Description
Type confusion exists in _cancel_eval Ruby's TclTkIp class method. Attacker passing different type of object than String as "retval" argument can cause arbitrary code execution.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Ruby | Ruby | 2.3.0 dev, 2.2.2 | — |
| Tcl | Tcl/Tk | 8.6 or later | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 8 | ruby2.1 | 2.1.5-2+deb8u5 | DLA-1480-1 |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 16.04 LTS | ruby2.3 | 2.3.1-2~16.04.2 | USN-3365-1 |
| Ubuntu 14.04 LTS | ruby1.9.1 | 1.9.3.484-2ubuntu1.3 | USN-3365-1 |
| Ubuntu 14.04 LTS | ruby2.0 | 2.0.0.484-1ubuntu2.4 | USN-3365-1 |
Advisories 2
- USN-3365-1 ruby1.9.1, ruby2.0, ruby2.3 vulnerabilities Ubuntu Security Notices (USN) · Apr 27, 2026
- DLA-1480-1 ruby2.1 - security update Debian Security (DSA / DLA) · Mar 9, 2026
References
- http://www.talosintelligence.com/reports/TALOS-2016-0031/
- 91233 vdb-entry
- [debian-lts-announce] 20180827 [SECURITY] [DLA 1480-1] ruby2.1 security update mailing-list
- GLSA-201710-18 vendor-advisory