CVE-2016-2339: Buffer Overflow
An exploitable heap overflow vulnerability exists in the Fiddle::Function.new "initialize" function functionality of Ruby. In Fiddle::Function.new "initialize" heap buffer "argtypes" allocation is made based on args array length. Specially constructed object passed as element of args array can increase this array size after mentioned allocation and cause heap overflow.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2016-2339?
CVE-2016-2339 is considered a critical vulnerability due to its potential for remote code execution.
How do I fix CVE-2016-2339?
To fix CVE-2016-2339, upgrade Ruby to a version where the vulnerability is patched, specifically Ruby 2.4.0 or later.
What software versions are affected by CVE-2016-2339?
CVE-2016-2339 affects Ruby versions 2.2.2 and 2.3.0.
What type of attack can exploit CVE-2016-2339?
An attacker can exploit CVE-2016-2339 through specially crafted inputs sent to the Fiddle::Function.new function.
Is CVE-2016-2339 being actively exploited in the wild?
As of the latest updates, CVE-2016-2339 has been recognized for potential exploitation but requires specific conditions to be successful.