Description

Type confusion exists in two methods of Ruby's WIN32OLE class, ole_invoke and ole_query_interface. Attacker passing different type of object than this assumed by developers can cause arbitrary code execution.

Remediation

References

CVE-2016-2336

Related Vulnerabilities

WordPress Plugin Simple Membership Cross-Site Request Forgery (3.8.4)

Magento Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') Vulnerability (CVE-2019-8135)

MySQL CVE-2016-0599 Vulnerability (CVE-2016-0599)

WordPress Plugin Active Extra Fields Cross-Site Scripting (1.0.1)

Atlassian Jira Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Vulnerability (CVE-2021-26082)

Severity

Critical

Classification

CVE-2016-2336 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Tags

Missing Update Known Vulnerabilities