Date: Thu, 19 May 2016 14:51:58 -0500 (CDT) From: Bob Friesenhahn <bfriesen@...ple.dallas.tx.us> To: oss-security@...ts.openwall.com Subject: Re: ImageMagick Is On Fire -- CVE-2016-3714 On Thu, 19 May 2016, Simon McVittie wrote: > > Having looked into it a bit for Debian, there are several factors: > > * mitigations exist, like you said The problem is that most users don't know about the problem, the mitigations, or are even aware that they are using the software. They do know about periodic application of security updates. Regarding the comments from Kurt Seifried about the supposed perils of MVG: Unless ImageMagick is configured to use RSVG (as it often is), then it will use its own built in SVG renderer by default (the built in one is still available with a "MSVG:" prefix to the filename or possibly the file extension). The SVG renderer operates by translating the SVG into MVG, including the URLs. The translation is not secure in that arbitrary MVG may be injected via SVG through text strings. SVG is a common file exchange format found on the web and often opened outside of web browsers. > * many of the upstream fixes in ImageMagick (and GraphicsMagick) > are really just mitigations too, and they remove features that someone > could conceivably have been using, which rather goes against the idea > of a stable release with a fixed feature-set Agreed. > Bob, if you would like distributions to pick up GraphicsMagick security > fixes in a timely way, it would probably be really useful to do an > upstream release - distributions are typically a lot more confident about I do plan to make a release, but want to make sure that the release is of no less quality than other releases. I want to remove the current render/MVG "mitigation" regarding magick-specific syntax and provide a "safer" operating mode which protects against magick-specific syntax when it is used for formats with expected behavior like SVG. The "safer" mode may have general purpose value outside of MVG. Bob -- Bob Friesenhahn bfriesen@...ple.dallas.tx.us, http://www.simplesystems.org/users/bfriesen/ GraphicsMagick Maintainer, http://www.GraphicsMagick.org/
Powered by blists - more mailing lists
Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.
Powered by Openwall GNU/*/Linux - Powered by OpenVZ