[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <alpine.GSO.2.20.1605191154150.15930@freddy.simplesystems.org>
Date: Thu, 19 May 2016 12:07:16 -0500 (CDT)
From: Bob Friesenhahn <bfriesen@...ple.dallas.tx.us>
To: oss-security@...ts.openwall.com
Subject: Re: ImageMagick Is On Fire -- CVE-2016-3714
I find it very disturbing that there seems to be very little response
from popular OS distributions to this issue. Most do not appear to
have issued any package updates to close the shell exploit. Perhaps
the opinion is that major new versions will be introduced as part of
major distribution releases and it is ok for users to exposed to
problems for two or three years.
As an example Ubuntu 14.04.4 LTS (which is supposed to be getting
security updates) has not provided ImageMagick or GraphicsMagick
package updates in 3 years.
Even NebBSD pkgsrc does not appear to have created a new version to
address the "ImageTragick" issues.
What is the point of security notices and advisories if there is no
response from the community to provide updates to protect the majority
of their users (who are using 'stable' releases) from the problems?
Bob
--
Bob Friesenhahn
bfriesen@...ple.dallas.tx.us, http://www.simplesystems.org/users/bfriesen/
GraphicsMagick Maintainer, http://www.GraphicsMagick.org/
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
