IP-DB.com
Türkçe English Deutsch Español
Anmelden API-Schlüssel holen
Ohne Score

CVE-2016-2337

Ruby Ruby; Tcl Tcl/Tk Veröffentlicht: (vor 9 Jahren)

Beschreibung

Type confusion exists in _cancel_eval Ruby's TclTkIp class method. Attacker passing different type of object than String as "retval" argument can cause arbitrary code execution.

Daten: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Wiedergegeben wie in der Quelle, auf Englisch.

Betroffene Produkte und Versionen

HerstellerProduktVersionen
Ruby Ruby 2.3.0 dev, 2.2.2
Tcl Tcl/Tk 8.6 or later

Referenzen und Patches

Neue CVEs im selben Produkt — Ruby

10.0Kritisch
CVE-2026-97229 KEV

Integer Overflow or Wraparound in GitLab

GitLab GitLab

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 19.2 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2 that, under certain conditions, could have allowed an unauthenticated user to execute arbitrary code on the GitLab server…

69%EPSS
8.1Hoch
CVE-2026-46727
ruby-lang Ruby

An issue was discovered in Ruby 4 before 4.0.5. A race condition leading to a use-after-free in the pthread-based getaddrinfo timeout handler (rb_getaddrinfo in ext/socket/raddrinfo.c) allows a remote attacker who can delay DNS responses near the user-specifi…

7.4Hoch
CVE-2025-0306

Ruby: openssl: ruby marvin attack

Ruby; Red Hat Red Hat Enterprise Linux 10; Red Hat Red Hat Enterprise Linux 6; Red Hat Red Hat Enterprise Linux 7

A vulnerability was found in Ruby. The Ruby interpreter is vulnerable to the Marvin Attack. This attack allows the attacker to decrypt previously encrypted messages or forge signatures by exchanging a large number of messages with the vulnerable service.

9.8Kritisch
CVE-2024-27280
ruby-lang ruby

A buffer-overread issue was discovered in StringIO 3.0.1, as distributed in Ruby 3.0.x through 3.0.6 and 3.1.x through 3.1.4. The ungetbyte and ungetc methods on a StringIO can read past the end of a string, and a subsequent call to StringIO.gets may return t…

2.4%EPSS
Ohne Score
CVE-2015-1855
Ruby Ruby

verify_certificate_identity in the OpenSSL extension in Ruby before 2.0.0 patchlevel 645, 2.1.x before 2.1.6, and 2.2.x before 2.2.2 does not properly validate hostnames, which allows remote attackers to spoof servers via vectors related to (1) multiple wildc…

2.8%EPSS
Ohne Score
CVE-2011-3624
Ruby Ruby

Various methods in WEBrick::HTTPRequest in Ruby 1.9.2 and 1.8.7 and earlier do not validate the X-Forwarded-For, X-Forwarded-Host and X-Forwarded-Server headers in requests, which might allow remote attackers to inject arbitrary text into log files or bypass …

1.5%EPSS