View at Official suse advisory, NVD, CVE.org · CVE detail
Freshness: upstream tracker timestamp is available; use API updated time as primary recency signal.
CVE-2016-2338 severity important: SUSE including 10 source package names (libruby2_1-2_1, libruby2_5-2_5, …), 156 product×package rows across 36 product lines (SUSE CaaS Platform 4.0, SUSE Enterprise Storage 6, … (36 product lines)): Known Not Affected 156.
An exploitable heap overflow vulnerability exists in the Psych::Emitter start_document function of Ruby. In Psych::Emitter start_document function heap buffer "head" allocation is made based on tags array length. Specially constructed object passed as element of tags array can increase this array size after mentioned allocation and cause heap overflow.