File _patchinfo of Package patchinfo.75

<patchinfo incident="75">
  <packager>lijews</packager>
  <issue tracker="cve" id="CVE-2013-0183"></issue>
  <issue tracker="cve" id="CVE-2013-0263"></issue>
  <issue tracker="cve" id="CVE-2013-0262"></issue>
  <issue tracker="cve" id="CVE-2013-0277"></issue>
  <issue tracker="cve" id="CVE-2013-0184"></issue>
  <issue tracker="cve" id="CVE-2013-0276"></issue>
  <issue tracker="bnc" id="803336">VUL-0: CVE-2013-0276: rubygem-activerecord*: Circumvention of attr_protected</issue>
  <issue tracker="bnc" id="798452">VUL-0: rubygem-rack*: 3 DoS conditions in Rack</issue>
  <issue tracker="bnc" id="803339">VUL-0: CVE-2013-0277: rubygem-activerecord-2_3: Serialized Attributes YAML Vulnerability with Rails 2.3 and 3.0</issue>
  <category>security</category>
  <rating>moderate</rating>
  <summary>RubyOnRails: security version update to 2.3.17</summary>
  <description>The Ruby on Rails 2.3 stack was updated to 2.3.17.

  The Ruby Rack was updated to 1.1.6.

  The updates fix various security issues and bugs.

- update to version 2.3.17 (bnc#803336, bnc#803339)
  CVE-2013-0276 CVE-2013-0277:

- update to version 2.3.17 (bnc#803336, bnc#803339)
  CVE-2013-0276 CVE-2013-0277:
  - Fix issue with attr_protected where malformed input could
    circumvent protection
  - Fix Serialized Attributes YAML Vulnerability

- update to version 2.3.17 (bnc#803336, bnc#803339)
  CVE-2013-0276 CVE-2013-0277:
  - Fix issue with attr_protected where malformed input could
    circumvent protection
  - Fix Serialized Attributes YAML Vulnerability

- update to 1.1.6 (bnc#802794)
  * Fix CVE-2013-0263, timing attack against Rack::Session::Cookie

</description>
</patchinfo>