drucken bookmarks versenden konfigurieren admin pdf Sicherheit: Ausführen beliebiger Kommandos in ruby-mini-magick
Name: |
Ausführen beliebiger Kommandos in ruby-mini-magick |
|
ID: |
DSA-4481-1 |
|
Distribution: |
Debian |
|
Plattformen: |
Debian stretch, Debian buster |
|
Datum: |
Sa, 13. Juli 2019, 17:40 |
|
Referenzen: |
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-13574 |
|
Applikationen: |
ruby-mini-magick |
|
Originalnachricht |
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512
- ------------------------------------------------------------------------- Debian Security Advisory DSA-4481-1 security@debian.org https://www.debian.org/security/ Salvatore Bonaccorso July 13, 2019 https://www.debian.org/security/faq - -------------------------------------------------------------------------
Package : ruby-mini-magick CVE ID : CVE-2019-13574 Debian Bug : 931932
Harsh Jaiswal discovered a remote shell execution vulnerability in ruby-mini-magick, a Ruby library providing a wrapper around ImageMagick or GraphicsMagick, exploitable when using MiniMagick::Image.open with specially crafted URLs coming from unsanitized user input.
For the oldstable distribution (stretch), this problem has been fixed in version 4.5.1-1+deb9u1.
For the stable distribution (buster), this problem has been fixed in version 4.9.2-1+deb10u1.
We recommend that you upgrade your ruby-mini-magick packages.
For the detailed security status of ruby-mini-magick please refer to its security tracker page at: https://security-tracker.debian.org/tracker/ruby-mini-magick
Further information about Debian Security Advisories, how to apply these updates to your system and frequently asked questions can be found at: https://www.debian.org/security/
Mailing list: debian-security-announce@lists.debian.org -----BEGIN PGP SIGNATURE-----
iQKSBAEBCgB9FiEERkRAmAjBceBVMd3uBUy48xNDz0QFAl0p3c1fFIAAAAAALgAo aXNzdWVyLWZwckBub3RhdGlvbnMub3BlbnBncC5maWZ0aGhvcnNlbWFuLm5ldDQ2 NDQ0MDk4MDhDMTcxRTA1NTMxRERFRTA1NENCOEYzMTM0M0NGNDQACgkQBUy48xND z0TeaA/4inX0cznpQAv45vkxEnD3UnV15UA/Zp+bHieIdJHQE1dH2odLnsDde3C0 ZhpslhquGoJc2V0uFouV+cDHHSz9cCaFkF+7tHbUK4pIFnDNJck0m0SmimJUvJSs YVr2Do/qqR+eu3hfejDU8Y/v55BDTlxsLQFEpSg6QZdHqRt5gasboDUOMRDVhOF0 dDIvp6kL/Ihia0gE/xso1pSMWmVhpUoApwtBwmyBSF0aqIUIm64zScIHDDYWj6+g CZeLc4+RdwSviCr91yw1n90/59Sl3EQOmELWGwrKu+PXIenri7E07/9e11/8XHwK Ie24rnRB6+xsPy7PoFnzn23jUmjJdUOFTPmoqDqOcDhQouaVgOjGIqAF1ePMP8rl JXiwfIWFLi7D0ck/+JKYGDNuUaqrB+2PJ7FEZM0WT6EiMUNNbaPhbYFF6iisaB9L HZdtcFmz9zoafHlLCd27YC+bpSyDI9t+XIBUrNr9D1Rpd3L07K3qYczm837llDLA 8GotPiv4fqs1BuLd08Z2lWv0MMm7B67PBUD7Ryjwr4piPBTdmaTKE280NlP+1G95 az76W4fQ9GfYASYm3r9UaHoJTnGf8/WNt/NuyjsQ+YikgdMJAcfsMFJAa7HVuO0k W9iS6Ab7ZC5GDg3vpwL777QALxSZxjIpILVlj2Nh3JSTMz/KHQ== =1n0N -----END PGP SIGNATURE-----
|
|
|
|