ImageMagick and CVE-2016-3714

SUSE Product Topics SLES Configure-Administer
1

Hello,

Recommended mitigation seems to be to tweak /etc/ImageMagick/policy.xml file but that does not appear to exist even with both ImageMagick packages installed.
Anyone know if I created this directory and file that the ImageMagick software will actually read the file?

Thanks,
Matt

2

To mitigate this I ended up doing the following :

vi /usr/lib64/ImageMagick-6.4.3/config/configure.xml
add









cd /usr/lib64/ImageMagick-6.4.3/modules-Q16/coders

mv mvg.so mvg.so.bak
mv msl.so msl.so.bak
mv label.so label.so.bak

Matt

3

Hi
Looks like a fix is on the way;
https://bugzilla.suse.com/show_bug.cgi?id=978061

–
Cheers Malcolm °¿° LFCS, SUSE Knowledge Partner (Linux Counter #276890)
openSUSE Leap 42.1|GNOME 3.16.2|4.1.20-11-default
If you find this post helpful and are logged into the web interface,
please show your appreciation and click on the star below… Thanks!

4

[QUOTE=skunkboy;32464]To mitigate this I ended up doing the following :

vi /usr/lib64/ImageMagick-6.4.3/config/configure.xml
add









cd /usr/lib64/ImageMagick-6.4.3/modules-Q16/coders

mv mvg.so mvg.so.bak
mv msl.so msl.so.bak
mv label.so label.so.bak

Matt[/QUOTE]

Hi Matt,

I tried your approach but don’t work. I added the policy setting to configure.xml. However, I can still trigger the issue.

Thanks!
William

5

Hmm, well that sucks. All of the information I can find on how to mitigate this issue before any updates are issued lead me to believe that this should work.

6

Patch appears to be out for Suse 11 sp4 now …