CVE-2016-2338: Critical severity ruby vulnerability
An exploitable heap overflow vulnerability exists in the Psych::Emitter startdocument function of Ruby. In Psych::Emitter startdocument function heap buffer "head" allocation is made based on tags array length. Specially constructed object passed as element of tags array can increase this array size after mentioned allocation and cause heap overflow.
Affected Software
Event History
Frequently Asked Questions
What is CVE-2016-2338?
CVE-2016-2338 is an exploitable heap overflow vulnerability in the Psych::Emitter start_document function of Ruby.
How severe is CVE-2016-2338?
CVE-2016-2338 is classified as critical with a severity score of 9.8 out of 10.
Which software versions are affected by CVE-2016-2338?
CVE-2016-2338 affects Ruby 2.2.2, Ruby 2.3.0, and Debian Linux 8.0.
How can I fix CVE-2016-2338?
To fix CVE-2016-2338, update to a patched version of Ruby or apply the recommended security updates for Debian Linux.
Where can I find more information about CVE-2016-2338?
You can find more information about CVE-2016-2338 in the following references: http://www.talosintelligence.com/reports/TALOS-2016-0032/, https://lists.debian.org/debian-lts-announce/2020/03/msg00032.html, https://security.netapp.com/advisory/ntap-20221228-0005/