News for hackers. Stuff that matters.
Re:GraphicsMagick and ImageMagick popen() shell vulnerabilit... by userbinator on Sunday May 29, 2016 @07:01PM (#11798633)
The biggest question I have is why filenames would even need to be treated specially by ImageMagick anyway. Almost all command-line utilities that are designed to be used in pipelines have the convention of using stdin/stdout, and do so without requiring they spawn shells themselves.
Re:GraphicsMagick and ImageMagick popen() shell vulnerabilit... by zerocrates on Sunday May 29, 2016 @07:12PM (#11798668)
"Why?" can be an interesting question with ImageMagick.

Does it need a prefix you can put on a filename that makes the file automatically get deleted after it's read? I don't think so, but there it is.

Re:GraphicsMagick and ImageMagick popen() shell vulnerabilit... by ams6110 on Sunday May 29, 2016 @08:21PM (#11798904)
At some point in the past, someone thought it would be clever.