CVE-2016-5118

EPSS 35.42%
Published 10.06.2016 15:59:06
Last modified 12.04.2025 10:46:40
Source cve@mitre.org
Teams watchlist Login
Open Login

The OpenBlob function in blob.c in GraphicsMagick before 1.3.24 and ImageMagick allows remote attackers to execute arbitrary code via a | (pipe) character at the start of a filename.

Affected products Warnungen 0 Metrics 3 CWE 0 References 25

Data is provided by the National Vulnerability Database (NVD)

Graphicsmagick ≫ Graphicsmagick Version <= 1.3.23

Suse ≫ Linux Enterprise Debuginfo Version11 Updatesp4

Suse ≫ Studio Onsite Version1.3

Suse ≫ Linux Enterprise Software Development Kit Version11 Updatesp4

Oracle ≫ Solaris Version10

Oracle ≫ Solaris Version11.3

Oracle ≫ Linux Version6

Oracle ≫ Linux Version7

Opensuse ≫ Leap Version42.1

Opensuse ≫ Opensuse Version13.2

Canonical ≫ Ubuntu Linux Version12.04 SwEditionlts

Canonical ≫ Ubuntu Linux Version14.04 SwEditionlts

Canonical ≫ Ubuntu Linux Version15.10

Canonical ≫ Ubuntu Linux Version16.04 SwEditionlts

Debian ≫ Debian Linux Version8.0

Suse ≫ Linux Enterprise Desktop Version12 Update-

Suse ≫ Linux Enterprise Desktop Version12.0 Updatesp1

Suse ≫ Linux Enterprise Server Version12 Update-

Suse ≫ Linux Enterprise Server Version12.0 Updatesp1

Suse ≫ Linux Enterprise Software Development Kit Version12 Update-

Suse ≫ Linux Enterprise Software Development Kit Version12.0 Updatesp1

Suse ≫ Linux Enterprise Workstation Extension Version12 Update-

Suse ≫ Linux Enterprise Workstation Extension Version12 Updatesp1

Imagemagick ≫ Imagemagick Version < 7.0.1-7

Zu dieser CVE wurde keine CISA KEV oder CERT.AT-Warnung gefunden.

EPSS Metriken
Type	Source	Score	Percentile
EPSS	FIRST.org	35.42%	0.969

CVSS Metriken
Source	Base Score	Exploit Score	Impact Score	Vector string
nvd@nist.gov	9.8	3.9	5.9	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
nvd@nist.gov	10	10	10	AV:N/AC:L/Au:N/C:C/I:C/A:C

http://www.oracle.com/technetwork/topics/security/bulletinjul2016-3090568.html

Third Party Advisory

http://lists.opensuse.org/opensuse-security-announce/2016-06/msg00032.html

Third Party Advisory

http://www.oracle.com/technetwork/topics/security/linuxbulletinapr2016-2952096.html

Third Party Advisory

http://www.debian.org/security/2016/dsa-3746

Third Party Advisory

http://www.ubuntu.com/usn/USN-2990-1

Third Party Advisory

http://git.imagemagick.org/repos/ImageMagick/commit/40639d173aa8c76b850d625c630b711fee4dcfb8

Vendor Advisory

Broken Link

http://hg.code.sf.net/p/graphicsmagick/code/file/41876934e762/ChangeLog

Vendor Advisory

Release Notes

http://hg.code.sf.net/p/graphicsmagick/code/rev/ae3928faa858

Broken Link

http://lists.opensuse.org/opensuse-security-announce/2016-06/msg00008.html

Third Party Advisory

http://lists.opensuse.org/opensuse-security-announce/2016-06/msg00009.html

Third Party Advisory

http://lists.opensuse.org/opensuse-security-announce/2016-06/msg00011.html

Third Party Advisory

http://lists.opensuse.org/opensuse-security-announce/2016-06/msg00021.html

Third Party Advisory

http://lists.opensuse.org/opensuse-security-announce/2016-06/msg00030.html

Third Party Advisory

Mailing List

http://lists.opensuse.org/opensuse-security-announce/2016-06/msg00047.html

Third Party Advisory

Mailing List

http://www.debian.org/security/2016/dsa-3591

Third Party Advisory

http://www.openwall.com/lists/oss-security/2016/05/29/7

Mailing List

Release Notes

http://www.openwall.com/lists/oss-security/2016/05/30/1

Third Party Advisory

Mailing List

http://www.securityfocus.com/bid/90938

Third Party Advisory

Broken Link

VDB Entry

http://www.securitytracker.com/id/1035984

Third Party Advisory

VDB Entry

http://www.securitytracker.com/id/1035985

Third Party Advisory

Broken Link

VDB Entry

http://www.slackware.com/security/viewer.php?l=slackware-security&y=2016&m=slackware-security.397749

Third Party Advisory

https://access.redhat.com/errata/RHSA-2016:1237

Third Party Advisory

https://nvd.nist.gov/vuln/detail/CVE-2016-5118

CVE Source (NVD)

https://cveawg.mitre.org/api/cve/CVE-2016-5118

CVE Source (JSON)

https://euvd.enisa.europa.eu/vulnerability/CVE-2016-5118

EUVD