CVE-2016-2339

Critical

Published: 06/01/2017(UTC)Translated: 14/06/2026(UTC)NVD NIST

Summary

CVE-2016-2339 describes a heap overflow vulnerability in the 'initialize' function of Fiddle::Function.new in Ruby. A specially crafted object passed as an element of the args array can increase the size of this array after allocation, leading to a heap overflow.

Risk Assessment

Heap overflow can lead to unauthorized memory access, creating a risk of executing malicious code and potentially compromising the system.

Recommendation

It is recommended to update Ruby to the latest version where this vulnerability has been patched, and to review the code to identify and eliminate potential instances of this overflow.

Original NVD description (English source)

An exploitable heap overflow vulnerability exists in the Fiddle::Function.new "initialize" function functionality of Ruby. In Fiddle::Function.new "initialize" heap buffer "arg_types" allocation is made based on args array length. Specially constructed object passed as element of args array can increase this array size after mentioned allocation and cause heap overflow.