Most recent entries from all

bdu:2020-01532

EUVD-2026-55825

fkie_cve-2019-13574

In lib/mini_magick/image.rb in MiniMagick before 4.9.4, a fetched remote image filename could cause remote command execution because Image.open input is directly passed to Kernel#open, which accepts a '|' character followed by a command.

GHSA-r7j3-vvh2-xrpj — OS Command Injection in MiniMagick

Affected: RubyGems: mini_magick

In `lib/mini_magick/image.rb` in MiniMagick before 4.9.4, a fetched remote image filename could cause remote command execution because `Image.open` input is directly passed to `Kernel#open`, which accepts a `|` character followed by a command.

gsd-2019-13574

OESA-2021-1150 — rubygem-mini_magick security update

Affected: openEuler:20.03-LTS-SP1: rubygem-mini_magick

A ruby wrapper for ImageMagick command line. Using MiniMagick the ruby processes memory remains small (it spawns ImageMagick's command line program mogrify which takes up some memory as well, but is much smaller compared to RMagick). Security Fix(es): In lib/mini_magick/image.rb in MiniMagick before 4.9.4, a fetched remote image filename could cause remote command execution because Image.open input is directly passed to Kernel#open, which accepts a '|' character followed by a command.(CVE-2019-13574)

UBUNTU-CVE-2019-13574

Affected: Ubuntu:16.04:LTS: ruby-mini-magick, Ubuntu:18.04:LTS: ruby-mini-magick