Ohne Score

CVE-2016-2339

Ruby Ruby Veröffentlicht: 2017-01-07 00:00 (vor 9 Jahren)

Beschreibung

An exploitable heap overflow vulnerability exists in the Fiddle::Function.new "initialize" function functionality of Ruby. In Fiddle::Function.new "initialize" heap buffer "arg_types" allocation is made based on args array length. Specially constructed object passed as element of args array can increase this array size after mentioned allocation and cause heap overflow.

Daten: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Wiedergegeben wie in der Quelle, auf Englisch.

Betroffene Produkte und Versionen

Hersteller	Produkt	Versionen
Ruby	Ruby	2.3.0 dev, 2.2.2

Referenzen und Patches

[debian-lts-announce] 20180714 [SECURITY] [DLA 1421-1] ruby2.1 security update mailing-list
91234 vdb-entry
http://www.talosintelligence.com/reports/TALOS-2016-0034/

CVSS-Score

Noch nicht bewertet. Erscheint hier, sobald CNA, CISA oder NVD bewerten.

EPSS (Ausnutzungswahrscheinlichkeit in 30 Tagen)

5.14%

höher als 92 % aller CVEs

Zeitverlauf

ID reserviert2016-02-12
Veröffentlicht2017-01-07 00:00
Bei IP-DB eingegangen2026-10-24 23:53
Zuletzt aktualisiert2024-08-06 02:24

Vergeben von (CNA): certcc

In der Quelle ansehen: CVE.org · NVD

Benachrichtigung bei neuen Schwachstellen in diesen Produkten

E-Mail-Warnungen aktivieren

Kostenlos · mit Konto · jederzeit abbestellbar

Neue CVEs im selben Produkt — Ruby

10.0Kritisch

CVE-2026-97229 KEV vor 21 Tagen

Integer Overflow or Wraparound in GitLab

GitLab GitLab

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 19.2 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2 that, under certain conditions, could have allowed an unauthenticated user to execute arbitrary code on the GitLab server…

27%EPSS

8.1Hoch

CVE-2026-46727 vor 5 Monaten

ruby-lang Ruby

An issue was discovered in Ruby 4 before 4.0.5. A race condition leading to a use-after-free in the pthread-based getaddrinfo timeout handler (rb_getaddrinfo in ext/socket/raddrinfo.c) allows a remote attacker who can delay DNS responses near the user-specifi…

7.4Hoch

CVE-2025-0306 vor 1 Jahr

Ruby: openssl: ruby marvin attack

Ruby; Red Hat Red Hat Enterprise Linux 10; Red Hat Red Hat Enterprise Linux 6; Red Hat Red Hat Enterprise Linux 7

A vulnerability was found in Ruby. The Ruby interpreter is vulnerable to the Marvin Attack. This attack allows the attacker to decrypt previously encrypted messages or forge signatures by exchanging a large number of messages with the vulnerable service.

9.8Kritisch

CVE-2024-27280 vor 2 Jahren

ruby-lang ruby

A buffer-overread issue was discovered in StringIO 3.0.1, as distributed in Ruby 3.0.x through 3.0.6 and 3.1.x through 3.1.4. The ungetbyte and ungetc methods on a StringIO can read past the end of a string, and a subsequent call to StringIO.gets may return t…

2.4%EPSS

Ohne Score

CVE-2015-1855 vor 6 Jahren

Ruby Ruby

verify_certificate_identity in the OpenSSL extension in Ruby before 2.0.0 patchlevel 645, 2.1.x before 2.1.6, and 2.2.x before 2.2.2 does not properly validate hostnames, which allows remote attackers to spoof servers via vectors related to (1) multiple wildc…

2.8%EPSS

Ohne Score

CVE-2011-3624 vor 6 Jahren

Ruby Ruby

Various methods in WEBrick::HTTPRequest in Ruby 1.9.2 and 1.8.7 and earlier do not validate the X-Forwarded-For, X-Forwarded-Host and X-Forwarded-Server headers in requests, which might allow remote attackers to inject arbitrary text into log files or bypass …

1.5%EPSS