CVE-2016-2339: ruby-lang ruby

Vulnerability summary

CVE-2016-2339 is a critical (CVSS 9.8) vulnerability in ruby-lang ruby. EPSS estimates a 5.14% chance of exploitation in the next 30 days, higher than 92.4% of scored vulnerabilities. 1 public exploit is recorded.

Timeline

1. 06-01-2017
   PublishedVulnerability first disclosed.
2. 05-08-2024
   Last modifiedVulnerability information updated.

Description

An exploitable heap overflow vulnerability exists in the Fiddle::Function.new "initialize" function functionality of Ruby. In Fiddle::Function.new "initialize" heap buffer "arg_types" allocation is made based on args array length. Specially constructed object passed as element of args array can increase this array size after mentioned allocation and cause heap overflow.

• CWE-119Improper Restriction of Operations within the Bounds of a Memory BufferThe product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary.