Date: Thu, 19 May 2016 12:42:24 -0500 (CDT) From: Bob Friesenhahn <bfriesen@...ple.dallas.tx.us> To: oss-security@...ts.openwall.com Subject: Re: ImageMagick Is On Fire -- CVE-2016-3714 On Thu, 19 May 2016, Jeremy Stanley wrote: >> As an example Ubuntu 14.04.4 LTS (which is supposed to be getting >> security updates) has not provided ImageMagick or GraphicsMagick >> package updates in 3 years. > [...] > > Seems to be in progress? https://launchpad.net/bugs/1578398 That is good to hear. OS distribution response seems to be good for software like ISC named and OpenSSH but seems to be very poor for this trivial shell-exploit issue which impacts a great many (perhaps more than a million) Linux, *BSD, Solaris, and OS-X users. Perhaps this is because the developers of such packages are used to providing advance notice and a well-formed response and distribution maintainers are practiced and ready. Most people using a graphical desktop (e.g Gnome and KDE) are exposed to the issue since ImageMagick (and often GraphicsMagick) is a common dependency and clicking on a file in a graphical file manager (or delivered as an email attachment) is likely to expose the user to the problem. Servers processing uploaded images are exposed to the issue but server applications often take additional precautions which might protect from the problem. Desktop users are entirely exposed. Bob -- Bob Friesenhahn bfriesen@...ple.dallas.tx.us, http://www.simplesystems.org/users/bfriesen/ GraphicsMagick Maintainer, http://www.GraphicsMagick.org/
Powered by blists - more mailing lists
Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.
Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.