Legacy ImageMagick Discussions Archive

Does the C++ API to ImageMagick (Magick++) suffer from the same security flaws the command line version does?

My C++ windows application utilises the Magick++ library to convert various image formats. This is done in server side code of a web application.

The policy.xml file doesn't currently have any delegates, coders, filters, paths, or resources defined.
The delegates.xml file does not have an HTTPS decode defined.

I have no requirement to support MVG, MSL, or HTTPS.

Any advice would be appreciated.

Yes, Magick++ is affected. See https://www.imagemagick.org/discourse-s ... =4&t=29588 and add the recommended policies to your policy.xml configuration file. This should effectively prevent the recent reported vulnerabilities.