Requesting advice on ImageMagick popen() filename vulnerability (CVE-2016-5118)

[Leo Famulari]

CVE-2016-5118 is a bug in GraphicsMagick and ImageMagick whereby
one can get shell execution by passing the libraries a file whose name
begins with the pipe character, |.

http://seclists.org/oss-sec/2016/q2/433

We (crudely) fixed this for GraphicsMagick in d8862778c1b.

Now I see that ImageMagick has suggested a similar interim fix on their
forums:
https://www.imagemagick.org/discourse-server/viewtopic.php?f=2&t=29803#p134039

Also, they have begun committing mitigations to their Git repository:
http://git.imagemagick.org/repos/ImageMagick/commit/ca430ff77794980941ff0fa0d2fc463b50c2c6b7

I plan to fix this in our package using the "crude" option until
ImageMagick releases a new version, which seems to be happening every
few days.

Please let me know if you object to this solution.