Alerts This Week
Warning Icon 1 619
Alerts This Week
Warning Icon 1 619

Slackware 14.1: SSA:2016-132-01 Critical: Imagemagick Code Execution Threat

slackware
Calendar Grey May 11, 2016
Dist Slackware Esm H88
Enhanced ImageMagick versions for Slackware rectify vital vulnerabilities related to potential code execution and unauthorized file handling risks.
New imagemagick packages are available for Slackware 14.0, 14.1, and -current to fix security issues

Summary

Here are the details from the Slackware 14.1 ChangeLog: patches/packages/imagemagick-6.8.6_10-i486-2_slack14.1.txz: Rebuilt. This update addresses several security issues in ImageMagick, including: Insufficient shell characters filtering allows code execution (CVE-2016-3714) Server Side Request Forgery (CVE-2016-3718) File deletion (CVE-2016-3715) File moving (CVE-2016-3716) Local file read (CVE-2016-3717) To mitigate these issues, the default policy.xml config file has been modified to disable all of the vulnerable coders. For more information, see: https://imagetragick.com https://www.cve.org/CVERecord?id=CVE-2016-3714 https://www.cve.org/CVERecord?id=CVE-2016-3718 https://www.cve.org/CVERecord?id=CVE-2016-3715 https://www.cve.org/CVERecord?id=CVE-2016-3716 https://www.cve.org/CVERecord?id=CVE-2016-3717 (* Security fix *)

Where Find New Packages

Thanks to the friendly folks at the OSU Open Source Lab (https://osuosl.org/) for donating FTP and rsync hosting to the Slackware project! :-)
Also see the "Get Slack" section on http://www.slackware.com/ for additional mirror sites near you.
Updated package for Slackware 14.0:
Updated package for Slackware x86_64 14.0:
Updated package for Slackware 14.1:
Updated package for Slackware x86_64 14.1:
Updated package for Slackware -current:
Updated package for Slackware x86_64 -current:

MD5 Signatures

Slackware 14.0 package: e78d8825fc122e9411b9bbde341ce8da imagemagick-6.7.7_10-i486-2_slack14.0.txz
Slackware x86_64 14.0 package: 20bbb69e3a774f9493b3c87a90692b8f imagemagick-6.7.7_10-x86_64-2_slack14.0.txz
Slackware 14.1 package: 26aa6ce379628b85df0818b17d5b855d imagemagick-6.8.6_10-i486-2_slack14.1.txz
Slackware x86_64 14.1 package: 3060644c634984224e448ecd03bd0eb1 imagemagick-6.8.6_10-x86_64-2_slack14.1.txz
Slackware -current package: 7add4b4c162a9e59ae309ea38430e44e xap/imagemagick-6.9.4_1-i586-1.txz
Slackware x86_64 -current package: 73a376cb32a9fbf529340982dfdb9b88 xap/imagemagick-6.9.4_1-x86_64-1.txz

Severity
critical
Lowest
Low
Medium
High
Critical

Get the latest News and Insights

Get the latest Linux and open source security news straight to your inbox.

Installation Instructions

Installation instructions: Upgrade the package as root: # upgradepkg imagemagick-6.8.6_10-i486-2_slack14.1.txz

Related News

Your message here