[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <alpine.GSO.2.20.1605200827380.7756@freddy.simplesystems.org>
Date: Fri, 20 May 2016 08:52:31 -0500 (CDT)
From: Bob Friesenhahn <bfriesen@...ple.dallas.tx.us>
To: oss-security@...ts.openwall.com
Subject: Re: ImageMagick Is On Fire -- CVE-2016-3714
On Thu, 19 May 2016, John Lightsey wrote:
>
> This is the list I'm working off of. For RedHat and Debian, I only
> checked the ImageMagick updates.
>
> CVE-2016-3718 - SSRF via HTTP and FTP coders
> ImageMagick: Not fixed
> GraphicsMagick: Not fixed
> RedHat: Fixed
> Debian: Fixed
The above topic is worthy of discussion. What is a security issue in
some contexts is normal and necessary in others.
> No CVE assigned - Heap overflow in PICT parser
> ImageMagick: Fixed
> GraphicsMagick: ??
> RedHat: Not fixed
> Debian: Not fixed
> Reference: http://www.openwall.com/lists/oss-security/2016/05/11/3
The GraphicsMagick development code is not vulnerable to this one.
GraphicsMagick may have been vulnerable in the past.
> No CVE assigned - Out of bounds read in the PSD parser
> ImageMagick: Fixed
> GraphicsMagick: ??
> RedHat: Not fixed
> Debian: Not fixed
> Reference: http://www.openwall.com/lists/oss-security/2016/05/11/3
The GraphicsMagick development code is not vulnerable to this one.
GraphicsMagick may have been vulnerable in the past.
> Are there other formats that are unsafe and should be removed using the
> policy configuration files?
In interest of full-disclosure, the GraphicsMagick project has fixed
approximately 45 CVE-worthy issues since the last release, not
including issues covered by CVE-2016-2317 and CVE-2016-2318 (which are
fixed in the development code). Many of the test files are published
in full open view on bug trackers or other places.
In a similar time-frame, the ImageMagick project has been provided a
great many files (likely more than 100) which crash the software and
many of these files are published in full open view on bug trackers or
other places. Commits and other records show that problems are being
fixed.
When fixed versions are released, OS distributions which continue to
provide 3-year old releases are exposing users to releases with
perhaps hundreds of fixed vulnerabilities which can be triggered using
publically available files.
Bob
--
Bob Friesenhahn
bfriesen@...ple.dallas.tx.us, http://www.simplesystems.org/users/bfriesen/
GraphicsMagick Maintainer, http://www.GraphicsMagick.org/
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
