/ Register

Join the community today
Register Now

Security GraphicsMagick and ImageMagick popen() shell vulnerability via filename

Discussion in 'CentOS, Redhat & Oracle Linux News' started by Revenge, Jun 1, 2016.

Tags:
Previous Thread Next Thread
Loading...
  1. Jun 1, 2016 #1
    Revenge

    Revenge Active Member

    469
    93
    28
    Feb 21, 2016
    Portugal
    Ratings:
    +354
    Local Time:
    9:51 AM
    1.9.x
    10.1.x
    CVE Request: GraphicsMagick and ImageMagick popen() shell vulnerabilit
     
  2. Jun 1, 2016 #2
    eva2000

    eva2000 Administrator Staff Member

    55,237
    12,253
    113
    May 24, 2014
    Brisbane, Australia
    Ratings:
    +18,833
    Local Time:
    6:51 PM
    Nginx 1.27.x
    MariaDB 10.x/11.4+
    remi repo already updated i think
    Code (Text):
    rpm -q ImageMagick-last
ImageMagick-last-6.9.4.4-1.el6.remi.x86_64

    Code (Text):
    rpm -q --changelog ImageMagick-last | head -n6
* Fri May 27 2016 Remi Collet <remi@remirepo.net> - 6.9.4.4-1
- update to version 6.9.4 patchlevel 4

* Thu May 19 2016 Remi Collet <remi@remirepo.net> - 6.9.4.3-1
- update to version 6.9.4 patchlevel 3

    shame the changelog doesn't have any details

    doing check
    Code (Text):
    convert '|echo Hello > hello.txt;' null:
convert: no decode delegate for this image format `TXT;' @ error/constitute.c/ReadImage/504.
convert: no images defined `null:' @ error/convert.c/ConvertImageCommand/3257.
ls hello.txt
hello.txt
     
Previous Thread Next Thread
Loading...

.