Ubuntu
imagemagick package

  1. Bug #27767
  2. Comment #7

Comment 7 for bug 27767

Revision history for this message
In , Daniel Kobras (kobras) wrote : Re: Bug#345238: Shell command injection in delegate code (via file names)

tag 345238 + patch
thanks

On Fri, Dec 30, 2005 at 02:19:27PM +0100, Florian Weimer wrote:
> With some user interaction, this is exploitable through Gnus and
> Thunderbird. I think this warrants increasing the severity to
> "grave".

Here's the vanilla fix from upstream SVN, stripped off whitespace changes.
I wonder why they've banned ` but still allow $(...), though.

Regards,

Daniel.