5.8

CVE-2016-3715

Warnung
Exploit

The EPHEMERAL coder in ImageMagick before 6.9.3-10 and 7.x before 7.0.1-1 allows remote attackers to delete arbitrary files via a crafted image.

Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Redhat ≫ Enterprise Linux Eus Version6.7
Redhat ≫ Enterprise Linux Eus Version7.2
Redhat ≫ Enterprise Linux Eus Version7.3
Redhat ≫ Enterprise Linux Eus Version7.4
Redhat ≫ Enterprise Linux Eus Version7.5
Redhat ≫ Enterprise Linux Eus Version7.6
Redhat ≫ Enterprise Linux Eus Version7.7
Imagemagick ≫ Imagemagick Version < 6.9.3-10
Imagemagick ≫ Imagemagick Version7.0.0-0
Imagemagick ≫ Imagemagick Version7.0.1-0
Canonical ≫ Ubuntu Linux Version12.04 SwEditionlts
Canonical ≫ Ubuntu Linux Version14.04 SwEditionesm
Canonical ≫ Ubuntu Linux Version15.10
Canonical ≫ Ubuntu Linux Version16.04 SwEditionesm
Oracle ≫ Linux Version6 Update-
Oracle ≫ Linux Version7 Update-
Oracle ≫ Solaris Version10
Oracle ≫ Solaris Version11.3
Suse ≫ Linux Enterprise Debuginfo Version11 Updatesp2
Suse ≫ Linux Enterprise Debuginfo Version11 Updatesp3
Suse ≫ Linux Enterprise Debuginfo Version11 Updatesp4
Suse ≫ Manager Version2.1
Suse ≫ Manager Proxy Version2.1
Suse ≫ Openstack Cloud Version5
Opensuse ≫ Leap Version42.1
Opensuse ≫ Opensuse Version13.2
Suse ≫ Linux Enterprise Desktop Version12 Update-
Suse ≫ Linux Enterprise Desktop Version12 Updatesp1
Suse ≫ Linux Enterprise Server Version11 Updatesp2 SwEditionltss
Suse ≫ Linux Enterprise Server Version11 Updatesp3 SwEditionltss
Suse ≫ Linux Enterprise Server Version11 Updatesp4
Suse ≫ Linux Enterprise Server Version12 Update-
Suse ≫ Linux Enterprise Server Version12 Updatesp1

03.11.2021: CISA Known Exploited Vulnerabilities (KEV) Catalog

ImageMagick Arbitrary File Deletion Vulnerability

Schwachstelle

ImageMagick contains an unspecified vulnerability that could allow users to delete files by using ImageMagick's 'ephemeral' pseudo protocol, which deletes files after reading.

Beschreibung

Apply updates per vendor instructions.

Erforderliche Maßnahmen
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 79.8% 0.991
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
nvd@nist.gov 5.5 1.8 3.6
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N
nvd@nist.gov 5.8 8.6 4.9
AV:N/AC:M/Au:N/C:N/I:P/A:P
134c704f-9b21-4f2e-91b3-4a467353bcc0 5.5 1.8 3.6
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N
CWE-552 Files or Directories Accessible to External Parties

The product makes files or directories accessible to unauthorized actors, even though they should not be.

http://www.debian.org/security/2016/dsa-3580
Third Party Advisory
Mailing List
http://www.debian.org/security/2016/dsa-3746
Third Party Advisory
Mailing List
http://www.securityfocus.com/archive/1/538378/100/0/threaded
Third Party Advisory
Broken Link
VDB Entry
https://www.exploit-db.com/exploits/39767/
Third Party Advisory
Exploit
VDB Entry
http://www.securityfocus.com/bid/89852
Third Party Advisory
Broken Link
VDB Entry