Follow @Openwall on Twitter for new release announcements and other news
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date: Thu, 19 May 2016 12:07:16 -0500 (CDT)
From: Bob Friesenhahn <bfriesen@...ple.dallas.tx.us>
To: oss-security@...ts.openwall.com
Subject: Re: ImageMagick Is On Fire -- CVE-2016-3714

I find it very disturbing that there seems to be very little response 
from popular OS distributions to this issue.  Most do not appear to 
have issued any package updates to close the shell exploit.  Perhaps
the opinion is that major new versions will be introduced as part of 
major distribution releases and it is ok for users to exposed to 
problems for two or three years.

As an example Ubuntu 14.04.4 LTS (which is supposed to be getting 
security updates) has not provided ImageMagick or GraphicsMagick 
package updates in 3 years.

Even NebBSD pkgsrc does not appear to have created a new version to 
address the "ImageTragick" issues.

What is the point of security notices and advisories if there is no 
response from the community to provide updates to protect the majority 
of their users (who are using 'stable' releases) from the problems?

Bob
-- 
Bob Friesenhahn
bfriesen@...ple.dallas.tx.us, http://www.simplesystems.org/users/bfriesen/
GraphicsMagick Maintainer,    http://www.GraphicsMagick.org/

Powered by blists - more mailing lists

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.