Re:GraphicsMagick and ImageMagick popen() shell vulnerabilit...
by userbinator on Sunday May 29, 2016 @07:01PM
(#11798633)
The biggest question I have is why filenames would even need to be treated specially by ImageMagick anyway. Almost all command-line utilities that are designed to be used in pipelines have the convention of using stdin/stdout, and do so without requiring they spawn shells themselves.
[ Parent
| on HN ]
Re:GraphicsMagick and ImageMagick popen() shell vulnerabilit...
by zerocrates on Sunday May 29, 2016 @07:12PM
(#11798668)
"Why?" can be an interesting question with ImageMagick.
Does it need a prefix you can put on a filename that makes the file automatically get deleted after it's read? I don't think so, but there it is.