Explore top 10 tips to secure your open-source projects now. Read More

×
Alerts This Week
Warning Icon 1 527
Alerts This Week
Warning Icon 1 527

Debian: DSA-3580-1 critical: imagemagick input sanitation flaw

debian
Calendar Grey May 16, 2016
Scroller Debian
- ------------------------------------------------------------------------- Debian Security Advisory
Nikolay Ermishkin from the Mail.Ru Security Team and Stewie discovered several vulnerabilities in ImageMagick, a program suite for image manipulation
Topics%20covered

Topics Covered

security advisory code execution debian remote access input sanitization image processing

Summary

These vulnerabilities are particularly critical if Imagemagick processes
images coming from remote parties, such as part of a web service.

The update disables the vulnerable coders (EPHEMERAL, URL, MVG, MSL, and
PLT) and indirect reads via /etc/ImageMagick-6/policy.xml file. In
addition, we introduce extra preventions, including some sanitization for
input filenames in http/https delegates, the full remotion of PLT/Gnuplot
decoder, and the need of explicit reference in the filename for the
insecure coders.

For the stable distribution (jessie), these problems have been fixed in
version 8:6.8.9.9-5+deb8u2.

We recommend that you upgrade your imagemagick packages.

Further information about Debian Security Advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://www.debian.org/security/



Severity
critical
Lowest
Low
Medium
High
Critical

Package: imagemagick
CVE ID: CVE-2016-3714 CVE-2016-3715 CVE-2016-3716 CVE-2016-3717

Topics%20covered

Topics Covered

security advisory code execution debian remote access input sanitization image processing

Get the latest News and Insights

Get the latest Linux and open source security news straight to your inbox.