Follow @Openwall on Twitter for new release announcements and other news
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date: Sun, 16 Jun 2019 12:08:20 -0500 (CDT)
From: Bob Friesenhahn <>
Subject: Re: Thousands of vulnerabilities, almost no CVEs:

On Sun, 16 Jun 2019, Solar Designer wrote:
> Some people have interpreted this as implying there are ">100 security
> bugs OSS-Fuzz found and publicly disclosed [...], and which still have
> not been fixed" specifically in ImageMagick.  However, at the link you
> referenced there are currently "only" 38 bugs specifically in
> ImageMagick, with the rest of the >100 being in other projects:

Using the ordinary public access I have, I see that ImageMagick has 
129 open issues, and 1479 issues in total.  There are surely issues 
that I can not see yet since they are hidden for up to 90 days.

Taking the number 129, that would mean that there is a huge number of 
issues already fixed (1350) which are gradually making it out to 
users.  This is too many fixes to deal with via distribution-specific 

Using my privileged access for GraphicsMagick, I currently see 343 
issues in total, with 12 issues remaining to fix.  Some of those 12 
issues are open to the public for some time now. :-(

Bob Friesenhahn,
GraphicsMagick Maintainer,
Public Key,

Powered by blists - more mailing lists

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.