CVE-2016-2337

EUVD-2016-3421
Type confusion exists in _cancel_eval Ruby's TclTkIp class method. Attacker passing different type of object than String as "retval" argument can cause arbitrary code execution.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
9.8 CRITICAL
NETWORK
LOW
NONE
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Base Score
CVSS 3.x
EPSS Score
Percentile: 73%
Affected Products (NVD)
VendorProductVersion
ruby-langruby
2.2.2
ruby-langruby
2.3.0
𝑥
= Vulnerable software versions
Ubuntu logo
Ubuntu Releases
Ubuntu Product
Codename
ruby1.8
precise
ignored
trusty
dne
xenial
dne
yakkety
dne
zesty
dne
ruby1.9.1
precise
ignored
trusty
Fixed 1.9.3.484-2ubuntu1.3
released
xenial
dne
yakkety
dne
zesty
dne
ruby2.0
precise
dne
trusty
Fixed 2.0.0.484-1ubuntu2.4
released
xenial
dne
yakkety
dne
zesty
dne
ruby2.3
precise
dne
trusty
dne
xenial
not-affected
yakkety
not-affected
zesty
not-affected
References
http://www.securityfocus.com/bid/91233
http://www.talosintelligence.com/reports/TALOS-2016-0031/
https://lists.debian.org/debian-lts-announce/2018/08/msg00028.html
https://security.gentoo.org/glsa/201710-18
http://www.securityfocus.com/bid/91233
http://www.talosintelligence.com/reports/TALOS-2016-0031/
https://lists.debian.org/debian-lts-announce/2018/08/msg00028.html
https://security.gentoo.org/glsa/201710-18