Attestkeep
Language: English
Sign up

Vulnerabilities / CVE-2016-2338

critical

CVE-2016-2338

ruby: heap buffer overflow in the Psych::Emitter start_document function

Published Modified CWE 787
In the Trivy database since at least 24 Oct 2026, 07:11 UTCWhen it arrived before that build is not recorded.

Severity by source

NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Red Hat9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Trivy's own label is CRITICAL. Rated critical by NVD. Rated lower by Red Hat (medium), Amazon (medium).

Description

An exploitable heap overflow vulnerability exists in the Psych::Emitter start_document function of Ruby. In Psych::Emitter start_document function heap buffer "head" allocation is made based on tags array length. Specially constructed object passed as element of tags array can increase this array size after mentioned allocation and cause heap overflow.

Affected packages and fixed versions

SourcePackageFixed in
amazon linux 2ruby, ruby-debuginfo, ruby-devel and 13 more2.0.0.648-36.amzn2.0.17 and 8 more
debian 8ruby2.12.1.5-2+deb8u9
Red Hatruby, ruby-devel, ruby-doc and 16 moreno fix listed
Show all 36 entries from 3 sources
SourcePackageFixed in
amazon linux 2ruby2.0.0.648-36.amzn2.0.17
amazon linux 2ruby-debuginfo2.0.0.648-36.amzn2.0.17
amazon linux 2ruby-devel2.0.0.648-36.amzn2.0.17
amazon linux 2ruby-doc2.0.0.648-36.amzn2.0.17
amazon linux 2ruby-irb2.0.0.648-36.amzn2.0.17
amazon linux 2ruby-libs2.0.0.648-36.amzn2.0.17
amazon linux 2ruby-tcltk2.0.0.648-36.amzn2.0.17
amazon linux 2rubygem-bigdecimal1.2.0-36.amzn2.0.17
amazon linux 2rubygem-io-console0.4.2-36.amzn2.0.17
amazon linux 2rubygem-json1.7.7-36.amzn2.0.17
amazon linux 2rubygem-minitest4.3.2-36.amzn2.0.17
amazon linux 2rubygem-psych2.0.0-36.amzn2.0.17
amazon linux 2rubygem-rake0.9.6-36.amzn2.0.17
amazon linux 2rubygem-rdoc4.0.0-36.amzn2.0.17
amazon linux 2rubygems2.0.14.1-36.amzn2.0.17
amazon linux 2rubygems-devel2.0.14.1-36.amzn2.0.17
debian 8ruby2.12.1.5-2+deb8u9
Red Hatrubyno fix listed
Red Hatruby-develno fix listed
Red Hatruby-docno fix listed
Red Hatruby-docsno fix listed
Red Hatruby-irbno fix listed
Red Hatruby-libsno fix listed
Red Hatruby-rdocno fix listed
Red Hatruby-rino fix listed
Red Hatruby-staticno fix listed
Red Hatruby-tcltkno fix listed
Red Hatrubygem-bigdecimalno fix listed
Red Hatrubygem-io-consoleno fix listed
Red Hatrubygem-jsonno fix listed
Red Hatrubygem-minitestno fix listed
Red Hatrubygem-psychno fix listed
Red Hatrubygem-rakeno fix listed
Red Hatrubygem-rdocno fix listed
Red Hatrubygemsno fix listed
Red Hatrubygems-develno fix listed

References

Vulnerability data compiled from the Trivy vulnerability database (trivy-db, Aqua Security, Apache License 2.0), which aggregates third-party advisories. CVE records are published by The MITRE Corporation under the CVE Terms of Use; CVE is a trademark of MITRE. This product uses data from the NVD API but is not endorsed or certified by the NVD. Severity, titles and advisory data from the GitHub Advisory Database (CC BY 4.0), Red Hat security data (CC BY 4.0) and the other sources linked on each entry. Entries may be summarised or re-formatted; the linked original is the authoritative record.