Re: ImageMagick Is On Fire -- CVE-2016-3714

[Bob Friesenhahn <bfriesen () simple dallas tx us>]

On Thu, 19 May 2016, Jeremy Stanley wrote:
> > As an example Ubuntu 14.04.4 LTS (which is supposed to be getting
> > security updates) has not provided ImageMagick or GraphicsMagick
> > package updates in 3 years.
> [...]
>
> Seems to be in progress? https://launchpad.net/bugs/1578398

That is good to hear.

OS distribution response seems to be good for software like ISC named 
and OpenSSH but seems to be very poor for this trivial shell-exploit 
issue which impacts a great many (perhaps more than a million) Linux, 
*BSD, Solaris, and OS-X users.  Perhaps this is because the developers 
of such packages are used to providing advance notice and a 
well-formed response and distribution maintainers are practiced and 
ready.

Most people using a graphical desktop (e.g Gnome and KDE) are exposed 
to the issue since ImageMagick (and often GraphicsMagick) is a common 
dependency and clicking on a file in a graphical file manager (or 
delivered as an email attachment) is likely to expose the user to the 
problem.  Servers processing uploaded images are exposed to the issue 
but server applications often take additional precautions which might 
protect from the problem.  Desktop users are entirely exposed.

Bob
--
Bob Friesenhahn
bfriesen () simple dallas tx us, http://www.simplesystems.org/users/bfriesen/
GraphicsMagick Maintainer,    http://www.GraphicsMagick.org/