Date: Thu, 19 May 2016 12:07:16 -0500 (CDT) From: Bob Friesenhahn <bfriesen@...ple.dallas.tx.us> To: oss-security@...ts.openwall.com Subject: Re: ImageMagick Is On Fire -- CVE-2016-3714 I find it very disturbing that there seems to be very little response from popular OS distributions to this issue. Most do not appear to have issued any package updates to close the shell exploit. Perhaps the opinion is that major new versions will be introduced as part of major distribution releases and it is ok for users to exposed to problems for two or three years. As an example Ubuntu 14.04.4 LTS (which is supposed to be getting security updates) has not provided ImageMagick or GraphicsMagick package updates in 3 years. Even NebBSD pkgsrc does not appear to have created a new version to address the "ImageTragick" issues. What is the point of security notices and advisories if there is no response from the community to provide updates to protect the majority of their users (who are using 'stable' releases) from the problems? Bob -- Bob Friesenhahn bfriesen@...ple.dallas.tx.us, http://www.simplesystems.org/users/bfriesen/ GraphicsMagick Maintainer, http://www.GraphicsMagick.org/
Powered by blists - more mailing lists
Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.
Powered by Openwall GNU/*/Linux - Powered by OpenVZ