CVE-2016-5118 is a bug in GraphicsMagick and ImageMagick whereby one can get shell execution by passing the libraries a file whose name begins with the pipe character, |.
http://seclists.org/oss-sec/2016/q2/433 We (crudely) fixed this for GraphicsMagick in d8862778c1b. Now I see that ImageMagick has suggested a similar interim fix on their forums: https://www.imagemagick.org/discourse-server/viewtopic.php?f=2&t=29803#p134039 Also, they have begun committing mitigations to their Git repository: http://git.imagemagick.org/repos/ImageMagick/commit/ca430ff77794980941ff0fa0d2fc463b50c2c6b7 I plan to fix this in our package using the "crude" option until ImageMagick releases a new version, which seems to be happening every few days. Please let me know if you object to this solution.
