Type confusion exists in _cancel_eval Ruby's TclTkIp class method. Attacker passing different type of object than String as "retval" argument can cause arbitrary code execution.

The remote MiracleLinux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2025-10964:04 advisory.

    * CVE-2016-2337: Fix type confusion in _cancel_eval Ruby's TclTkIp class method     to prevent arbitrary code execution
    * CVE-2017-9224: Fix stack out-of-bounds read in match_at() during regular     expression searching
    * CVE-2017-9227: Fix stack out-of-bounds read in mbc_enc_len() and invalid     pointer dereference in  forward_search_range()
    * CVE-2017-9228: Fix heap out-of-bounds write in bitset_set_range() and     parse_char_class() by initializing critical local variable     CVE(s):
    CVE-2017-9227     CVE-2017-9228     CVE-2016-2337     CVE-2017-9224

Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - Type confusion exists in _cancel_eval Ruby's TclTkIp class method. Attacker passing different type of     object than String as retval argument can cause arbitrary code execution. (CVE-2016-2337)

Note that Nessus relies on the presence of the package as reported by the vendor.

According to the versions of the ruby packages installed, the EulerOS Virtualization for ARM 64 installation on the remote host is affected by the following vulnerabilities :

  - Ruby is an extensible, interpreted, object-oriented,     scripting language. It has features to process text     files and to perform system management tasks.Security     Fix(es):An issue was discovered in the OpenSSL library     in Ruby before 2.3.8, 2.4.x before 2.4.5, 2.5.x before     2.5.2, and 2.6.x before 2.6.0-preview3. When two     OpenSSL::X509::Name objects are compared using ==,     depending on the ordering, non-equal objects may return     true. When the first argument is one character longer     than the second, or the second argument contains a     character that is one less than a character in the same     position of the first argument, the result of == will     be true. This could be leveraged to create an     illegitimate certificate that may be accepted as     legitimate and then used in signing or encryption     operations.(CVE-2018-16395)An issue was discovered in     Ruby before 2.3.8, 2.4.x before 2.4.5, 2.5.x before     2.5.2, and 2.6.x before 2.6.0-preview3. It does not     taint strings that result from unpacking tainted     strings with some formats.(CVE-2018-16396)** RESERVED
    ** This candidate has been reserved by an organization     or individual that will use it when announcing a new     security problem. When the candidate has been     publicized, the details for this candidate will be     provided.(CVE-2019-8322)** RESERVED ** This candidate     has been reserved by an organization or individual that     will use it when announcing a new security problem.
    When the candidate has been publicized, the details for     this candidate will be provided.(CVE-2019-8323)**     RESERVED ** This candidate has been reserved by an     organization or individual that will use it when     announcing a new security problem. When the candidate     has been publicized, the details for this candidate     will be provided.(CVE-2019-8324)** RESERVED ** This     candidate has been reserved by an organization or     individual that will use it when announcing a new     security problem. When the candidate has been     publicized, the details for this candidate will be     provided.(CVE-2019-8325)An exploitable heap overflow     vulnerability exists in the Fiddle::Function.new     ''initialize'' function functionality of Ruby. In     Fiddle::Function.new ''initialize'' heap buffer     ''arg_types'' allocation is made based on args array     length. Specially constructed object passed as element     of args array can increase this array size after     mentioned allocation and cause heap     overflow.(CVE-2016-2339)Type confusion exists in
    _cancel_eval Ruby's TclTkIp class method. Attacker     passing different type of object than String as     ''retval'' argument can cause arbitrary code     execution.(CVE-2016-2337)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Several vulnerabilities were discovered in Ruby 2.1.

CVE-2016-2337

Type confusion exists in _cancel_eval Ruby's TclTkIp class method.
Attacker passing different type of object than String as 'retval' argument can cause arbitrary code execution.

CVE-2018-1000073

RubyGems contains a Directory Traversal vulnerability in install_location function of package.rb that can result in path traversal when writing to a symlinked basedir outside of the root.

CVE-2018-1000074

RubyGems contains a Deserialization of Untrusted Data vulnerability in owner command that can result in code execution. This attack appear to be exploitable via victim must run the `gem owner` command on a gem with a specially crafted YAML file.

For Debian 8 'Jessie', these problems have been fixed in version 2.1.5-2+deb8u5.

We recommend that you upgrade your ruby2.1 packages.

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote host is affected by the vulnerability described in GLSA-201710-18 (Ruby: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in Ruby. Please review the       referenced CVE identifiers for details.
  Impact :

    A remote attacker could execute arbitrary code, cause a Denial of       Service condition, or obtain sensitive information.
  Workaround :

    There is no known workaround at this time.

The remote Ubuntu 14.04 LTS / 16.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-3365-1 advisory.

    It was discovered that Ruby DL::dlopen incorrectly handled opening libraries. An attacker could possibly     use this issue to open libraries with tainted names. This issue only applied to Ubuntu 14.04 LTS.
    (CVE-2009-5147)

    Tony Arcieri, Jeffrey Walton, and Steffan Ullrich discovered that the Ruby OpenSSL extension incorrectly     handled hostname wildcard matching. This issue only applied to Ubuntu 14.04 LTS. (CVE-2015-1855)

    Christian Hofstaedtler discovered that Ruby Fiddle::Handle incorrectly handled certain crafted strings. An     attacker could use this issue to cause a denial of service, or possibly execute arbitrary code. This issue     only applied to Ubuntu 14.04 LTS. (CVE-2015-7551)

    It was discovered that Ruby Net::SMTP incorrectly handled CRLF sequences. A remote attacker could possibly     use this issue to inject SMTP commands. (CVE-2015-9096)

    Marcin Noga discovered that Ruby incorrectly handled certain arguments in a TclTkIp class method. An     attacker could possibly use this issue to execute arbitrary code. This issue only affected Ubuntu 14.04     LTS. (CVE-2016-2337)

    It was discovered that Ruby Fiddle::Function.new incorrectly handled certain arguments. An attacker could     possibly use this issue to execute arbitrary code. This issue only affected Ubuntu 14.04 LTS.
    (CVE-2016-2339)

    It was discovered that Ruby incorrectly handled the initialization vector (IV) in GCM mode. An attacker     could possibly use this issue to bypass encryption. (CVE-2016-7798)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

According to the versions of the ruby packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - An exploitable heap overflow vulnerability exists in     the Fiddle::Function.new 'initialize' function     functionality of Ruby. In Fiddle::Function.new     'initialize' heap buffer 'arg_types' allocation is made     based on args array length. Specially constructed     object passed as element of args array can increase     this array size after mentioned allocation and cause     heap overflow.(CVE-2016-2339)

  - Type confusion exists in _cancel_eval Ruby's TclTkIp     class method. Attacker passing different type of object     than String as 'retval' argument can cause arbitrary     code execution.(CVE-2016-2337)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Severity
283434	MiracleLinux 7 : ruby-2.0.0.648-39.0.4.el7.AXS7 (AXSA:2025-10964:04)	Nessus	Miracle Linux Local Security Checks	critical
219383	Linux Distros Unpatched Vulnerability : CVE-2016-2337	Nessus	Misc.	critical
125569	EulerOS Virtualization for ARM 64 3.0.2.0 : ruby (EulerOS-SA-2019-1617)	Nessus	Huawei Local Security Checks	critical
112167	Debian DLA-1480-1 : ruby2.1 security update	Nessus	Debian Local Security Checks	critical
103911	GLSA-201710-18 : Ruby: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	critical
101974	Ubuntu 14.04 LTS / 16.04 LTS : Ruby vulnerabilities (USN-3365-1)	Nessus	Ubuntu Local Security Checks	critical
99896	EulerOS 2.0 SP2 : ruby (EulerOS-SA-2017-1051)	Nessus	Huawei Local Security Checks	critical
99895	EulerOS 2.0 SP1 : ruby (EulerOS-SA-2017-1050)	Nessus	Huawei Local Security Checks	critical

Detections

Analytics

CVE-2016-2337

critical

Tenable Plugins

critical

critical

critical

critical

critical

critical

critical

critical