Re: Re: ImageMagick vulnerability

On 7 May 2016 at 22:58, Jan Ehrhardt <phpdev@ehrhardt.nl> wrote: Hey Jan, > I tried to update php_imagick.dll on Windows to 7.0.1-1, but could not get > it compiled. The 6.x branch is in maintenance mode and the security fixes are being applied to it. Can you upgrade to that? I need to do another release of Imagick to begin to officially support 7. However we need to change the Pecl release system for Imagick. Basically we need to include both the compiled Imagick files with the version of ImageMagick they were compiled against in the file that people download. As Imagick is just a thin wrapper there is no guarantee that Imagick will work with anything except the libraries that it was compiled against. ImageMagick 7 does not use a CORE_RL_wand_.lib and a > CORE_RL_magick_.lib anymore, so compilation on Windows is not possible > yet. There is some work for you to do as well... I don't have access to a Windows box to investigate what needs to be made to build against ImageMagick 7 at the moment. I might acquire one on next pay-day. I also need to do some work to both understand what a migration of 6 -> 7 implies and write some upgrade notes for end-users, as well as mark a whole load of functions as deprecated, probably. > The ImageMagick maintainers are trying to mitigate the vulnerabilities, > but did not succeed fully yet. Ref, for instance: > https://github.com/ImageMagick/ImageMagick/issues/190 Ugh. Checking the magic bytes for 'safe' file formats of gif, jpeg or png should block that. And the removing of all rights for MVG delegate through <policy domain="coder" rights="none" pattern="MVG" /> should also mitigate it. cheers Dan