Debian: DSA-3580-1: imagemagick security update
Summary
These vulnerabilities are particularly critical if Imagemagick processes
images coming from remote parties, such as part of a web service.
The update disables the vulnerable coders (EPHEMERAL, URL, MVG, MSL, and
PLT) and indirect reads via /etc/ImageMagick-6/policy.xml file. In
addition, we introduce extra preventions, including some sanitization for
input filenames in http/https delegates, the full remotion of PLT/Gnuplot
decoder, and the need of explicit reference in the filename for the
insecure coders.
For the stable distribution (jessie), these problems have been fixed in
version 8:6.8.9.9-5+deb8u2.
We recommend that you upgrade your imagemagick packages.
Further information about Debian Security Advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://www.debian.org/security/
Mailing list: debian-security-announce@lists.debian.org