CVE-2016-2338

An exploitable heap overflow vulnerability exists in the Psych::Emitter start_document function of Ruby. In Psych::Emitter start_document function heap buffer "head" allocation is made based on tags array length. Specially constructed object passed as element of tags array can increase this array size after mentioned allocation and cause heap overflow.

CVSS v3.0 9.8 CRITICAL

9.8^/10

CVSS v3.0 : CRITICAL

V3 Legend

Vector :

Exploitability : 3.9 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://lists.debian.org/debian-lts-announce/2020/03/msg00032.html	Mailing List Third Party Advisory
http://www.talosintelligence.com/reports/TALOS-2016-0032/	Exploit Third Party Advisory
https://security.netapp.com/advisory/ntap-20221228-0005/	Third Party Advisory

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:ruby-lang:ruby:2.3.0:::::::*
	cpe:2.3:a:ruby-lang:ruby:2.2.2:::::::*

Configuration 2 (hide)

cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*

Information

Published : 2022-09-28 20:15

Updated : 2023-03-01 08:35

NVD link : CVE-2016-2338

Mitre link : CVE-2016-2338

JSON object : View

CWE

CWE-787

Out-of-bounds Write

Products Affected

debian

debian_linux

ruby-lang

ruby

{"cve": {"data_type": "CVE", "references": {"reference_data": [{"url": "https://lists.debian.org/debian-lts-announce/2020/03/msg00032.html", "name": "[debian-lts-announce] 20200325 [SECURITY] [DLA 2158-1] ruby2.1 security update", "tags": ["Mailing List", "Third Party Advisory"], "refsource": "MLIST"}, {"url": "http://www.talosintelligence.com/reports/TALOS-2016-0032/", "name": "http://www.talosintelligence.com/reports/TALOS-2016-0032/", "tags": ["Exploit", "Third Party Advisory"], "refsource": "MISC"}, {"url": "https://security.netapp.com/advisory/ntap-20221228-0005/", "name": "https://security.netapp.com/advisory/ntap-20221228-0005/", "tags": ["Third Party Advisory"], "refsource": "CONFIRM"}]}, "data_format": "MITRE", "description": {"description_data": [{"lang": "en", "value": "An exploitable heap overflow vulnerability exists in the Psych::Emitter start_document function of Ruby. In Psych::Emitter start_document function heap buffer \"head\" allocation is made based on tags array length. Specially constructed object passed as element of tags array can increase this array size after mentioned allocation and cause heap overflow."}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "en", "value": "CWE-787"}]}]}, "data_version": "4.0", "CVE_data_meta": {"ID": "CVE-2016-2338", "ASSIGNER": "cert@cert.org"}}, "impact": {"baseMetricV3": {"cvssV3": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.8, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 3.9}}, "publishedDate": "2022-09-29T03:15Z", "configurations": {"nodes": [{"children": [], "operator": "OR", "cpe_match": [{"cpe23Uri": "cpe:2.3:a:ruby-lang:ruby:2.3.0:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}, {"cpe23Uri": "cpe:2.3:a:ruby-lang:ruby:2.2.2:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}]}, {"children": [], "operator": "OR", "cpe_match": [{"cpe23Uri": "cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}]}], "CVE_data_version": "4.0"}, "lastModifiedDate": "2023-03-01T16:35Z"}

9.8 /10