Re: ImageMagick Is On Fire -- CVE-2016-3714

[Bob Friesenhahn <bfriesen () simple dallas tx us>]

I find it very disturbing that there seems to be very little response 
from popular OS distributions to this issue.  Most do not appear to 
have issued any package updates to close the shell exploit.  Perhaps
the opinion is that major new versions will be introduced as part of 
major distribution releases and it is ok for users to exposed to 
problems for two or three years.

As an example Ubuntu 14.04.4 LTS (which is supposed to be getting 
security updates) has not provided ImageMagick or GraphicsMagick 
package updates in 3 years.

Even NebBSD pkgsrc does not appear to have created a new version to 
address the "ImageTragick" issues.

What is the point of security notices and advisories if there is no 
response from the community to provide updates to protect the majority 
of their users (who are using 'stable' releases) from the problems?

Bob
--
Bob Friesenhahn
bfriesen () simple dallas tx us, http://www.simplesystems.org/users/bfriesen/
GraphicsMagick Maintainer,    http://www.GraphicsMagick.org/