MiniMagick Gem for Ruby URI Handling Arbitrary Command Injection

概要

参考情報

• nvd.nist.gov/vuln/detail/CVE-2013-2616 · ADVISORY
• minimagick/minimagick · PACKAGE
• rubysec/ruby-advisory-db · WEB
• web.archive.org/web/20130315095512/http://www.securityfocus.com/bid/58448 · WEB
• packetstormsecurity.com/files/120777/Ruby-Gem-Minimagic-Command-Execution.html · WEB
• seclists.org/fulldisclosure/2013/Mar/123 · WEB
• openwall.com/lists/oss-security/2013/03/19/9 · WEB
• osvdb.org/91231
• securityfocus.com/bid/58448

mini_magick のその他の脆弱性

• CVE-2019-13574高 7.8In lib/mini_magick/image.rb in MiniMagick before 4.9.4, a fetched remote image filename could cause remote command execution because Image.o…