Well other than being riddled with security holes. It has its place, but never use it on user-submitted images.
Re:Google May Be Stealing Mobile Traffic
by criddell on Monday October 17, 2016 @09:25AM
(#12724750)
Well, the person I'm responding to is using Photoshop to resize images. Presumably that isn't for user submitted content.
Re:Google May Be Stealing Mobile Traffic
by microcolonel on Monday October 17, 2016 @09:04AM
(#12724621)
While that may have been true in 2014, today it's hard to find an exploitable bug affecting a major image format parser in ImageMagick. Assuming you aren't using unsanitized user-provided parameters on the command line with it, it should be fine unless your attacker is very motivated.
Re:Google May Be Stealing Mobile Traffic
by nitrogen on Monday October 17, 2016 @09:56AM
(#12725006)
There was an RCE vulnerability this year: https://imagetragick.com/
Re:Google May Be Stealing Mobile Traffic
by tetromino_ on Monday October 17, 2016 @12:28PM
(#12726543)
ImageTragick did not affect major image formats; it was a vulnerability in the parser for ImageMagick's scripting languages [1]. The real problem was that support for scripting was enabled by default, and there was no obvious big red button to disable it.
[1] Like MVG (http://www.imagemagick.org/script/magick-vector-graphics.php) and MSL (http://www.imagemagick.org/script/conjure.php)
I'd argue that you should simply sandbox it. If performance is an issue, throw it in a VM or container with a simple socat + fork + TCP-LISTEN on a socket and pipe data in/out over TCP.
You can insert ImageMagick somewhere into your production pipeline. It's excellent software.