CVE catalog
CVE-2016-2339
Security update for ruby19
- Severity
- Critical · CVSS 9.8
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Published
- Updated
- Source
- [NVD] · [CVE record]
- EPSS
- 5.14% · Oct 25, 2026
An exploitable heap overflow vulnerability exists in the Fiddle::Function.new "initialize" function functionality of Ruby. In Fiddle::Function.new "initialize" heap buffer "arg_types" allocation is made based on args array length. Specially constructed object passed as element of args array can increase this array size after mentioned allocation and cause heap overflow.
Vulnerable and fixed packages
Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.
| Distribution | Package | Release | Version | Status |
|---|---|---|---|---|
| Ubuntu | ruby1.9.1 | 14.04 | 1.9.3.194-8.1ubuntu2 | vulnerable |
| Ubuntu | ruby1.9.1 | 14.04 | 1.9.3.448-1ubuntu1 | vulnerable |
| Ubuntu | ruby1.9.1 | 14.04 | 1.9.3.448-1ubuntu2 | vulnerable |
| Ubuntu | ruby1.9.1 | 14.04 | 1.9.3.484-1ubuntu1 | vulnerable |
| Ubuntu | ruby1.9.1 | 14.04 | 1.9.3.484-1ubuntu2 | vulnerable |
| Ubuntu | ruby1.9.1 | 14.04 | 1.9.3.484-2ubuntu1 | vulnerable |
| Ubuntu | ruby1.9.1 | 14.04 | 1.9.3.484-2ubuntu1.1 | vulnerable |
| Ubuntu | ruby1.9.1 | 14.04 | 1.9.3.484-2ubuntu1.2 | vulnerable |
| Ubuntu | ruby1.9.1 | 14.04 | 1.9.3.484-2ubuntu1.3 | fixed |
| Ubuntu | ruby2.0 | 14.04 | 2.0.0.299-2 | vulnerable |
| Ubuntu | ruby2.0 | 14.04 | 2.0.0.343-1 | vulnerable |
| Ubuntu | ruby2.0 | 14.04 | 2.0.0.343-1ubuntu1 | vulnerable |
| Ubuntu | ruby2.0 | 14.04 | 2.0.0.353-1 | vulnerable |
| Ubuntu | ruby2.0 | 14.04 | 2.0.0.353-1ubuntu1 | vulnerable |
| Ubuntu | ruby2.0 | 14.04 | 2.0.0.484-1ubuntu1 | vulnerable |
| Ubuntu | ruby2.0 | 14.04 | 2.0.0.484-1ubuntu2 | vulnerable |
| Ubuntu | ruby2.0 | 14.04 | 2.0.0.484-1ubuntu2.1 | vulnerable |
| Ubuntu | ruby2.0 | 14.04 | 2.0.0.484-1ubuntu2.2 | vulnerable |
| Ubuntu | ruby2.0 | 14.04 | 2.0.0.484-1ubuntu2.4 | fixed |
| Suse | ruby19 | studio onsite 1.3 | 1.9.3.p392-0.26.1 | fixed |
| Suse | ruby19 | studio onsite runner 1.3 | 1.9.3.p392-0.26.1 | fixed |
Fixed-version evidence
| Distribution | Package | Type | Release | Fixed version | Urgency | Origin | Bugs |
|---|---|---|---|---|---|---|---|
| Ubuntu | ruby1.9.1 | deb | 14.04 | 1.9.3.484-2ubuntu1.3 | Not reported | UBUNTU-CVE-2016-2339 | Not reported |
| Ubuntu | ruby2.0 | deb | 14.04 | 2.0.0.484-1ubuntu2.4 | Not reported | UBUNTU-CVE-2016-2339 | Not reported |
| Suse | ruby19 | rpm | studio onsite 1.3 | 1.9.3.p392-0.26.1 | Not reported | SUSE-SU-2017:0914-1 | Not reported |
| Suse | ruby19 | rpm | studio onsite runner 1.3 | 1.9.3.p392-0.26.1 | Not reported | SUSE-SU-2017:0914-1 | Not reported |
OpenFactory catalog packages
No matching packages in this catalog.
Observed:
References
- [https://ftp.suse.com/pub/projects/security/csaf/suse-su-2017_0914-1.json]
- [https://osv.dev/vulnerability/SUSE-SU-2017:0914-1]
- [https://osv.dev/vulnerability/UBUNTU-CVE-2016-2339]
- [https://security.access.redhat.com/data/csaf/v2/vex/2016/cve-2016-2339.json]
[FIRST EPSS] · [OSV Package Vulnerability Database] · [Red Hat security advisories and VEX] · [SUSE security advisories and VEX]