CVE-2016-0753: debian debian_linux
Vulnerability summary
CVE-2016-0753 is a medium (CVSS 5.3) vulnerability in debian debian_linux. EPSS estimates a 7.16% chance of exploitation in the next 30 days, higher than 94.2% of scored vulnerabilities.
Not severe (CVSS 5.3, network access); no exploitation reported by the 5 checked sources
Source freshness unavailable
How is this decided?Advisory lineage
Upstream 0 · Downstream 7 · Related 5Timeline
- 16-02-2016PublishedVulnerability first disclosed.
- 05-08-2024Last modifiedVulnerability information updated.
Description
Active Model in Ruby on Rails 4.1.x before 4.1.14.1, 4.2.x before 4.2.5.1, and 5.x before 5.0.0.beta1.1 supports the use of instance-level writers for class accessors, which allows remote attackers to bypass intended validation steps via crafted parameters.
CVSS metrics
6 scores · 4 sources · 3 versions- OSV · UbuntuEcosystem advisory · calculated5.3MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
- OSV · DebianEcosystem advisory · calculated5.3MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
- OSV · RubygemsEcosystem advisory · calculated5.3MediumCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
EPSS trend
Probability
7.16%
Chance of exploitation in the next 30 days
Percentile
94%
Versus all other CVEs
30-day change
No change 0.00 pp
From 7.16% on 04-10-2026
Known exploited
Compare KEV catalogs
CISA KEVNot in the CISA KEV catalog.
ENISA CNWNot in the ENISA CNW catalog.
CIRCLNot in the CIRCL catalog.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeNo weakness data has been published for this record.
Affected systems
Known conditions: network-reachable, no authentication, no user interaction (CVSS vector). Other conditions: not stated in public data.
Debian5 products
- rails< 2:4.2.5.1-1
- ruby-activemodel-3.2< 3.2.6-3+deb7u1
- ruby-activerecord-3.2< 3.2.6-5+deb7u3
- ruby-activesupport-3.2< 3.2.6-6+deb7u3
- debian_linuxEOL8.0
Suse2 products
- rubygem-activemodel-4_1&distro=SUSE OpenStack Cloud 5< 4.1.9-9.1
- rubygem-activemodel-4_2&distro=SUSE Enterprise Storage 2.1< 4.2.2-5.1
Fedoraproject1 product
- fedoraEOL22 | 23
Opensuse1 product
- leapEOL42.1
RubyGems1 product
- activemodel≥ 4.1.0, < 4.1.14.1 | ≥ 4.2.0, < 4.2.5.1
Rubyonrails1 product
- railsEOL≥ 4.1.0, < 4.1.14.1 | ≥ 4.2.0, < 4.2.5.1 | 5.0.0:beta1
Ubuntu1 product
- rails< 2:4.2.5.1-1
7 vendors · 12 products
References
28 links- www.openwall.com/lists/oss-security/2016/01/25/14Mailing ListX Refsource MLISTThird Party AdvisoryWEB
- groups.google.com/forum/message/raw?msg=ruby-security-ann/6jQVC1geukQ/3Iy0GU1ZEgAJMailing ListX Refsource MLISTBroken Link
- lists.opensuse.org/opensuse-updates/2016-02/msg00043.htmlVendor AdvisoryX Refsource SUSEMailing ListThird Party AdvisoryWEB
- lists.fedoraproject.org/pipermail/package-announce/2016-February/178043.htmlVendor AdvisoryX Refsource FEDORAMailing ListThird Party AdvisoryWEB
- lists.fedoraproject.org/pipermail/package-announce/2016-February/178041.htmlVendor AdvisoryX Refsource FEDORAMailing ListThird Party AdvisoryWEB
- lists.fedoraproject.org/pipermail/package-announce/2016-February/178065.htmlVendor AdvisoryX Refsource FEDORAMailing ListThird Party AdvisoryWEB
- lists.opensuse.org/opensuse-security-announce/2016-04/msg00053.htmlVendor AdvisoryX Refsource SUSEMailing ListThird Party AdvisoryWEB
Show all 28 references
- lists.fedoraproject.org/pipermail/package-announce/2016-February/178066.htmlVendor AdvisoryX Refsource FEDORAMailing ListThird Party AdvisoryWEB
- lists.fedoraproject.org/pipermail/package-announce/2016-February/178047.htmlVendor AdvisoryX Refsource FEDORAMailing ListThird Party AdvisoryWEB
- bugzilla.suse.com/963334REPORT
- github.com/rails/railsPACKAGE