Follow @Openwall on Twitter for new release announcements and other news
[<prev] [next>] [day] [month] [year] [list]
Date: Sun, 8 May 2016 19:48:49 -0500 (CDT)
From: Bob Friesenhahn <>
Subject: GraphicsMagick Response To "ImageTragick"

The GraphicsMagick project response to the recent "ImageTragick" 
( exploits may be found in an email posted 
to the GraphicsMagick announcements mail list and which may be found 
archived here: 

The most important concern noted is that a shell exploit is possible 
via the "gplt" entry in the delegates.mgk file.  While GraphicsMagick 
does escape individual Unix shell arguments appropriately, the gnuplot 
load request can be used to invoke gnuplot's system() command.  The 
mere existence of a system() command makes gnuplot files entirely 
unsecure and it is a very dangerous format.

Unfortunately, I see that SourceForge converted the several patches 
into MS-DOS format.

Bob Friesenhahn,
GraphicsMagick Maintainer,

Powered by blists - more mailing lists

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.