[from a quick skim of the patch:] The changes to array.c and string.c look pretty worrying, seems like there are unchecked error conditions that aren't too hard to exploit, possibly allowing buffer overflows in String.... e.g. any code where the attacker could specify the right-hand-side argument to the in-place string concatenation operators (String#concat and String#<<) may be affected. Most string concatenations probably aren't in-place (using String#+ instead), but there's probably at least a handful of in-place string concats in popular packages like Rails.
[from a quick skim of the patch:] The changes to array.c and string.c look pretty worrying, seems like there are unchecked error conditions that aren't too hard to exploit, possibly allowing buffer overflows in String.... e.g. any code where the attacker could specify the right-hand-side argument to the in-place string concatenation operators (String#concat and String#<<) may be affected. Most string concatenations probably aren't in-place (using String#+ instead), but there's probably at least a handful of in-place string concats in popular packages like Rails.