CVE-2016-2337 PUBLISHED

Type confusion exists in _cancel_eval Ruby's TclTkIp class method. Attacker passing different type of object than String as "retval" argument can cause arbitrary code execution.

EPSS 0.81% · 74.0th percentile

Risk Scores

EPSS Score
0.81%
74.0th percentile

Affected Products

VendorProductVersions
Ubuntu:14.04:LTSruby2.02.0.0.484-1ubuntu2.2, 0, 2.0.0.299-2
Ubuntu:14.04:LTSruby1.9.11.9.3.194-8.1ubuntu2, 1.9.3.448-1ubuntu1, 1.9.3.448-1ubuntu2

Timeline

References

Open in Interactive Console →