4 ms·
Be careful running this on an untrusted directory, especially with e.g. pdfs, just like anything else that parses images, especially using ImageMagick.
by aftbit 2y ago
Be careful running this on an untrusted directory, especially with e.g. pdfs, just like anything else that parses images, especially using ImageMagick.
- aniviacat 2y agoIs parsing untrusted images inherently problematic? If I open my (untrusted) downloads folder using Gnome Files and it displays (and therefore parses) the contained images, is that a security issue I should be concerned about? (I would have assumed that (e.g.) Javascript in PDFs could be problematic, but not a simple preview.)
- J_tt 2y agoUnfortunately, it can be a vector[0], especially on less security focused software that has less sandboxing. 0: https://www.cvedetails.com/vulnerability-list/vendor_id-7294/Libpng.html?page=1&order=3&trc=47&sha=411afff6690d97dd25405fb43da5dfe802eb4a71 https://www.cvedetails.com/vulnerability-list/vendor_id-7294...
- tedunangst 2y agoRandom example that doesn't even require opening the directory. https://github.blog/2023-10-09-coordinated-disclosure-1-click-rce-on-gnome-cve-2023-43641/ https://github.blog/2023-10-09-coordinated-disclosure-1-clic...