CVE Catalog
CVE-2016-2336
CriticalSummary
Type confusion exists in the WIN32OLE class in Ruby in the ole_invoke and ole_query_interface methods. An attacker passing a different type of object than assumed by developers can cause arbitrary code execution.
Risk Assessment
The organization may be exposed to remote code execution, potentially leading to data loss or system takeover.
Recommendation
It is recommended to update Ruby to the latest version to mitigate this vulnerability and review the code to ensure proper type validation.
Original NVD description (English source)
Type confusion exists in two methods of Ruby's WIN32OLE class, ole_invoke and ole_query_interface. Attacker passing different type of object than this assumed by developers can cause arbitrary code execution.