News for hackers. Stuff that matters.

A comment on Google May Be Stealing Mobile Traffic. Parent comment

Re:Google May Be Stealing Mobile Traffic by microcolonel on Monday October 17, 2016 @09:04AM (#12724621)
While that may have been true in 2014, today it's hard to find an exploitable bug affecting a major image format parser in ImageMagick. Assuming you aren't using unsanitized user-provided parameters on the command line with it, it should be fine unless your attacker is very motivated.
[ Parent | on HN ]
Re:Google May Be Stealing Mobile Traffic by nitrogen on Monday October 17, 2016 @09:56AM (#12725006)
There was an RCE vulnerability this year: https://imagetragick.com/
[ Parent | on HN ]
Re:Google May Be Stealing Mobile Traffic by tetromino_ on Monday October 17, 2016 @12:28PM (#12726543)
ImageTragick did not affect major image formats; it was a vulnerability in the parser for ImageMagick's scripting languages [1]. The real problem was that support for scripting was enabled by default, and there was no obvious big red button to disable it.

[1] Like MVG (http://www.imagemagick.org/script/magick-vector-graphics.php) and MSL (http://www.imagemagick.org/script/conjure.php)

[ Parent | on HN ]