p PatchFirst

CVE-2016-2339

CVE-2016-2339

This page contains facts from public vulnerability sources. Check the original advisory before updating.

An exploitable heap overflow vulnerability exists in the Fiddle::Function.new "initialize" function functionality of Ruby. In Fiddle::Function.new "initialize" heap buffer "arg_types" allocation is made based on args array length. Specially constructed object passed as element of args array can increase this array size after mentioned allocation and cause heap overflow.

CVSS 9.8 · Critical · EPSS 5.1% · Fix available

Published
Updated

Stack: system

Affected products and versions

  • ruby

    Versions
    • 2.3.0 dev: Affected
    • 2.2.2: Affected

    No fix published

  • ruby1.9.1 Ubuntu:14.04:LTS

    Versions
    • 1.9.3.194-8.1ubuntu2
    • 1.9.3.448-1ubuntu1
    • 1.9.3.448-1ubuntu2
    • 1.9.3.484-1ubuntu1
    • 1.9.3.484-1ubuntu2
    • 1.9.3.484-2ubuntu1
    • 1.9.3.484-2ubuntu1.1
    • 1.9.3.484-2ubuntu1.2
    Affected ranges
    • ECOSYSTEM: < 1.9.3.484-2ubuntu1.3

    Update to 1.9.3.484-2ubuntu1.3

  • ruby2.0 Ubuntu:14.04:LTS

    Versions
    • 2.0.0.299-2
    • 2.0.0.343-1
    • 2.0.0.343-1ubuntu1
    • 2.0.0.353-1
    • 2.0.0.353-1ubuntu1
    • 2.0.0.484-1ubuntu1
    • 2.0.0.484-1ubuntu2
    • 2.0.0.484-1ubuntu2.1
    • 2.0.0.484-1ubuntu2.2
    Affected ranges
    • ECOSYSTEM: < 2.0.0.484-1ubuntu2.4

    Update to 2.0.0.484-1ubuntu2.4

Original sources

Check your server →