Follow @Openwall on Twitter for new release announcements and other news
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date: Thu, 19 May 2016 12:42:24 -0500 (CDT)
From: Bob Friesenhahn <>
Subject: Re: ImageMagick Is On Fire -- CVE-2016-3714

On Thu, 19 May 2016, Jeremy Stanley wrote:
>> As an example Ubuntu 14.04.4 LTS (which is supposed to be getting
>> security updates) has not provided ImageMagick or GraphicsMagick
>> package updates in 3 years.
> [...]
> Seems to be in progress?

That is good to hear.

OS distribution response seems to be good for software like ISC named 
and OpenSSH but seems to be very poor for this trivial shell-exploit 
issue which impacts a great many (perhaps more than a million) Linux, 
*BSD, Solaris, and OS-X users.  Perhaps this is because the developers 
of such packages are used to providing advance notice and a 
well-formed response and distribution maintainers are practiced and 

Most people using a graphical desktop (e.g Gnome and KDE) are exposed 
to the issue since ImageMagick (and often GraphicsMagick) is a common 
dependency and clicking on a file in a graphical file manager (or 
delivered as an email attachment) is likely to expose the user to the 
problem.  Servers processing uploaded images are exposed to the issue 
but server applications often take additional precautions which might 
protect from the problem.  Desktop users are entirely exposed.

Bob Friesenhahn,
GraphicsMagick Maintainer,

Powered by blists - more mailing lists

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.