In lib/mini_magick/image.rb in MiniMagick before 4.9.4, a fetched remote image filename could cause remote command execution because Image.open input is directly passed to Kernel#open, which accepts a '|' character followed by a command.

Affected: RubyGems: mini_magick

In `lib/mini_magick/image.rb` in MiniMagick before 4.9.4, a fetched remote image filename could cause remote command execution because `Image.open` input is directly passed to `Kernel#open`, which accepts a `|` character followed by a command.

Affected: openEuler:20.03-LTS-SP1: rubygem-mini_magick

A ruby wrapper for ImageMagick command line. Using MiniMagick the ruby processes memory remains small (it spawns ImageMagick's command line program mogrify which takes up some memory as well, but is much smaller compared to RMagick). Security Fix(es): In lib/mini_magick/image.rb in MiniMagick before 4.9.4, a fetched remote image filename could cause remote command execution because Image.open input is directly passed to Kernel#open, which accepts a '|' character followed by a command.(CVE-2019-13574)

Affected: Ubuntu:16.04:LTS: ruby-mini-magick, Ubuntu:18.04:LTS: ruby-mini-magick

In lib/mini_magick/image.rb in MiniMagick before 4.9.4, a fetched remote image filename could cause remote command execution because Image.open input is directly passed to Kernel#open, which accepts a '|' character followed by a command.