News for hackers. Stuff that matters.

A comment on GraphicsMagick and ImageMagick popen() shell vulnerability via filename. Parent comment

Re:GraphicsMagick and ImageMagick popen() shell vulnerabilit... by Bromskloss on Monday May 30, 2016 @06:53AM (#11800677)
I always have a hard time interpreting Twitter posts. Did you link to two images in this post? Were they things you observed when trying to upload an avatar with a filename in accordance with this bug? Why does Twitter crop the images? (This it what I see: https://u.pomf.is/dmomwl.png )
[ Parent | on HN ]
Re:GraphicsMagick and ImageMagick popen() shell vulnerabilit... by _jomo on Monday May 30, 2016 @07:44AM (#11800817)
Yes, there are two images. You should be able to click on them separately to open the full images [0][1]. The first screenshot shows a preview of the file with its name which I tried to upload to Twitter, the other one shows what I observed locally through htop when running `convert` on that filename.

0: https://pbs.twimg.com/media/Cjqj3oiXIAAYJix.jpg:large

1: https://pbs.twimg.com/media/Cjqj3pFWkAEaRcD.jpg:large

[ Parent | on HN ]