CVE-2016-2337: Critical severity ruby vulnerability
Published Jan 6, 2017
·Updated
Last updated 24 July 2024
Other sources
Type confusion exists in canceleval Ruby's TclTkIp class method. Attacker passing different type of object than String as "retval" argument can cause arbitrary code execution.
Affected Software
3 affected components
debian/ruby2.1
ruby-lang Ruby=2.2.2
ruby-lang Ruby=2.3.0
Remediation
Event History
Jan 6, 2017
CVE Published
via MITRE·09:00 PM
Data Sourced
via MITRE·09:00 PM
DescriptionWeakness
Data Sourced
via NVD·09:59 PM
DescriptionSeverityAffected Software
Jan 11, 2024
Data Sourced
via Launchpad·10:16 PM
Description
Sep 16, 2024
Data Sourced
via Ubuntu·01:12 AM
RemedyDescriptionSeverityAffected Software
Frequently Asked Questions
1
What is the severity of CVE-2016-2337?
CVE-2016-2337 is classified as a high-severity vulnerability due to its potential for arbitrary code execution.
2
How do I fix CVE-2016-2337?
To mitigate CVE-2016-2337, upgrade Ruby to a version that is not affected, such as Ruby 2.3.1 or later.
3
What software is affected by CVE-2016-2337?
CVE-2016-2337 affects Ruby versions 2.1, 2.2.2, and 2.3.0.
4
What type of vulnerability is CVE-2016-2337?
CVE-2016-2337 is a type confusion vulnerability that can lead to arbitrary code execution.
5
Can CVE-2016-2337 be exploited remotely?
Yes, an attacker can exploit CVE-2016-2337 remotely by passing a non-string object as an argument.