[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <alpine.GSO.2.20.1605191228070.15930@freddy.simplesystems.org>
Date: Thu, 19 May 2016 12:42:24 -0500 (CDT)
From: Bob Friesenhahn <bfriesen@...ple.dallas.tx.us>
To: oss-security@...ts.openwall.com
Subject: Re: ImageMagick Is On Fire -- CVE-2016-3714
On Thu, 19 May 2016, Jeremy Stanley wrote:
>> As an example Ubuntu 14.04.4 LTS (which is supposed to be getting
>> security updates) has not provided ImageMagick or GraphicsMagick
>> package updates in 3 years.
> [...]
>
> Seems to be in progress? https://launchpad.net/bugs/1578398
That is good to hear.
OS distribution response seems to be good for software like ISC named
and OpenSSH but seems to be very poor for this trivial shell-exploit
issue which impacts a great many (perhaps more than a million) Linux,
*BSD, Solaris, and OS-X users. Perhaps this is because the developers
of such packages are used to providing advance notice and a
well-formed response and distribution maintainers are practiced and
ready.
Most people using a graphical desktop (e.g Gnome and KDE) are exposed
to the issue since ImageMagick (and often GraphicsMagick) is a common
dependency and clicking on a file in a graphical file manager (or
delivered as an email attachment) is likely to expose the user to the
problem. Servers processing uploaded images are exposed to the issue
but server applications often take additional precautions which might
protect from the problem. Desktop users are entirely exposed.
Bob
--
Bob Friesenhahn
bfriesen@...ple.dallas.tx.us, http://www.simplesystems.org/users/bfriesen/
GraphicsMagick Maintainer, http://www.GraphicsMagick.org/
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
