News for hackers. Stuff that matters.

A comment on Remote code execution vulnerability in ImageMagick. Parent comment

Re:Remote code execution vulnerability in ImageMagick by zerocrates on Tuesday May 03, 2016 @05:28PM (#11624385)
ImageMagick shells out to "delegates" to convert to/from many of the formats it supports: reading in a PDF results in a call to "gs", reading in a .docx results in a call to "soffice --headless", etc.

As for the wisdom of this approach...

[ Parent | on HN ]
Re:Remote code execution vulnerability in ImageMagick by r1ch on Tuesday May 03, 2016 @08:25PM (#11625320)
This must expose an absolutely massive attack surface. Time to disable all these "delegates".
[ Parent | on HN ]