Re: ImageTragick
Bob Friesenhahn <[email protected]>
| Newsgroups | gmane.comp.video.graphicsmagick.help |
|---|---|
| Message-ID | <[email protected]> |
On Wed, 4 May 2016, Max Baum wrote: > Hi Bob, > > thank you for your fast reply! > > Can you share any information about the serious issue you mentioned yet? Only once I have had a proper chance to look at everything and make an assessment. If it is disclosed in another way (by the person who revealed it to me) then it won't matter. I am at my day job at the moment, which has nothing to do with GraphicsMagick. It should not take long (a few hours) to see if there are any other issues to be concerned about. Bob > > > Best, > > Max > > 2016-05-04 22:23 GMT+02:00 Bob Friesenhahn <[email protected]>: >> On Wed, 4 May 2016, Max Baum wrote: >> >>> Hi all, >>> >>> >>> is GraphicsMagick in any way affected by the current security issues >>> found in ImageMagick? >> >> GraphicsMagick does not suffer from the specific exploits described as >> "ImageTragick" because the related code was either re-written to avoid >> security issues or the ImageMagick implementation otherwise diverged. >> >> However, there is one serious issue known to me now and I plan to >> perform an investigation to make sure that any issues are properly >> identified so that they can be addressed in an expedient yet >> reasonable way. >> >> Once the investigation has been performed, I plan to post to the >> GraphicsMagick announcements list regarding any local >> fixes/work-arounds which can be made without needing to upgrade >> GraphicsMagick or which could be applied to an existing release of >> GraphicsMagick to make it safer. >> >> GraphicsMagick makes only two or three releases per year and many >> people do not have a reasonable opportunity to use the latest release >> because they use the release that their OS distribution provides. For >> example, stable Ubuntu 14.04 is providing 1.3.18, which was released >> in March of 2013. A very large number of security fixes have been >> made since that release. >> >> Bob >> -- >> Bob Friesenhahn >> [email protected], http://www.simplesystems.org/users/bfriesen/ >> GraphicsMagick Maintainer, http://www.GraphicsMagick.org/ >> >> ------------------------------------------------------------------------------ >> Find and fix application performance issues faster with Applications Manager >> Applications Manager provides deep performance insights into multiple tiers of >> your business applications. It resolves application problems quickly and >> reduces your MTTR. Get your free trial! >> https://ad.doubleclick.net/ddm/clk/302982198;130105516;z >> _______________________________________________ >> Graphicsmagick-help mailing list >> [email protected] >> https://lists.sourceforge.net/lists/listinfo/graphicsmagick-help > > ------------------------------------------------------------------------------ > Find and fix application performance issues faster with Applications Manager > Applications Manager provides deep performance insights into multiple tiers of > your business applications. It resolves application problems quickly and > reduces your MTTR. Get your free trial! > https://ad.doubleclick.net/ddm/clk/302982198;130105516;z > _______________________________________________ > Graphicsmagick-help mailing list > [email protected] > https://lists.sourceforge.net/lists/listinfo/graphicsmagick-help > -- Bob Friesenhahn [email protected], http://www.simplesystems.org/users/bfriesen/ GraphicsMagick Maintainer, http://www.GraphicsMagick.org/ ------------------------------------------------------------------------------ Find and fix application performance issues faster with Applications Manager Applications Manager provides deep performance insights into multiple tiers of your business applications. It resolves application problems quickly and reduces your MTTR. Get your free trial! https://ad.doubleclick.net/ddm/clk/302982198;130105516;z