CVE-2016-2338

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

An exploitable heap overflow vulnerability exists in the Psych::Emitter start_document function of Ruby. In Psych::Emitter start_document function heap buffer "head" allocation is made based on tags array length. Specially constructed object passed as element of tags array can increase this array size after mentioned allocation and cause heap overflow.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-787

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://www.talosintelligence.com/reports/TALOS-2016-0032/Exploit, Third Party Advisory
https://lists.debian.org/debian-lts-announce/2020/03/msg00032.htmlMailing List, Third Party Advisory
https://security.netapp.com/advisory/ntap-20221228-0005/Third Party Advisory
http://www.talosintelligence.com/reports/TALOS-2016-0032/Exploit, Third Party Advisory
https://lists.debian.org/debian-lts-announce/2020/03/msg00032.htmlMailing List, Third Party Advisory
https://security.netapp.com/advisory/ntap-20221228-0005/Third Party Advisory

Timeline

Published: Sep 29, 2022
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2016

CVE-2016-23399.8An exploitable heap overflow vulnerability exists in the Fiddle::Function.new "initialize" function functionality of Ruby. In Fiddle::Functi CVE-2016-23405.4The AMF framework in Granite Data Services 3.1.1-SNAPSHOT allows remote authenticated users to read arbitrary files, send TCP requests to in CVE-2016-23428.1The bgp_nlri_parse_vpnv4 function in bgp_mplsvpn.c in the VPNv4 NLRI parser in bgpd in Quagga before 1.0.20160309, when a certain VPNv4 conf CVE-2016-23439.8Patterson Dental Eaglesoft 17 has a hardcoded password of sql for the dba account, which allows remote attackers to obtain sensitive Dental.CVE-2016-23447.5Stack-based buffer overflow in manager.exe in Backburner Manager in Autodesk Backburner 2016 2016.0.0.2150 and earlier allows remote attacke CVE-2016-23459.8Stack-based buffer overflow in dwrcs.exe in the dwmrcs daemon in SolarWinds DameWare Mini Remote Control 12.0 allows remote attackers to exe CVE-2016-23468.1Allround Automations PL/SQL Developer 11 before 11.0.6 relies on unverified HTTP data for updates, which allows man-in-the-middle attackers CVE-2016-23477.8Integer underflow in the decode_level3_header function in lib/lha_file_header.c in Lhasa before 0.3.1 allows remote attackers to execute arb CVE-2016-23497.5Remedy AR System Server in BMC Remedy 8.1 SP 2, 9.0, 9.0 SP 1, and 9.1 allows attackers to reset arbitrary passwords via a blank previous pa CVE-2016-23506.1Multiple cross-site scripting (XSS) vulnerabilities on the Accellion File Transfer Appliance (FTA) before FTA_9_12_40 allow remote attackers CVE-2016-23519.8SQL injection vulnerability in home/seos/courier/security_key2.api on the Accellion File Transfer Appliance (FTA) before FTA_9_12_40 allows CVE-2016-23528.8The Accellion File Transfer Appliance (FTA) before FTA_9_12_40 allows remote authenticated users to execute arbitrary commands by leveraging