CVE-2016-2338

CRITICAL severity · CVSS 9.8 · Out-of-bounds write

9.8CVSS CRITICAL

Summary

An exploitable heap overflow vulnerability exists in the Psych::Emitter start_document function of Ruby. In Psych::Emitter start_document function heap buffer "head" allocation is made based on tags array length. Specially constructed object passed as element of tags array can increase this array size after mentioned allocation and cause heap overflow.

Impact & exploitability

Attack vectorNetwork

Attack complexityLow

Privileges requiredNone

User interactionNone

Confidentiality impactHigh

Integrity impactHigh

Availability impactHigh

Exploit probability (EPSS)13%

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Affected products we track (1)

Ruby

Recommendation

Apply the vendor fix promptly. Open any affected product above for its exact safe version.

Additional information

NVD record
https://lists.debian.org/debian-lts-announce/2020/03/msg00032.htmlAdvisory
https://security.netapp.com/advisory/ntap-20221228-0005/Advisory
https://lists.debian.org/debian-lts-announce/2020/03/msg00032.htmlAdvisory
https://security.netapp.com/advisory/ntap-20221228-0005/Advisory
http://www.talosintelligence.com/reports/TALOS-2016-0032/Advisory
http://www.talosintelligence.com/reports/TALOS-2016-0032/Advisory