pstopnm called the ghostscript interpreter on potentially untrusted
PostScript without specifying the -dSAFER option. Not running under
-dSAFER allows PostScript code to do file IO and to open pipes to
arbitrary external programs, including /bin/sh.
Originally reported by Max Vozeler/Debian Linux; ok brad@
Cox. While these programs are not installed suid root, they are often
used to prepare data for processing. These errors may permit remote
attackers to cause a denial of service or execute arbitrary code in
any programs or scripts that use these graphics conversion tools.
http://marc.theaimsgroup.com/?l=bugtraq&m=104644687816522&w=2
