An exploitable heap overflow vulnerability exists in the Psych::Emitter start_document function of Ruby. In Psych::Emitter start_document function heap buffer "head" allocation is made based on tags array length. Specially constructed object passed as element of tags array can increase this array size after mentioned allocation and cause heap overflow.

The remote MiracleLinux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2025-10921:03 advisory.

    * CVE-2017-9226: fix a heap out-of-bounds write or read occurs in   next_state_val() during regular     expression compilation.
    * CVE-2016-2338: fix heap overflow vulnerability in start_document function
    * CVE-2016-2339: fix heap overflow vulnerability in Fiddle::Function.new     'initialize' function     CVE(s):
    CVE-2017-9226     An issue was discovered in Oniguruma 6.2.0, as used in Oniguruma-mod in Ruby through 2.4.1 and mbstring in     PHP through 7.1.5. A heap out-of-bounds write or read occurs in next_state_val() during regular expression     compilation. Octal numbers larger than 0xff are not handled correctly in fetch_token() and     fetch_token_in_cc(). A malformed regular expression containing an octal number in the form of '\700' would     produce an invalid code point value larger than 0xff in next_state_val(), resulting in an out-of-bounds     write memory corruption.
    CVE-2016-2338     An exploitable heap overflow vulnerability exists in the Psych::Emitter start_document function of Ruby.
    In Psych::Emitter start_document function heap buffer head allocation is made based on tags array     length. Specially constructed object passed as element of tags array can increase this array size after     mentioned allocation and cause heap overflow.
    CVE-2016-2339     An exploitable heap overflow vulnerability exists in the Fiddle::Function.new initialize function     functionality of Ruby. In Fiddle::Function.new initialize heap buffer arg_types allocation is made     based on args array length. Specially constructed object passed as element of args array can increase this     array size after mentioned allocation and cause heap

Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of ruby installed on the remote host is prior to 2.0.0.648-36. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2025-2990 advisory.

    An exploitable heap overflow vulnerability exists in the Psych::Emitter start_document function of Ruby.
    In Psych::Emitter start_document function heap buffer head allocation is made based on tags array     length. Specially constructed object passed as element of tags array can increase this array size after     mentioned allocation and cause heap overflow. (CVE-2016-2338)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

An exploitable heap overflow vulnerability exists in the Psych::Emitter startdocument function of Ruby. In Psych::Emitter startdocument function heap buffer 'head' allocation is made based on tags array length. Specially constructed object passed as element of tags array can increase this array size after mentioned allocation and cause heap overflow

For Debian 8 'Jessie', this problem has been fixed in version 2.1.5-2+deb8u9.

We recommend that you upgrade your ruby2.1 packages.

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Severity
283023	MiracleLinux 7 : ruby-2.0.0.648-39.0.3.el7.AXS7 (AXSA:2025-10921:03)	Nessus	Miracle Linux Local Security Checks	critical
261341	Amazon Linux 2 : ruby, --advisory ALAS2-2025-2990 (ALAS-2025-2990)	Nessus	Amazon Linux Local Security Checks	critical
134915	Debian DLA-2158-1 : ruby2.1 security update	Nessus	Debian Local Security Checks	critical

Detections

Analytics

CVE-2016-2338

critical

Tenable Plugins

critical

critical

critical