I&#x27;ve grouped the patches for 4.1 and 4.2 here: <a href="https:&#x2F;&#x2F;drive.google.com&#x2F;file&#x2F;d&#x2F;0BwnrE2iUdypUMkpqWVVPTXNzNVU&#x2F;view" rel="nofollow">https:&#x2F;&#x2F;drive.google.com&#x2F;file&#x2F;d&#x2F;0BwnrE2iUdypUMkpqWVVPTXNzNVU...</a> -- because download one by one is boring. Don&#x27;t trust me, verify each file before patching. Some comments:<p>[CVE-2015-7581] Object leak vulnerability for wildcard controller routes in Action Pack:
Look for routes that contain &quot;:controller&quot; and change it to something else. Hopefully you didn&#x27;t have this weird name in your routes.<p>[CVE-2015-7578&#x2F;79] Possible XSS vulnerability in rails-html-sanitizer: You&#x27;re safe if you use a single page application that properly encode for you. Stripping tags isn&#x27;t the best way anyway to filter XSS, so if you&#x27;re encoding, you&#x27;re good.<p>[CVE-2016-0753] Possible Input Validation Circumvention in Active Model: params.permit! is negligence, you should not be doing that anyway<p>[CVE-2016-0752] Possible Information Leak Vulnerability in Action View: render params[:id] is not defensive programming, so you should not be doing that too<p>[CVE-2015-7577] Nested attributes rejection proc bypass in Active Record: Only if using nested_attributes and rejection proc. Wasn&#x27;t my case. Just patch.<p>[CVE-2016-0751] Possible Object Leak and Denial of Service attack in Action Pack: DoS is bad, just patch.<p>[CVE-2015-7576] Timing attack vulnerability in basic authentication in Action Controller: Just patch.<p>--
Doesn&#x27;t look THAT bad, but need to be patched fast.