10

CVE-2016-3714

Warnung
Medienbericht
The (1) EPHEMERAL, (2) HTTPS, (3) MVG, (4) MSL, (5) TEXT, (6) SHOW, (7) WIN, and (8) PLT coders in ImageMagick before 6.9.3-10 and 7.x before 7.0.1-1 allow remote attackers to execute arbitrary code via shell metacharacters in a crafted image, aka "ImageTragick."
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Imagemagick ≫ Imagemagick Version <= 6.9.3-9
Imagemagick ≫ Imagemagick Version 7.0.0-0
Imagemagick ≫ Imagemagick Version 7.0.1-0
Canonical ≫ Ubuntu Linux Version 12.04 SwEdition lts
Canonical ≫ Ubuntu Linux Version 14.04 SwEdition lts
Canonical ≫ Ubuntu Linux Version 15.10
Canonical ≫ Ubuntu Linux Version 16.04 SwEdition lts
Debian ≫ Debian Linux Version 8.0
Debian ≫ Debian Linux Version 9.0
Opensuse ≫ Leap Version 42.1
Opensuse ≫ Opensuse Version 13.2

09.09.2024: CISA Known Exploited Vulnerabilities (KEV) Catalog

ImageMagick Improper Input Validation Vulnerability

Schwachstelle

ImageMagick contains an improper input validation vulnerability that affects the EPHEMERAL, HTTPS, MVG, MSL, TEXT, SHOW, WIN, and PLT coders. This allows a remote attacker to execute arbitrary code via shell metacharacters in a crafted image.

Beschreibung

Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

Erforderliche Maßnahmen
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 97.49% 0.999
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
NIST 8.4 2.5 5.9
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
NIST 10 10 10
AV:N/AC:L/Au:N/C:C/I:C/A:C
CISA-ADP 8.4 2.5 5.9
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CWE-20 Improper Input Validation

The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

Für Zugriff zu Vulnerability Intelligence ist ein VulnDex Zugang erforderlich.
VulnDex Intel
Media Report
24.07.2026 15:18
http://www.oracle.com/technetwork/topics/security/bulletinjul2016-3090568.html
Third Party Advisory
http://www.oracle.com/technetwork/topics/security/linuxbulletinapr2016-2952096.html
Third Party Advisory
http://git.imagemagick.org/repos/ImageMagick/blob/a01518e08c840577cabd7d3ff291a9ba735f7276/ChangeLog
Patch
http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00024.html
Third Party Advisory
http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00025.html
Third Party Advisory
http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00028.html
Third Party Advisory
http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00032.html
Third Party Advisory
http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00041.html
Third Party Advisory
http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00051.html
Third Party Advisory
http://packetstormsecurity.com/files/152364/ImageTragick-ImageMagick-Proof-Of-Concepts.html
Third Party Advisory
VDB Entry
http://rhn.redhat.com/errata/RHSA-2016-0726.html
Third Party Advisory
http://www.debian.org/security/2016/dsa-3580
Third Party Advisory
http://www.debian.org/security/2016/dsa-3746
Third Party Advisory
http://www.openwall.com/lists/oss-security/2016/05/03/13
Mailing List
http://www.openwall.com/lists/oss-security/2016/05/03/18
Mailing List
http://www.rapid7.com/db/modules/exploit/unix/fileformat/imagemagick_delegate
Third Party Advisory
http://www.securityfocus.com/archive/1/538378/100/0/threaded
Third Party Advisory
VDB Entry
http://www.securityfocus.com/bid/89848
Third Party Advisory
VDB Entry
http://www.securitytracker.com/id/1035742
Third Party Advisory
VDB Entry
http://www.slackware.com/security/viewer.php?l=slackware-security&y=2016&m=slackware-security.440568
Third Party Advisory
http://www.ubuntu.com/usn/USN-2990-1
Third Party Advisory
https://access.redhat.com/security/vulnerabilities/2296071
Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=1332492
Issue Tracking
https://imagetragick.com/
Vendor Advisory
https://security.gentoo.org/glsa/201611-21
Third Party Advisory
https://www.exploit-db.com/exploits/39767/
Third Party Advisory
VDB Entry
https://www.exploit-db.com/exploits/39791/
Third Party Advisory
VDB Entry
https://www.imagemagick.org/discourse-server/viewtopic.php?f=4&t=29588
Vendor Advisory
https://www.imagemagick.org/script/changelog.php
Vendor Advisory
https://www.kb.cert.org/vuls/id/250519
Third Party Advisory
US Government Resource
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2016-3714
US Government Resource