Debian/ruby-mini-magick: high 7.8
In lib/mini_magick/image.rb in MiniMagick before 4.9.4, a fetched remote image filename could cause remote command execution because Image.open input is directly passed to Kernel#open, which accepts a
Action: Upgrade ruby-mini-magick to 4.9.2-1.1 or later.
Affected
| introduced | fixed | last affected |
|---|---|---|
| 0 | 4.9.2-1.1 | - |
Fixed versions
| 4.9.2-1.1 |
Sources
published · modified · JSON