CVE-2016-2338

See a problem?
Source
https://nvd.nist.gov/vuln/detail/CVE-2016-2338
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2016-2338.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2016-2338
Related
Published
2022-09-29T03:15:11Z
Modified
2024-09-03T00:02:59Z
Severity
  • 9.8 (Critical) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CVSS Calculator
Summary
[none]
Details

An exploitable heap overflow vulnerability exists in the Psych::Emitter startdocument function of Ruby. In Psych::Emitter startdocument function heap buffer "head" allocation is made based on tags array length. Specially constructed object passed as element of tags array can increase this array size after mentioned allocation and cause heap overflow.

References

Affected packages

Git / github.com/ruby/ruby

Affected ranges

Type
GIT
Repo
https://github.com/ruby/ruby
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
Last affected