SUSE CVE-2016-2337

Type confusion exists in canceleval Ruby's TclTkIp class method. Attacker passing different type of object than String as "retval" argument can cause arbitrary code execution...

The vulnerability of the _cancel_eval method in the TclTkIp class of the Ruby interpreter allows a hacker to execute arbitrary code.

The vulnerability of the canceleval method in the TclTkIp class of the Ruby interpreter arises from an incorrect check of the returned value by the method or function. Exploiting this vulnerability could allow a malicious actor, operating remotely, to execute arbitrary code...