--- title: "CVE-2007-5379\n | Ubuntu" description: Ubuntu is an open source software operating system that runs from the desktop, to the cloud, to all your internet connected things. url: https://ubuntu.com/security/CVE-2007-5379?format=md keywords: index, follow --- # CVE-2007-5379 Publication date 19 October 2007 Last updated 24 July 2024 --- Ubuntu priority **Low** [Why this priority?](https://ubuntu.com/security/cves/about#priority ) Toggle side navigation ## Description Rails before 1.2.4, as used for Ruby on Rails, allows remote attackers and ActiveResource servers to determine the existence of arbitrary files and read arbitrary XML files via the Hash.from\_xml (Hash#from\_xml) method, which uses XmlSimple (XML::Simple) unsafely, as demonstrated by reading passwords from the Pidgin (Gaim) .purple/accounts.xml file. ## Status Show unmaintained releases | Package | Ubuntu Release | Status | | --- | --- | --- | | rails | 9.10 karmic | Not affected | | 9.04 jaunty | Not affected | | 8.10 intrepid | Not affected | | 8.04 LTS hardy | Not affected | | 7.10 gutsy | Not affected | | 7.04 feisty | Ignored end of life, was needed | | 6.10 edgy | Ignored end of life, was needed | | 6.06 LTS dapper | Ignored end of life | --- * [How can I get the fixes?](https://ubuntu.com/security/cves/about#security) * [What do statuses mean?](https://ubuntu.com/security/cves/about#statuses) ## References * [MITRE](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-5379) * [NVD](https://nvd.nist.gov/vuln/detail/CVE-2007-5379) * [Launchpad](https://launchpad.net/bugs/cve/CVE-2007-5379) * [Debian](https://security-tracker.debian.org/tracker/CVE-2007-5379) ### Other references * * *