The following was reported: ... The function "rsfiltergraph" located in file ./librawstudio/rs-filter.c contains the following code:

gstringappendprintf(str, "}\n"); gfilesetcontents("/tmp/rs-filter-graph", str->str, str->len, NULL);

ignore = system("dot -Tpng >/tmp/rs-filter-graph.png </tmp/rs-filter-graph"); ignore = system("gnome-open /tmp/rs-filter-graph.png");

This code makes insecure use of two temporary files:

/tmp/rs-filter-graph.png /tmp/rs-filter-graph

This allows the truncation of arbitrary files which are owned by the user running rawstudio - for example:

ln -s ~/.important /tmp/rs-filter-graph ln -s /etc/shadow /tmp/rs-filter-graph.png