UBUNTU-CVE-2016-2339
Advisory lineage Upstream: 1 Downstream: 1
Upstream
Downstream
Published: 06 Jan 2017, 00:00
Last modified:22 Apr 2026, 10:23
Vulnerability Summary
Overall Risk (default)
high
70/100 CVSS Score
9.8 CRITICAL
3.0 (osv_ubuntu)
EPSS Score
No data
KEV
Not listed
Ransomware
No reports
Public exploits
None found
Dark Web
Not detected
Timeline
06 Jan 2017, 00:00
Published
Vulnerability first disclosed
22 Apr 2026, 10:23
Last Modified
Vulnerability information updated
Description
An exploitable heap overflow vulnerability exists in the Fiddle::Function.new "initialize" function functionality of Ruby. In Fiddle::Function.new "initialize" heap buffer "arg_types" allocation is made based on args array length. Specially constructed object passed as element of args array can increase this array size after mentioned allocation and cause heap overflow.
CVSS Metrics
- v3.0•CRITICAL•Score: 9.8CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected Systems
- ubuntu•ruby1.9.1
< 1.9.3.484-2ubuntu1.3
- ubuntu•ruby2.0
< 2.0.0.484-1ubuntu2.4