CVE-2016-2339
Fixed in a distro release EPSS 5%
An exploitable heap overflow vulnerability exists in the Fiddle::Function.new "initialize" function functionality of Ruby. In Fiddle::Function.new "initialize" heap buffer "arg_types" allocation is made based on args array length. Specially constructed object passed as element of args array can increase this array size after mentioned allocation and cause heap overflow.
Products: Ruby
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Debian:8 | ruby2.1 | 2.1.5-2+deb8u4 |
| SUSE:Enterprise Storage 5 | ruby2.1 | 2.1.9-19.3.2 |
| SUSE:HPE Helion OpenStack 8 | ruby2.1 | 2.1.9-19.3.2 |
| SUSE:Linux Enterprise Desktop 12 SP1 | ruby2.1 | 2.1.9-15.1 |
| SUSE:Linux Enterprise Desktop 12 SP2 | ruby2.1 | 2.1.9-15.1 |
| SUSE:Linux Enterprise Server 12 SP1 | ruby2.1 | 2.1.9-15.1 |
| SUSE:Linux Enterprise Server 12 SP2 | ruby2.1 | 2.1.9-15.1 |
| SUSE:Linux Enterprise Server 12 SP2-BCL | ruby2.1 | 2.1.9-19.3.2 |
| SUSE:Linux Enterprise Server 12 SP2-BCL | yast2-ruby-bindings | 3.1.53-9.8.1 |
| SUSE:Linux Enterprise Server 12 SP2-LTSS | ruby2.1 | 2.1.9-19.3.2 |
| SUSE:Linux Enterprise Server 12 SP2-LTSS | yast2-ruby-bindings | 3.1.53-9.8.1 |
| SUSE:Linux Enterprise Server 12 SP3-BCL | ruby2.1 | 2.1.9-19.3.2 |
| SUSE:Linux Enterprise Server 12 SP3-LTSS | ruby2.1 | 2.1.9-19.3.2 |
| SUSE:Linux Enterprise Server 12 SP4 | ruby2.1 | 2.1.9-19.3.2 |
| SUSE:Linux Enterprise Server 12 SP5 | ruby2.1 | 2.1.9-19.3.2 |
| SUSE:Linux Enterprise Server for Raspberry Pi 12 SP2 | ruby2.1 | 2.1.9-15.1 |
| SUSE:Linux Enterprise Server for SAP Applications 12 SP1 | ruby2.1 | 2.1.9-15.1 |
| SUSE:Linux Enterprise Server for SAP Applications 12 SP2 | ruby2.1 | 2.1.9-15.1 |
| SUSE:Linux Enterprise Server for SAP Applications 12 SP2 | ruby2.1 | 2.1.9-19.3.2 |
| SUSE:Linux Enterprise Server for SAP Applications 12 SP2 | yast2-ruby-bindings | 3.1.53-9.8.1 |
| SUSE:Linux Enterprise Server for SAP Applications 12 SP3 | ruby2.1 | 2.1.9-19.3.2 |
| SUSE:Linux Enterprise Server for SAP Applications 12 SP4 | ruby2.1 | 2.1.9-19.3.2 |
| SUSE:Linux Enterprise Server for SAP Applications 12 SP5 | ruby2.1 | 2.1.9-19.3.2 |
| SUSE:Linux Enterprise Software Development Kit 12 SP1 | ruby2.1 | 2.1.9-15.1 |
| SUSE:Linux Enterprise Software Development Kit 12 SP2 | ruby2.1 | 2.1.9-15.1 |
| SUSE:Linux Enterprise Software Development Kit 12 SP4 | ruby2.1 | 2.1.9-19.3.2 |
| SUSE:Linux Enterprise Software Development Kit 12 SP5 | ruby2.1 | 2.1.9-19.3.2 |
| SUSE:OpenStack Cloud 7 | ruby2.1 | 2.1.9-19.3.2 |
| SUSE:OpenStack Cloud 7 | yast2-ruby-bindings | 3.1.53-9.8.1 |
| SUSE:OpenStack Cloud 8 | ruby2.1 | 2.1.9-19.3.2 |
| SUSE:OpenStack Cloud Crowbar 8 | ruby2.1 | 2.1.9-19.3.2 |
| SUSE:Studio Onsite 1.3 | ruby19 | 1.9.3.p392-0.26.1 |
| SUSE:Studio Onsite Runner 1.3 | ruby19 | 1.9.3.p392-0.26.1 |
| Ubuntu:14.04:LTS | ruby1.9.1 | 1.9.3.484-2ubuntu1.3 |
| Ubuntu:14.04:LTS | ruby2.0 | 2.0.0.484-1ubuntu2.4 |
| Ubuntu:16.04:LTS | ruby2.3 | 2.3.1-2~16.04.2 |