GHSA-78j3-7wpm-qhvp

Shell Metacharacter Injection in kelredd-pruview

Source: GitHub Advisory Database (reviewed) Critical CVE-2013-1947

Packages

Ecosystem	Package	Affected	Fixed in
RubyGems	kelredd-pruview	<= 0.5.0	no fix listed

Details

As written in the advisory (Markdown source, shown as plain text).

kelredd-pruview gem 0.3.8 for Ruby allows context-dependent attackers to execute arbitrary commands via shell metacharacters in a filename argument to document.rb, video.rb, or video_image.rb.

References

External links from the advisory. They lead to third-party sites.

https://nvd.nist.gov/vuln/detail/CVE-2013-1947 advisory
https://github.com/advisories/GHSA-78j3-7wpm-qhvp advisory
https://github.com/rubysec/ruby-advisory-db/blob/master/gems/kelredd-pruview/CVE-2013-1947.yml web
http://vapid.dhs.org/advisories/kelredd-pruview-cmd-inject.html web
http://www.openwall.com/lists/oss-security/2013/04/10/3 web
http://www.openwall.com/lists/oss-security/2013/04/12/2 web