Is it safe to use ImageMagick on user images

imagemagickSecurity

I've heard there may be security concerns when using ImageMagick on arbitrary user-provided images. For example, the link below gives evidence that there used to be some buffer overflow exploits. Does anyone know if I can now safely use this as part of a web service dealing with user images?

http://rhn.redhat.com/errata/RHSA-2006-0633.html

Best Answer

That security advisory is from 2006. All software has bugs, but I wouldn't say that ImageMagick has more than other software. Seriously, if you are implementing a web service, you're probably just as likely to get hacked by someone through Apache than with ImageMagick.

In short, don't worry about it, but do keep all your software up to date.

EDIT: by the way, I helped a client implement a web service that used ImageMagick, and I never heard of one problem with it.

Related Question