CVE Catalog
CVE-2016-2337
CriticalSummary
Type confusion exists in the TclTkIp class method _cancel_eval in Ruby. An attacker passing a different type of object than String as the 'retval' argument can cause arbitrary code execution.
Risk Assessment
The organization may be exposed to remote code execution, potentially leading to serious security breaches and data loss.
Recommendation
It is recommended to update Ruby to the latest version to mitigate this vulnerability and review the code to verify the types of passed arguments.
Original NVD description (English source)
Type confusion exists in _cancel_eval Ruby's TclTkIp class method. Attacker passing different type of object than String as "retval" argument can cause arbitrary code execution.