Re:Google May Be Stealing Mobile Traffic
by nitrogen on Monday October 17, 2016 @09:56AM
(#12725006)
There was an RCE vulnerability this year: https://imagetragick.com/
[ Parent
| on HN ]
Re:Google May Be Stealing Mobile Traffic
by tetromino_ on Monday October 17, 2016 @12:28PM
(#12726543)
ImageTragick did not affect major image formats; it was a vulnerability in the parser for ImageMagick's scripting languages [1]. The real problem was that support for scripting was enabled by default, and there was no obvious big red button to disable it.
[1] Like MVG (http://www.imagemagick.org/script/magick-vector-graphics.php) and MSL (http://www.imagemagick.org/script/conjure.php)