CVE-2016-2337 Type confusion exists in _cancel_eval Ruby's TclTkIp class method. Attacker passing different type of object than String as "retval" argument can cause arbitrary code execution.
CriticalCVSS 9.8
EPSS 6.2%
- Published
- Updated
- Exploit status
- No public exploit known
Description
Type confusion exists in _cancel_eval Ruby's TclTkIp class method. Attacker passing different type of object than String as "retval" argument can cause arbitrary code execution.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| ruby-lang ruby | = 2.2.2 | No fix listed |
| ruby-lang ruby | = 2.3.0 | No fix listed |
| Ruby | = 2.3.0 dev | No fix listed |
| Ruby | = 2.2.2 | No fix listed |
| tcltk | = 8.6 or later | No fix listed |
References
- 91233 vdb-entry
- www.talosintelligence.com exploit technical-description third-party-advisory vdb-entry
- [debian-lts-announce] 20180827 [SECURITY] [DLA 1480-1] ruby2.1 security update mailing-list
- GLSA-201710-18 vendor-advisory