CVE-2016-2336

ruby: WIN32OLE ole_invoke and ole_query_interface type confusion vulnerabilities

Loading…

Severity

Important

Red Hat Product Security

8.1

CVSS 3.0

Review impact separately from score.

Published · June 14, 2016

Updated · May 7, 2026

Description

Type confusion exists in two methods of Ruby's WIN32OLE class, ole_invoke and ole_query_interface. Attacker passing different type of object than this assumed by developers can cause arbitrary code execution.

Statement

This issue did not affect the versions of ruby as shipped with Red Hat Enterprise Linux or Red Hat Software Collections as they did not include support for OLE.

CVSS score applicability

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation

No mitigation is specified in collected source.

CVSS / CWE

CVSS 3.0 · 8.1
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

CWE-843 · Access of Resource Using Incompatible Type ('Type Confusion')