Vulnerability updates in GraphicsMagick

I have just committed two important vulnerability fixes for 
GraphicsMagick in both the HEAD and 1.1 source branches.  One fix is 
for a security issue while the other is to prevent a denial of service 
(crash).  These fixes are important in order to get GM 1.1.8 out the 
door and regain some lost respect in the open source community.

In released versions of GraphicsMagick, a carefully crafted filename 
could be used to execute shell commands via the delegate system. 
Also, a carefully crafted filename could be used to cause a memory 
exception (core dump).  Server web applications should not allow such 
file names to be passed to the underlying software, but there is no 
doubt that some server applications are not as robust as they should 
be.

The delegate system has been updated on POSIX (Unix/Linux) platforms 
to execute without using the Unix shell if possible, and if the shell 
is absolutely required, all arguments to the shell are carefully 
protected so that user provided data can not alter expected operation. 
Most delegates are executed without using the Unix shell.  Any 
attribute which is requested via the delegates.mgk file is completely 
protected (i.e. not just file names).  This differs from my 
understanding of how ImageMagick solved the problem in that 
ImageMagick renames/copies problem file names to temporary files.

I would like to get GM 1.1.8 released as soon as possible, but 
correctness is key.  We have yet to have a broken GM release and this 
release must not be any different.  If you are using CVS or snapshots 
to access files, please update and test to make sure that everything 
is working well prior to the release.  The 1.2.020070715 snapshot 
contains the security updates.

Bob
======================================
Bob Friesenhahn
[email protected], http://www.simplesystems.org/users/bfriesen/
GraphicsMagick Maintainer,    http://www.GraphicsMagick.org/


-------------------------------------------------------------------------
This SF.net email is sponsored by DB2 Express
Download DB2 Express C - the FREE version of DB2 express and take
control of your XML. No limits. Just data. Click to get it now.
http://sourceforge.net/powerbar/db2/