CVE-2016-2338

    Dashboard / Vulnerabilities / CVE-2016-2338

    CVE-2016-2338

    Published: 29 Sept 2022Last Modified: 8 Jul 2026

    Summary:

    Details: An exploitable heap overflow vulnerability exists in the Psych::Emitter start_document function of Ruby. In Psych::Emitter start_document function heap buffer "head" allocation is made based on tags array length. Specially constructed object passed as element of tags array can increase this array size after mentioned allocation and cause heap overflow.

    References: https://lists.debian.org/debian-lts-announce/2020/03/msg00032.html, https://security.netapp.com/advisory/ntap-20221228-0005/, http://www.talosintelligence.com/reports/TALOS-2016-0032/

    Affected packages

    Package

    Name:

    Purl:

    Affected ranges

    Type: GIT

    Events:

    Introduced- a9721a259665149b1b9ff0beabcf5f8dc0136120
    Fixed -None

    Affected versions

    2.2.2

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    CVE-2016-2338 | CVE-DB