Package: winff Version: 1.5.5-9 Tags: securityWinFF doesn't correctly escape filenames that it passes to shell. If the user is tricked to convert files with malicious names, this could result in execution of arbitrary code.
To reproduce, try converting the file created by this command: touch '$(cowsay pwned >&2; sleep inf).mp3' -- Jakub Wilk
