CVE-2016-2336 Memory corruption in Ruby
A type confusion vulnerability in Ruby's WIN32OLE class allows attackers to execute arbitrary code by passing unexpected object types.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2016-2336?
CVE-2016-2336 is a critical memory corruption vulnerability in Ruby-Lang Ruby, published on 6 Jan 2017. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Type confusion exists in two methods of Ruby's WIN32OLE class, ole_invoke and ole_query_interface. Attacker passing different type of object than this assumed by developers can cause arbitrary code execution.
Which versions are affected by CVE-2016-2336?
It affects 1 product.
Products include Ruby-Lang Ruby.
How do I fix CVE-2016-2336?
No fix has been published for CVE-2016-2336 yet. Limit exposure of the affected software until one is available.
Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.
Is CVE-2016-2336 being exploited?
There is no known exploitation of CVE-2016-2336 in the wild and no public exploit code.
Other vulnerabilities in Ruby-Lang Ruby
Sources
Also known as GHSA-f46g-7w88-2qv4.