Topic: Newer ImageMagick version than in base repository?

[cactus]

Has someone installed a newer ImageMagick version (6.2.2.3 or higher) than the one in the base repository (6.0.7) as this has a vulnerability as stated by my gallery2 installation:

Version

ImageMagick 6.0.7

Warning: This version of ImageMagick has a known vulnerability that can be exploited to cause infinite loops. You may wish to upgrade. This determination may be inaccurate for Debian.

It links to the National Vulnerability Site which states:

Vulnerability Summary CVE-2005-1739[/url]"]The XWD Decoder in ImageMagick before 6.2.2.3, and GraphicsMagick before 1.1.6-r1, allows remote attackers to cause a denial of service (infinite loop) via an image with a zero color mask.

[crazybob]

Did you notify the security team at security@contribs.org ?
Never mind, I just did it myself

Bob

[cactus]

Did you notify the security team at security@contribs.org ?
Never mind, I just did it myself

Bob

No did not do so... Thanks for reporting it to them.

[gregswallow]

* Thu May 26 2005  <mclasen@redhat.com> - 6.0.7.1-12
- fix a denial of service in the xwd coder (#158790, CAN-2005-1739)

As long as you have this version or newer, you are ok.

It's an rpm from CentOS by the way, not part of SME7.