CVE-2016-2336: Critical severity ruby vulnerability
Published Jan 6, 2017
·Updated
Type confusion exists in two methods of Ruby's WIN32OLE class, oleinvoke and olequeryinterface. Attacker passing different type of object than this assumed by developers can cause arbitrary code execution.
Affected Software
2 affected components
ruby-lang Ruby=2.2.2
ruby-lang Ruby=2.3.0
Event History
Jan 6, 2017
CVE Published
via MITRE·09:00 PM
Data Sourced
via MITRE·09:00 PM
DescriptionWeakness
Data Sourced
via NVD·09:59 PM
DescriptionSeverityAffected Software
Frequently Asked Questions
1
What is the severity of CVE-2016-2336?
CVE-2016-2336 has a high severity due to the potential for arbitrary code execution.
2
How do I fix CVE-2016-2336?
To fix CVE-2016-2336, update Ruby to a version higher than 2.3.0 that addresses this vulnerability.
3
Which versions of Ruby are affected by CVE-2016-2336?
CVE-2016-2336 affects Ruby versions 2.2.2 and 2.3.0.
4
What is the nature of the vulnerability in CVE-2016-2336?
The vulnerability in CVE-2016-2336 is a type confusion in the WIN32OLE class that can lead to arbitrary code execution.
5
Can exploiting CVE-2016-2336 allow remote code execution?
Yes, exploiting CVE-2016-2336 can allow an attacker to execute arbitrary code remotely.