CVE-2016-3714

The (1) EPHEMERAL, (2) HTTPS, (3) MVG, (4) MSL, (5) TEXT, (6) SHOW, (7) WIN, and (8) PLT coders in ImageMagick before 6.9.3-10 and 7.x before 7.0.1-1 allow remote attackers to execute arbitrary code via shell metacharacters in a crafted image, aka "ImageTragick."
References
Link Resource
https://bugzilla.redhat.com/show_bug.cgi?id=1332492 Issue Tracking
http://www.securitytracker.com/id/1035742 Third Party Advisory VDB Entry
https://www.imagemagick.org/discourse-server/viewtopic.php?f=4&t=29588 Vendor Advisory
https://www.kb.cert.org/vuls/id/250519 Third Party Advisory US Government Resource
http://www.openwall.com/lists/oss-security/2016/05/03/13 Mailing List
https://imagetragick.com/ Vendor Advisory
https://www.imagemagick.org/script/changelog.php Vendor Advisory
http://git.imagemagick.org/repos/ImageMagick/blob/a01518e08c840577cabd7d3ff291a9ba735f7276/ChangeLog Patch
https://access.redhat.com/security/vulnerabilities/2296071 Third Party Advisory
http://www.openwall.com/lists/oss-security/2016/05/03/18 Mailing List
http://www.ubuntu.com/usn/USN-2990-1 Third Party Advisory
http://rhn.redhat.com/errata/RHSA-2016-0726.html Third Party Advisory
http://www.oracle.com/technetwork/topics/security/bulletinjul2016-3090568.html Third Party Advisory
http://www.oracle.com/technetwork/topics/security/linuxbulletinapr2016-2952096.html Third Party Advisory
http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00024.html Third Party Advisory
http://www.debian.org/security/2016/dsa-3580 Third Party Advisory
http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00028.html Third Party Advisory
http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00041.html Third Party Advisory
https://www.exploit-db.com/exploits/39791/ Third Party Advisory VDB Entry
http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00032.html Third Party Advisory
http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00025.html Third Party Advisory
http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00051.html Third Party Advisory
http://www.slackware.com/security/viewer.php?l=slackware-security&y=2016&m=slackware-security.440568 Third Party Advisory
http://www.rapid7.com/db/modules/exploit/unix/fileformat/imagemagick_delegate Third Party Advisory
http://www.securityfocus.com/bid/89848 Third Party Advisory VDB Entry
https://security.gentoo.org/glsa/201611-21 Third Party Advisory
https://www.exploit-db.com/exploits/39767/ Third Party Advisory VDB Entry
http://www.debian.org/security/2016/dsa-3746 Third Party Advisory
http://www.securityfocus.com/archive/1/538378/100/0/threaded Third Party Advisory VDB Entry
http://packetstormsecurity.com/files/152364/ImageTragick-ImageMagick-Proof-Of-Concepts.html Third Party Advisory VDB Entry
Advertisement

NeevaHost hosting service

Configurations

Configuration 1 (hide)

OR cpe:2.3:a:imagemagick:imagemagick:7.0.0-0:*:*:*:*:*:*:*
cpe:2.3:a:imagemagick:imagemagick:*:*:*:*:*:*:*:*
cpe:2.3:a:imagemagick:imagemagick:7.0.1-0:*:*:*:*:*:*:*

Configuration 2 (hide)

OR cpe:2.3:o:canonical:ubuntu_linux:12.04:*:*:*:lts:*:*:*
cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*
cpe:2.3:o:canonical:ubuntu_linux:16.04:*:*:*:lts:*:*:*
cpe:2.3:o:canonical:ubuntu_linux:15.10:*:*:*:*:*:*:*
cpe:2.3:o:canonical:ubuntu_linux:14.04:*:*:*:lts:*:*:*
cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*
cpe:2.3:o:opensuse:leap:42.1:*:*:*:*:*:*:*
cpe:2.3:o:opensuse:opensuse:13.2:*:*:*:*:*:*:*
cpe:2.3:o:suse:suse_linux_enterprise_server:12:*:*:*:*:*:*:*

Information

Published : 2016-05-05 11:59

Updated : 2023-02-12 15:19


NVD link : CVE-2016-3714

Mitre link : CVE-2016-3714


JSON object : View

CWE
CWE-20

Improper Input Validation

Advertisement

dedicated server usa

Products Affected

canonical

  • ubuntu_linux

imagemagick

  • imagemagick

suse

  • suse_linux_enterprise_server

opensuse

  • leap
  • opensuse

debian

  • debian_linux