[IT-SecNots] [SECURITY] [DSA 4481-1] ruby-mini-magick security update

[Salvatore Bonaccorso <carnil AT debian.org>]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

- -------------------------------------------------------------------------
Debian Security Advisory DSA-4481-1                   security AT debian.org
https://www.debian.org/security/                     Salvatore Bonaccorso
July 13, 2019                         https://www.debian.org/security/faq
- -------------------------------------------------------------------------

Package        : ruby-mini-magick
CVE ID         : CVE-2019-13574
Debian Bug     : 931932

Harsh Jaiswal discovered a remote shell execution vulnerability in
ruby-mini-magick, a Ruby library providing a wrapper around ImageMagick
or GraphicsMagick, exploitable when using MiniMagick::Image.open with
specially crafted URLs coming from unsanitized user input.

For the oldstable distribution (stretch), this problem has been fixed
in version 4.5.1-1+deb9u1.

For the stable distribution (buster), this problem has been fixed in
version 4.9.2-1+deb10u1.

We recommend that you upgrade your ruby-mini-magick packages.

For the detailed security status of ruby-mini-magick please refer to its
security tracker page at:
https://security-tracker.debian.org/tracker/ruby-mini-magick

Further information about Debian Security Advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://www.debian.org/security/

Mailing list: debian-security-announce AT lists.debian.org
-----BEGIN PGP SIGNATURE-----

iQKSBAEBCgB9FiEERkRAmAjBceBVMd3uBUy48xNDz0QFAl0p3c1fFIAAAAAALgAo
aXNzdWVyLWZwckBub3RhdGlvbnMub3BlbnBncC5maWZ0aGhvcnNlbWFuLm5ldDQ2
NDQ0MDk4MDhDMTcxRTA1NTMxRERFRTA1NENCOEYzMTM0M0NGNDQACgkQBUy48xND
z0TeaA/4inX0cznpQAv45vkxEnD3UnV15UA/Zp+bHieIdJHQE1dH2odLnsDde3C0
ZhpslhquGoJc2V0uFouV+cDHHSz9cCaFkF+7tHbUK4pIFnDNJck0m0SmimJUvJSs
YVr2Do/qqR+eu3hfejDU8Y/v55BDTlxsLQFEpSg6QZdHqRt5gasboDUOMRDVhOF0
dDIvp6kL/Ihia0gE/xso1pSMWmVhpUoApwtBwmyBSF0aqIUIm64zScIHDDYWj6+g
CZeLc4+RdwSviCr91yw1n90/59Sl3EQOmELWGwrKu+PXIenri7E07/9e11/8XHwK
Ie24rnRB6+xsPy7PoFnzn23jUmjJdUOFTPmoqDqOcDhQouaVgOjGIqAF1ePMP8rl
JXiwfIWFLi7D0ck/+JKYGDNuUaqrB+2PJ7FEZM0WT6EiMUNNbaPhbYFF6iisaB9L
HZdtcFmz9zoafHlLCd27YC+bpSyDI9t+XIBUrNr9D1Rpd3L07K3qYczm837llDLA
8GotPiv4fqs1BuLd08Z2lWv0MMm7B67PBUD7Ryjwr4piPBTdmaTKE280NlP+1G95
az76W4fQ9GfYASYm3r9UaHoJTnGf8/WNt/NuyjsQ+YikgdMJAcfsMFJAa7HVuO0k
W9iS6Ab7ZC5GDg3vpwL777QALxSZxjIpILVlj2Nh3JSTMz/KHQ==
=1n0N
-----END PGP SIGNATURE-----