CVE-2013-4389

Multiple format string vulnerabilities in log_subscriber.rb files in the log subscriber component in Action Mailer in Ruby on Rails 3.x before 3.2.15 allow remote attackers to cause a denial of service via a crafted e-mail address that is improperly handled during construction of a log message.

• CWE-134

• http://lists.opensuse.org/opensuse-updates/2013-12/msg00091.htmlMailing List, Third Party Advisory
• http://lists.opensuse.org/opensuse-updates/2013-12/msg00094.htmlMailing List, Third Party Advisory
• http://lists.opensuse.org/opensuse-updates/2014-01/msg00003.htmlMailing List, Third Party Advisory
• http://www.debian.org/security/2014/dsa-2887Third Party Advisory
• http://www.debian.org/security/2014/dsa-2888Third Party Advisory
• https://groups.google.com/forum/message/raw?msg=ruby-security-ann/yvlR1Vx44c8/elKJkpO2KVgJBroken Link, Exploit
• http://lists.opensuse.org/opensuse-updates/2013-12/msg00091.htmlMailing List, Third Party Advisory
• http://lists.opensuse.org/opensuse-updates/2013-12/msg00094.htmlMailing List, Third Party Advisory
• http://lists.opensuse.org/opensuse-updates/2014-01/msg00003.htmlMailing List, Third Party Advisory
• http://www.debian.org/security/2014/dsa-2887Third Party Advisory
• http://www.debian.org/security/2014/dsa-2888Third Party Advisory
• https://groups.google.com/forum/message/raw?msg=ruby-security-ann/yvlR1Vx44c8/elKJkpO2KVgJBroken Link, Exploit

Published

Oct 17, 2013

Last Modified

Jun 16, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2013-4383Cross-site scripting (XSS) vulnerability in the jQuery Count…
• CVE-2013-4384Cross-site scripting (XSS) vulnerability in Google Site Sear…
• CVE-2013-4385Buffer overflow in the "read-string!" procedure in the "extr…
• CVE-2013-4386Multiple SQL injection vulnerabilities in app/models/concern…
• CVE-2013-4387net/ipv6/ip6_output.c in the Linux kernel through 3.11.4 doe…
• CVE-2013-4388Buffer overflow in the mp4a packetizer (modules/packetizer/m…
• CVE-2013-4390Open redirect vulnerability in the AbstractAuthenticationFor…
• CVE-2013-4391Integer overflow in the valid_user_field function in journal…
• CVE-2013-4392systemd, when updating file permissions, allows local users …5
• CVE-2013-4393journald in systemd, when the origin of native messages is s…
• CVE-2013-4394The SetX11Keyboard function in systemd, when PolicyKit Local…
• CVE-2013-4395Simple Machines Forum (SMF) through 2.0.5 has XSS6.1