Debian/ruby-mini-magick: high 7.8
In lib/mini_magick/image.rb in MiniMagick before 4.9.4, a fetched remote image filename could cause remote command execution because Image.open input is directly passed to Kernel#open, which accepts a
Action: Upgrade ruby-mini-magick to 4.9.2-1.1 or later.
Affected
| introduced | fixed | last affected |
|---|---|---|
| 0 | 4.9.2-1.1 | - |
Fixed versions
| 4.9.2-1.1 |
Sources
- osv: DEBIAN-CVE-2019-13574#Debian:14/ruby-mini-magick
- https://security-tracker.debian.org/tracker/CVE-2019-13574
published · modified · JSON