1-rc3"},{"introduced":"3.1.2"},{"last_affected":"3.1.2"},{"introduced":"3.1.2-rc1"},{"last_affected":"3.1.2-rc1"},{"introduced":"3.1.2-rc2"},{"last_affected":"3.1.2-rc2"},{"introduced":"3.1.3"},{"last_affected":"3.1.3"},{"introduced":"3.1.4"},{"last_affected":"3.1.4"},{"introduced":"3.1.4-rc1"},{"last_affected":"3.1.4-rc1"},{"introduced":"3.1.5"},{"last_affected":"3.1.5"},{"introduced":"3.1.5-rc1"},{"last_affected":"3.1.5-rc1"},{"introduced":"3.1.6"},{"last_affected":"3.1.6"},{"introduced":"3.1.7"},{"last_affected":"3.1.7"},{"introduced":"3.1.8"},{"last_affected":"3.1.8"},{"introduced":"3.1.9"},{"last_affected":"3.1.9"},{"introduced":"3.1.10"},{"last_affected":"3.1.10"},{"introduced":"3.1.12"},{"last_affected":"3.1.12"},{"introduced":"3.2.0"},{"last_affected":"3.2.0"},{"introduced":"3.2.0-rc1"},{"last_affected":"3.2.0-rc1"},{"introduced":"3.2.0-rc2"},{"last_affected":"3.2.0-rc2"},{"introduced":"3.2.1"},{"last_affected":"3.2.1"},{"introduced":"3.2.2"},{"last_affected":"3.2.2"},{"introduced":"3.2.2-rc1"},{"last_affected":"3.2.2-rc1"},{"introduced":"3.2.3"},{"last_affected":"3.2.3"},{"introduced":"3.2.3-rc1"},{"last_affected":"3.2.3-rc1"},{"introduced":"3.2.3-rc2"},{"last_affected":"3.2.3-rc2"},{"introduced":"3.2.4"},{"last_affected":"3.2.4"},{"introduced":"3.2.4-rc1"},{"last_affected":"3.2.4-rc1"},{"introduced":"3.2.5"},{"last_affected":"3.2.5"},{"introduced":"3.2.6"},{"last_affected":"3.2.6"},{"introduced":"3.2.7"},{"last_affected":"3.2.7"},{"introduced":"3.2.7-rc1"},{"last_affected":"3.2.7-rc1"},{"introduced":"3.2.8"},{"last_affected":"3.2.8"},{"introduced":"3.2.8-rc1"},{"last_affected":"3.2.8-rc1"},{"introduced":"3.2.8-rc2"},{"last_affected":"3.2.8-rc2"},{"introduced":"3.2.9"},{"last_affected":"3.2.9"},{"introduced":"3.2.9-rc1"},{"last_affected":"3.2.9-rc1"},{"introduced":"3.2.9-rc2"},{"last_affected":"3.2.9-rc2"},{"introduced":"3.2.9-rc3"},{"last_affected":"3.2.9-rc3"},{"introduced":"3.2.10"},{"last_affected":"3.2.10"},{"introduced":"3.2.11"},{"last_affected":"3.2.11"},{"introduced":"3.2.12"},{"last_affected":"3.2.12"},{"introduced":"3.2.13"},{"last_affected":"3.2.13"},{"introduced":"3.2.13-rc1"},{"last_affected":"3.2.13-rc1"},{"introduced":"3.2.13-rc2"},{"last_affected":"3.2.13-rc2"},{"introduced":"3.2.15"},{"last_affected":"3.2.15"},{"introduced":"3.2.15-rc3"},{"last_affected":"3.2.15-rc3"},{"introduced":"3.2.16"},{"last_affected":"3.2.16"},{"introduced":"3.2.17"},{"last_affected":"3.2.17"},{"introduced":"3.2.18"},{"last_affected":"3.2.18"},{"introduced":"3.2.21"},{"last_affected":"3.2.21"},{"introduced":"3.2.22.2"},{"last_affected":"3.2.22.2"},{"introduced":"4.0.0-NA"},{"last_affected":"4.0.0-NA"},{"introduced":"4.0.0-beta"},{"last_affected":"4.0.0-beta"},{"introduced":"4.0.0-rc1"},{"last_affected":"4.0.0-rc1"},{"introduced":"4.0.0-rc2"},{"last_affected":"4.0.0-rc2"},{"introduced":"4.0.1-NA"},{"last_affected":"4.0.1-NA"},{"introduced":"4.0.1-rc1"},{"last_affected":"4.0.1-rc1"},{"introduced":"4.0.1-rc2"},{"last_affected":"4.0.1-rc2"},{"introduced":"4.0.1-rc3"},{"last_affected":"4.0.1-rc3"},{"introduced":"4.0.1-rc4"},{"last_affected":"4.0.1-rc4"},{"introduced":"4.0.2"},{"last_affected":"4.0.2"},{"introduced":"4.0.3"},{"last_affected":"4.0.3"},{"introduced":"4.0.4"},{"last_affected":"4.0.4"},{"introduced":"4.0.4-rc1"},{"last_affected":"4.0.4-rc1"},{"introduced":"4.0.5"},{"last_affected":"4.0.5"},{"introduced":"4.0.6"},{"last_affected":"4.0.6"},{"introduced":"4.0.6-rc1"},{"last_affected":"4.0.6-rc1"},{"introduced":"4.0.6-rc2"},{"last_affected":"4.0.6-rc2"},{"introduced":"4.0.6-rc3"},{"last_affected":"4.0.6-rc3"},{"introduced":"4.0.7"},{"last_affected":"4.0.7"},{"introduced":"4.0.8"},{"last_affected":"4.0.8"},{"introduced":"4.0.9"},{"last_affected":"4.0.9"},{"introduced":"4.0.10"},{"last_affected":"4.0.10"},{"introduced":"4.0.10-rc1"},{"last_affected":"4.0.10-rc1"},{"introduced":"4.1.0-NA"},{"last_affected":"4.1.0-NA"},{"introduced":"4.1.0-beta1"},{"last_affected":"4.1.0-beta1"},{"introduced":"4.1.0-beta2"},{"last_affected":"4.1.0-beta2"},{"introduced":"4.1.0-rc1"},{"last_affected":"4.1.0-rc1"},{"introduced":"4.1.0-rc2"},{"last_affected":"4.1.0-rc2"},{"introduced":"4.1.1"},{"last_affected":"4.1.1"},{"introduced":"4.1.2"},{"last_affected":"4.1.2"},{"introduced":"4.1.2-rc1"},{"last_affected":"4.1.2-rc1"},{"introduced":"4.1.2-rc2"},{"last_affected":"4.1.2-rc2"},{"introduced":"4.1.2-rc3"},{"last_affected":"4.1.2-rc3"},{"introduced":"4.1.3"},{"last_affected":"4.1.3"},{"introduced":"4.1.4"},{"last_affected":"4.1.4"},{"introduced":"4.1.5"},{"last_affected":"4.1.5"},{"introduced":"4.1.6"},{"last_affected":"4.1.6"},{"introduced":"4.1.6-rc1"},{"last_affected":"4.1.6-rc1"},{"introduced":"4.1.6-rc2"},{"last_affected":"4.1.6-rc2"},{"introduced":"4.1.7"},{"last_affected":"4.1.7"},{"introduced":"4.1.7.1"},{"last_affected":"4.1.7.1"},{"introduced":"4.1.8"},{"last_affected":"4.1.8"},{"introduced":"4.1.9"},{"last_affected":"4.1.9"},{"introduced":"4.1.9-rc1"},{"last_affected":"4.1.9-rc1"},{"introduced":"4.1.10"},{"last_affected":"4.1.10"},{"introduced":"4.1.10-rc1"},{"last_affected":"4.1.10-rc1"},{"introduced":"4.1.10-rc2"},{"last_affected":"4.1.10-rc2"},{"introduced":"4.1.10-rc3"},{"last_affected":"4.1.10-rc3"},{"introduced":"4.1.10-rc4"},{"last_affected":"4.1.10-rc4"},{"introduced":"4.1.12"},{"last_affected":"4.1.12"},{"introduced":"4.1.12-rc1"},{"last_affected":"4.1.12-rc1"},{"introduced":"4.1.13"},{"last_affected":"4.1.13"},{"introduced":"4.1.13-rc1"},{"last_affected":"4.1.13-rc1"},{"introduced":"4.1.14"},{"last_affected":"4.1.14"},{"introduced":"4.1.14-rc1"},{"last_affected":"4.1.14-rc1"},{"introduced":"4.1.14-rc2"},{"last_affected":"4.1.14-rc2"},{"introduced":"4.1.14.2"},{"last_affected":"4.1.14.2"},{"introduced":"4.1.15"},{"last_affected":"4.1.15"},{"introduced":"4.1.15-rc1"},{"last_affected":"4.1.15-rc1"},{"introduced":"4.1.16"},{"last_affected":"4.1.16"},{"introduced":"4.1.16-rc1"},{"last_affected":"4.1.16-rc1"},{"introduced":"4.2.0"},{"last_affected":"4.2.0"},{"introduced":"4.2.0-beta1"},{"last_affected":"4.2.0-beta1"},{"introduced":"4.2.0-beta2"},{"last_affected":"4.2.0-beta2"},{"introduced":"4.2.0-beta3"},{"last_affected":"4.2.0-beta3"},{"introduced":"4.2.0-beta4"},{"last_affected":"4.2.0-beta4"},{"introduced":"4.2.0-rc1"},{"last_affected":"4.2.0-rc1"},{"introduced":"4.2.0-rc2"},{"last_affected":"4.2.0-rc2"},{"introduced":"4.2.0-rc3"},{"last_affected":"4.2.0-rc3"},{"introduced":"4.2.1"},{"last_affected":"4.2.1"},{"introduced":"4.2.1-rc1"},{"last_affected":"4.2.1-rc1"},{"introduced":"4.2.1-rc2"},{"last_affected":"4.2.1-rc2"},{"introduced":"4.2.1-rc3"},{"last_affected":"4.2.1-rc3"},{"introduced":"4.2.1-rc4"},{"last_affected":"4.2.1-rc4"},{"introduced":"4.2.2"},{"last_affected":"4.2.2"},{"introduced":"4.2.3"},{"last_affected":"4.2.3"},{"introduced":"4.2.3-rc1"},{"last_affected":"4.2.3-rc1"},{"introduced":"4.2.4"},{"last_affected":"4.2.4"},{"introduced":"4.2.4-rc1"},{"last_affected":"4.2.4-rc1"},{"introduced":"4.2.5"},{"last_affected":"4.2.5"},{"introduced":"4.2.5-rc1"},{"last_affected":"4.2.5-rc1"},{"introduced":"4.2.5-rc2"},{"last_affected":"4.2.5-rc2"},{"introduced":"4.2.5.1"},{"last_affected":"4.2.5.1"},{"introduced":"4.2.5.2"},{"last_affected":"4.2.5.2"},{"introduced":"4.2.6"},{"last_affected":"4.2.6"},{"introduced":"4.2.6-rc1"},{"last_affected":"4.2.6-rc1"},{"introduced":"4.2.7"},{"last_affected":"4.2.7"},{"introduced":"4.2.7-rc1"},{"last_affected":"4.2.7-rc1"},{"introduced":"5.0.0-beta1"},{"last_affected":"5.0.0-beta1"},{"introduced":"5.0.0-beta1\\.1"},{"last_affected":"5.0.0-beta1\\.1"},{"introduced":"5.0.0-beta2"},{"last_affected":"5.0.0-beta2"},{"introduced":"5.0.0-beta3"},{"last_affected":"5.0.0-beta3"},{"introduced":"5.0.0-beta4"},{"last_affected":"5.0.0-beta4"},{"introduced":"5.0.0-rc1"},{"last_affected":"5.0.0-rc1"},{"introduced":"5.0.0-rc2"},{"last_affected":"5.0.0-rc2"}],"source":"CPE_STRING"}}],"versions":["3.0.0","3.0.0-beta2","3.0.0-beta3","3.0.0-beta4","3.0.0-rc","3.0.0-rc2","3.0.1","3.0.10","3.0.10-rc1","3.0.11","3.0.12","3.0.12-rc1","3.0.13","3.0.13-rc1","3.0.14","3.0.16","3.0.17","3.0.18","3.0.19","3.0.2","3.0.20","3.0.3","3.0.4-rc1","3.0.5","3.0.5-rc1","3.0.6","3.0.6-rc1","3.0.6-rc2","3.0.7","3.0.7-rc1","3.0.7-rc2","3.0.8","3.0.8-rc1","3.0.8-rc2","3.0.8-rc3","3.0.8-rc4","3.0.9","3.0.9-rc1","3.0.9-rc2","3.0.9-rc3","3.0.9-rc4","3.0.9-rc5","3.1.0","3.1.0-beta1","3.1.0-rc1","3.1.0-rc2","3.1.0-rc3","3.1.0-rc4","3.1.0-rc5","3.1.0-rc6","3.1.0-rc7","3.1.0-rc8","3.1.1","3.1.1-rc1","3.1.1-rc2","3.1.1-rc3","3.1.10","3.1.12","3.1.2","3.1.2-rc1","3.1.2-rc2","3.1.3","3.1.4","3.1.4-rc1","3.1.5","3.1.5-rc1","3.1.6","3.1.7","3.1.8","3.1.9","3.2.0","3.2.0-rc1","3.2.0-rc2","3.2.1","3.2.10","3.2.11","3.2.12","3.2.13","3.2.13-rc1","3.2.13-rc2","3.2.15","3.2.15-rc3","3.2.16","3.2.17","3.2.18","3.2.2","3.2.2-rc1","3.2.21","3.2.22.2","3.2.3","3.2.3-rc1","3.2.3-rc2","3.2.4","3.2.4-rc1","3.2.5","3.2.6","3.2.7","3.2.7-rc1","3.2.8","3.2.8-rc1","3.2.8-rc2","3.2.9","3.2.9-rc1","3.2.9-rc2","3.2.9-rc3","4.0.0-NA","4.0.0-beta","4.0.0-rc1","4.0.0-rc2","4.0.1-NA","4.0.1-rc1","4.0.1-rc2","4.0.1-rc3","4.0.1-rc4","4.0.10","4.0.10-rc1","4.0.2","4.0.3","4.0.4","4.0.4-rc1","4.0.5","4.0.6","4.0.6-rc1","4.0.6-rc2","4.0.6-rc3","4.0.7","4.0.8","4.0.9","4.1.0-NA","4.1.0-beta1","4.1.0-beta2","4.1.0-rc1","4.1.0-rc2","4.1.1","4.1.10","4.1.10-rc1","4.1.10-rc2","4.1.10-rc3","4.1.10-rc4","4.1.12","4.1.12-rc1","4.1.13","4.1.13-rc1","4.1.14","4.1.14-rc1","4.1.14-rc2","4.1.14.2","4.1.15","4.1.15-rc1","4.1.16","4.1.16-rc1","4.1.2","4.1.2-rc1","4.1.2-rc2","4.1.2-rc3","4.1.3","4.1.4","4.1.5","4.1.6","4.1.6-rc1","4.1.6-rc2","4.1.7","4.1.7.1","4.1.8","4.1.9","4.1.9-rc1","4.2.0","4.2.0-beta1","4.2.0-beta2","4.2.0-beta3","4.2.0-beta4","4.2.0-rc1","4.2.0-rc2","4.2.0-rc3","4.2.1","4.2.1-rc1","4.2.1-rc2","4.2.1-rc3","4.2.1-rc4","4.2.2","4.2.3","4.2.3-rc1","4.2.4","4.2.4-rc1","4.2.5","4.2.5-rc1","4.2.5-rc2","4.2.5.1","4.2.5.2","4.2.6","4.2.6-rc1","4.2.7","4.2.7-rc1","5.0.0-beta1","5.0.0-beta1\\.1","5.0.0-beta2","5.0.0-beta3","5.0.0-beta4","5.0.0-rc1","5.0.0-rc2"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2016-6316.json"}}],"references":[{"type":"WEB","url":"http://www.securityfocus.com/bid/92430"},{"type":"WEB","url":"https://groups.google.com/forum/#%21topic/ruby-security-ann/8B2iV2tPRSE"},{"type":"WEB","url":"https://puppet.com/security/cve/cve-2016-6316"},{"type":"ADVISORY","url":"http://rhn.redhat.com/errata/RHSA-2016-1855.html"},{"type":"ADVISORY","url":"http://rhn.redhat.com/errata/RHSA-2016-1856.html"},{"type":"ADVISORY","url":"http://rhn.redhat.com/errata/RHSA-2016-1857.html"},{"type":"ADVISORY","url":"http://rhn.redhat.com/errata/RHSA-2016-1858.html"},{"type":"ADVISORY","url":"http://weblog.rubyonrails.org/2016/8/11/Rails-5-0-0-1-4-2-7-2-and-3-2-22-3-have-been-released/"},{"type":"ADVISORY","url":"http://www.debian.org/security/2016/dsa-3651"},{"type":"ADVISORY","url":"http://www.openwall.com/lists/oss-security/2016/08/11/3"}],"database_specific":{"unresolved_ranges":[{"cpes":["cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*"],"extracted_events":[{"introduced":"8.0"},{"last_affected":"8.0"}],"source":"CPE_STRING","vendor_product":"debian:debian_linux"},{"cpes":["cpe:2.3:a:rubyonrails:rails:3.0.0:beta:*:*:*:*:*:*"],"extracted_events":[{"introduced":"3.0.0-beta"},{"last_affected":"3.0.0-beta"}],"source":"CPE_STRING","vendor_product":"rubyonrails:rails"},{"cpes":["cpe:2.3:a:rubyonrails:ruby_on_rails:3.0.4:*:*:*:*:*:*:*","cpe:2.3:a:rubyonrails:ruby_on_rails:3.2.14:*:*:*:*:*:*:*","cpe:2.3:a:rubyonrails:ruby_on_rails:3.2.14:rc1:*:*:*:*:*:*","cpe:2.3:a:rubyonrails:ruby_on_rails:3.2.14:rc2:*:*:*:*:*:*","cpe:2.3:a:rubyonrails:ruby_on_rails:3.2.15:rc1:*:*:*:*:*:*","cpe:2.3:a:rubyonrails:ruby_on_rails:3.2.15:rc2:*:*:*:*:*:*","cpe:2.3:a:rubyonrails:ruby_on_rails:3.2.19:*:*:*:*:*:*:*","cpe:2.3:a:rubyonrails:ruby_on_rails:3.2.20:*:*:*:*:*:*:*","cpe:2.3:a:rubyonrails:ruby_on_rails:3.2.22.1:*:*:*:*:*:*:*","cpe:2.3:a:rubyonrails:ruby_on_rails:3.2.22:*:*:*:*:*:*:*","cpe:2.3:a:rubyonrails:ruby_on_rails:4.0.10:rc2:*:*:*:*:*:*","cpe:2.3:a:rubyonrails:ruby_on_rails:4.0.11.1:*:*:*:*:*:*:*","cpe:2.3:a:rubyonrails:ruby_on_rails:4.0.11:*:*:*:*:*:*:*","cpe:2.3:a:rubyonrails:ruby_on_rails:4.0.12:*:*:*:*:*:*:*","cpe:2.3:a:rubyonrails:ruby_on_rails:4.0.13:*:*:*:*:*:*:*","cpe:2.3:a:rubyonrails:ruby_on_rails:4.0.13:rc1:*:*:*:*:*:*","cpe:2.3:a:rubyonrails:ruby_on_rails:4.1.11:*:*:*:*:*:*:*","cpe:2.3:a:rubyonrails:ruby_on_rails:4.1.14.1:*:*:*:*:*:*:*","cpe:2.3:a:rubyonrails:ruby_on_rails:5.0.0:*:*:*:*:*:*:*","cpe:2.3:a:rubyonrails:ruby_on_rails:5.0.0:racecar1:*:*:*:*:*:*"],"extracted_events":[{"introduced":"3.0.4"},{"last_affected":"3.0.4"},{"introduced":"3.2.14"},{"last_affected":"3.2.14"},{"introduced":"3.2.14-rc1"},{"last_affected":"3.2.14-rc1"},{"introduced":"3.2.14-rc2"},{"last_affected":"3.2.14-rc2"},{"introduced":"3.2.15-rc1"},{"last_affected":"3.2.15-rc1"},{"introduced":"3.2.15-rc2"},{"last_affected":"3.2.15-rc2"},{"introduced":"3.2.19"},{"last_affected":"3.2.19"},{"introduced":"3.2.20"},{"last_affected":"3.2.20"},{"introduced":"3.2.22"},{"last_affected":"3.2.22"},{"introduced":"3.2.22.1"},{"last_affected":"3.2.22.1"},{"introduced":"4.0.10-rc2"},{"last_affected":"4.0.10-rc2"},{"introduced":"4.0.11"},{"last_affected":"4.0.11"},{"introduced":"4.0.11.1"},{"last_affected":"4.0.11.1"},{"introduced":"4.0.12"},{"last_affected":"4.0.12"},{"introduced":"4.0.13"},{"last_affected":"4.0.13"},{"introduced":"4.0.13-rc1"},{"last_affected":"4.0.13-rc1"},{"introduced":"4.1.11"},{"last_affected":"4.1.11"},{"introduced":"4.1.14.1"},{"last_affected":"4.1.14.1"},{"introduced":"5.0.0"},{"last_affected":"5.0.0"},{"introduced":"5.0.0-racecar1"},{"last_affected":"5.0.0-racecar1"}],"source":"CPE_STRING","vendor_product":"rubyonrails:ruby_on_rails"}]},"severity":[{"type":"CVSS_V3","score":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"}]}