SB2017040522 - OpenSUSE Linux update for ruby2.2, ruby2.3 

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB2017040522

SB2017040522 - OpenSUSE Linux update for ruby2.2, ruby2.3

Published: April 5, 2017

Security Bulletin ID SB2017040522
Severity
High
Patch available
YES
Number of vulnerabilities 2
Exploitation vector Remote access
Highest impact Code execution

Breakdown by Severity

High 100%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 2 secuirty vulnerabilities.


1) Input validation error (CVE-ID: CVE-2015-7551)

The vulnerability allows context-dependent attackers to perform a denial of service (DoS) attack.

The vulnerability exists due to insufficient validation of user-supplied input. A remote attacker can execute arbitrary code or cause a denial of service (application crash) via a crafted string, related to the DL module and the libffi library.


2) Buffer overflow (CVE-ID: CVE-2016-2339)

The vulnerability allows a remote non-authenticated attacker to execute arbitrary code.

An exploitable heap overflow vulnerability exists in the Fiddle::Function.new "initialize" function functionality of Ruby. In Fiddle::Function.new "initialize" heap buffer "arg_types" allocation is made based on args array length. Specially constructed object passed as element of args array can increase this array size after mentioned allocation and cause heap overflow.


Remediation

Install update from vendor's website.

References