CVEs-PoC/2016/CVE-2016-2339.md

### [CVE-2016-2339](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-2339)
![](https://img.shields.io/static/v1?label=Product&message=Ruby&color=blue)
![](https://img.shields.io/static/v1?label=Version&message=2.2.2%20&color=brightgreen)
![](https://img.shields.io/static/v1?label=Version&message=2.3.0%20dev%20&color=brightgreen)
![](https://img.shields.io/static/v1?label=Vulnerability&message=heap%20overflow%20vulnerability&color=brightgreen)

### Description

An exploitable heap overflow vulnerability exists in the Fiddle::Function.new "initialize" function functionality of Ruby. In Fiddle::Function.new "initialize" heap buffer "arg_types" allocation is made based on args array length. Specially constructed object passed as element of args array can increase this array size after mentioned allocation and cause heap overflow.

### POC

#### Reference
- http://www.talosintelligence.com/reports/TALOS-2016-0034/

#### Github
No PoCs found on GitHub currently.