fixes for version 7 CVEs

[dotlambda]

NIST lists many CVEs as affecting ImageMagick 6.9.12-1. These seem to be CVEs reported for ImageMagick 7. How can I check whether these apply to version 6 and in which release they were fixed?

[dlemstra]

Most CVE's also have a corresponding issue that you can find in the report. And if those issues have a commit that is done in the IM6 repository you know that it also affected ImageMagick 6.

[dotlambda]

Is there a changelog which lists the CVEs fixed in a given release of ImageMagick6?

[urban-warrior]

No, CVE's are submitted by ImageMagick users and they sometimes will associate the CVE with the original issue posted here. The original issue posting will typically also include the patch we committed to resolve the issue. Try searching for CVE in the open and closed issues.