VU#580079: Arbitrary file read/write vulnerability in ImageMagick-based applications with default configuration

Overview Multiple arbitrary file read and write vulnerabilities have been identified in applications that use ImageMagick with insufficiently restrictive security policies. Collectively referred to as ImageTragick2, these issues arise when ImageMagick processes attacker-controlled SVG or PostScript content using dangerous coders or delegates permitted by its default or application-supplied configuration.

Read the full article at CERT/CC →