Description
An exploitable heap overflow vulnerability exists in the Fiddle::Function.new "initialize" function functionality of Ruby. In Fiddle::Function.new "initialize" heap buffer "arg_types" allocation is made based on args array length. Specially constructed object passed as element of args array can increase this array size after mentioned allocation and cause heap overflow.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Ruby | Ruby | 2.3.0 dev, 2.2.2 | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 8 | ruby2.1 | 2.1.5-2+deb8u4 | DLA-1421-1 |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 16.04 LTS | ruby2.3 | 2.3.1-2~16.04.2 | USN-3365-1 |
| Ubuntu 14.04 LTS | ruby1.9.1 | 1.9.3.484-2ubuntu1.3 | USN-3365-1 |
| Ubuntu 14.04 LTS | ruby2.0 | 2.0.0.484-1ubuntu2.4 | USN-3365-1 |
SUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES 12 SP5 | ruby2.1 | 2.1.9-19.3.2 | SUSE-SU-2020:1570-1 |
| SLES 12 SP4 | ruby2.1 | 2.1.9-19.3.2 | SUSE-SU-2020:1570-1 |
| SLES 12 SP3 | ruby2.1 | 2.1.9-19.3.2 | SUSE-SU-2020:1570-1 |
| SLES 12 SP2 | ruby2.1 | 2.1.9-15.1 | SUSE-SU-2020:1570-1, SUSE-SU-2017:1067-1 |
| SLES 12 SP2 | yast2-ruby-bindings | 3.1.53-9.8.1 | SUSE-SU-2020:1570-1 |
| SLES 12 SP1 | ruby2.1 | 2.1.9-15.1 | SUSE-SU-2017:1067-1 |
Show 12 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SUSE Studio Onsite Runner 1.3 | ruby19 | 1.9.3.p392-0.26.1 | SUSE-SU-2017:0914-1 |
| SUSE Studio Onsite 1.3 | ruby19 | 1.9.3.p392-0.26.1 | SUSE-SU-2017:0914-1 |
| SLES for SAP 12 SP5 | ruby2.1 | 2.1.9-19.3.2 | SUSE-SU-2020:1570-1 |
| SLES for SAP 12 SP4 | ruby2.1 | 2.1.9-19.3.2 | SUSE-SU-2020:1570-1 |
| SLES for SAP 12 SP3 | ruby2.1 | 2.1.9-19.3.2 | SUSE-SU-2020:1570-1 |
| SLES for SAP 12 SP2 | ruby2.1 | 2.1.9-15.1 | SUSE-SU-2020:1570-1, SUSE-SU-2017:1067-1 |
| SLES for SAP 12 SP2 | yast2-ruby-bindings | 3.1.53-9.8.1 | SUSE-SU-2020:1570-1 |
| SLES for SAP 12 SP1 | ruby2.1 | 2.1.9-15.1 | SUSE-SU-2017:1067-1 |
| SUSE OpenStack Cloud Crowbar 8 | ruby2.1 | 2.1.9-19.3.2 | SUSE-SU-2020:1570-1 |
| SUSE OpenStack Cloud 8 | ruby2.1 | 2.1.9-19.3.2 | SUSE-SU-2020:1570-1 |
| SUSE OpenStack Cloud 7 | ruby2.1 | 2.1.9-19.3.2 | SUSE-SU-2020:1570-1 |
| SUSE OpenStack Cloud 7 | yast2-ruby-bindings | 3.1.53-9.8.1 | SUSE-SU-2020:1570-1 |
| SUSE HPE Helion OpenStack 8 | ruby2.1 | 2.1.9-19.3.2 | SUSE-SU-2020:1570-1 |
| SUSE Enterprise Storage 5 | ruby2.1 | 2.1.9-19.3.2 | SUSE-SU-2020:1570-1 |
Advisories 5
- USN-3365-1 ruby1.9.1, ruby2.0, ruby2.3 vulnerabilities Ubuntu Security Notices (USN) · Apr 27, 2026
- DLA-1421-1 ruby2.1 - security update Debian Security (DSA / DLA) · Mar 9, 2026
- SUSE-SU-2017:0914-1 Security update for ruby19 SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2017:1067-1 Security update for ruby2.1 SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2020:1570-1 Security update for ruby2.1 SUSE / openSUSE Security Updates · Feb 4, 2026