CVE-2016-2336 Type confusion exists in two methods of Ruby's WIN32OLE class, ole_invoke and ole_query_interface. Attacker passing different type of object than this assumed by developers can cause arbitrary code ex...
CriticalCVSS 9.8
EPSS 3.4%
- Published
- Updated
- Exploit status
- No public exploit known
Description
Type confusion exists in two methods of Ruby's WIN32OLE class, ole_invoke and ole_query_interface. Attacker passing different type of object than this assumed by developers can cause arbitrary code execution.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| ruby-lang ruby | = 2.2.2 | No fix listed |
| ruby-lang ruby | = 2.3.0 | No fix listed |
| Ruby | = 2.3.0 dev | No fix listed |
| Ruby | = 2.2.2 | No fix listed |
References
- www.talosintelligence.com exploit technical-description third-party-advisory