http://git.imagemagick.org/repos/ImageMagick/blob/a01518e08c840577cabd7d3ff291a9ba735f7276/ChangeLog

http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00024.html

http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00025.html

http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00028.html

http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00032.html

http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00041.html

http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00051.html

http://packetstormsecurity.com/files/152364/ImageTragick-ImageMagick-Proof-Of-Concepts.html

http://rhn.redhat.com/errata/RHSA-2016-0726.html

http://www.debian.org/security/2016/dsa-3580

http://www.debian.org/security/2016/dsa-3746

http://www.openwall.com/lists/oss-security/2016/05/03/13

http://www.openwall.com/lists/oss-security/2016/05/03/18

http://www.oracle.com/technetwork/topics/security/bulletinjul2016-3090568.html

http://www.oracle.com/technetwork/topics/security/linuxbulletinapr2016-2952096.html

http://www.rapid7.com/db/modules/exploit/unix/fileformat/imagemagick_delegate

http://www.securityfocus.com/archive/1/538378/100/0/threaded

http://www.securityfocus.com/bid/89848

http://www.securitytracker.com/id/1035742

http://www.slackware.com/security/viewer.php?l=slackware-security&y=2016&m=slackware-security.440568

http://www.ubuntu.com/usn/USN-2990-1

https://access.redhat.com/security/vulnerabilities/2296071

https://bugzilla.redhat.com/show_bug.cgi?id=1332492

https://imagetragick.com/

https://security.gentoo.org/glsa/201611-21

https://www.exploit-db.com/exploits/39767/

https://www.exploit-db.com/exploits/39791/

https://www.imagemagick.org/discourse-server/viewtopic.php?f=4&t=29588

https://www.imagemagick.org/script/changelog.php

https://www.kb.cert.org/vuls/id/250519

NIST AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

NIST AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

2024-09-09

2024-09-30

Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

ImageMagick Improper Input Validation Vulnerability

CISA-ADP AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CISA-ADP CWE-20

It was discovered that ImageMagick did not properly sanitize certain input before passing it to the delegate functionality. A remote attacker could create a specially crafted image that, when processed by an application using ImageMagick or an unsuspecting user using the ImageMagick utilities, would lead to arbitrary execution of shell commands with the privileges of the user running the application.

The (1) EPHEMERAL, (2) HTTPS, (3) MVG, (4) MSL, (5) TEXT, (6) SHOW, (7) WIN, and (8) PLT coders in ImageMagick before 6.9.3-10 and 7.x before 7.0.1-1 allow remote attackers to execute arbitrary code via shell metacharacters in a crafted image, aka "ImageTragick."

Red Hat, Inc. AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Red Hat, Inc. (AV:N/AC:M/Au:N/C:P/I:P/A:P)

https://access.redhat.com/errata/RHSA-2016:0726 [No Types Assigned]

https://access.redhat.com/security/cve/CVE-2016-3714 [No Types Assigned]

The (1) EPHEMERAL, (2) HTTPS, (3) MVG, (4) MSL, (5) TEXT, (6) SHOW, (7) WIN, and (8) PLT coders in ImageMagick before 6.9.3-10 and 7.x before 7.0.1-1 allow remote attackers to execute arbitrary code via shell metacharacters in a crafted image, aka "ImageTragick."

It was discovered that ImageMagick did not properly sanitize certain input before passing it to the delegate functionality. A remote attacker could create a specially crafted image that, when processed by an application using ImageMagick or an unsuspecting user using the ImageMagick utilities, would lead to arbitrary execution of shell commands with the privileges of the user running the application.

Red Hat, Inc. AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Red Hat, Inc. (AV:N/AC:M/Au:N/C:P/I:P/A:P)

https://access.redhat.com/errata/RHSA-2016:0726 [No Types Assigned]

https://access.redhat.com/security/cve/CVE-2016-3714 [No Types Assigned]

OR
     *cpe:2.3:o:canonical:ubuntu_linux:12.04:*:*:*:lts:*:*:*
     *cpe:2.3:o:canonical:ubuntu_linux:14.04:*:*:*:lts:*:*:*
     *cpe:2.3:o:canonical:ubuntu_linux:15.10:*:*:*:*:*:*:*
     *cpe:2.3:o:canonical:ubuntu_linux:16.04:*:*:*:lts:*:*:*

OR
     *cpe:2.3:o:canonical:ubuntu_linux:12.04:*:*:*:lts:*:*:*
     *cpe:2.3:o:canonical:ubuntu_linux:14.04:*:*:*:lts:*:*:*
     *cpe:2.3:o:canonical:ubuntu_linux:15.10:*:*:*:*:*:*:*
     *cpe:2.3:o:canonical:ubuntu_linux:16.04:*:*:*:lts:*:*:*
     *cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*
     *cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*
     *cpe:2.3:o:opensuse:leap:42.1:*:*:*:*:*:*:*
     *cpe:2.3:o:opensuse:opensuse:13.2:*:*:*:*:*:*:*
     *cpe:2.3:o:suse:suse_linux_enterprise_se

http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00024.html No Types Assigned

http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00024.html Third Party Advisory

http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00025.html No Types Assigned

http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00025.html Third Party Advisory

http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00028.html No Types Assigned

http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00028.html Third Party Advisory

http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00032.html No Types Assigned

http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00032.html Third Party Advisory

http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00041.html No Types Assigned

http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00041.html Third Party Advisory

http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00051.html No Types Assigned

http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00051.html Third Party Advisory

http://packetstormsecurity.com/files/152364/ImageTragick-ImageMagick-Proof-Of-Concepts.html No Types Assigned

http://packetstormsecurity.com/files/152364/ImageTragick-ImageMagick-Proof-Of-Concepts.html Third Party Advisory, VDB Entry

http://rhn.redhat.com/errata/RHSA-2016-0726.html No Types Assigned

http://rhn.redhat.com/errata/RHSA-2016-0726.html Third Party Advisory

http://www.debian.org/security/2016/dsa-3580 No Types Assigned

http://www.debian.org/security/2016/dsa-3580 Third Party Advisory

http://www.debian.org/security/2016/dsa-3746 No Types Assigned

http://www.debian.org/security/2016/dsa-3746 Third Party Advisory

http://www.openwall.com/lists/oss-security/2016/05/03/13 No Types Assigned

http://www.openwall.com/lists/oss-security/2016/05/03/13 Mailing List

http://www.openwall.com/lists/oss-security/2016/05/03/18 No Types Assigned

http://www.openwall.com/lists/oss-security/2016/05/03/18 Mailing List

http://www.oracle.com/technetwork/topics/security/bulletinjul2016-3090568.html No Types Assigned

http://www.oracle.com/technetwork/topics/security/bulletinjul2016-3090568.html Third Party Advisory

http://www.oracle.com/technetwork/topics/security/linuxbulletinapr2016-2952096.html No Types Assigned

http://www.oracle.com/technetwork/topics/security/linuxbulletinapr2016-2952096.html Third Party Advisory

http://www.rapid7.com/db/modules/exploit/unix/fileformat/imagemagick_delegate No Types Assigned

http://www.rapid7.com/db/modules/exploit/unix/fileformat/imagemagick_delegate Third Party Advisory

http://www.securityfocus.com/archive/1/538378/100/0/threaded No Types Assigned

http://www.securityfocus.com/archive/1/538378/100/0/threaded Third Party Advisory, VDB Entry

http://www.securityfocus.com/bid/89848 No Types Assigned

http://www.securityfocus.com/bid/89848 Third Party Advisory, VDB Entry

http://www.securitytracker.com/id/1035742 No Types Assigned

http://www.securitytracker.com/id/1035742 Third Party Advisory, VDB Entry

http://www.slackware.com/security/viewer.php?l=slackware-security&y=2016&m=slackware-security.440568 No Types Assigned

http://www.slackware.com/security/viewer.php?l=slackware-security&y=2016&m=slackware-security.440568 Third Party Advisory

http://www.ubuntu.com/usn/USN-2990-1 No Types Assigned

http://www.ubuntu.com/usn/USN-2990-1 Third Party Advisory

https://access.redhat.com/security/vulnerabilities/2296071 No Types Assigned

https://access.redhat.com/security/vulnerabilities/2296071 Third Party Advisory

https://bugzilla.redhat.com/show_bug.cgi?id=1332492 No Types Assigned

https://bugzilla.redhat.com/show_bug.cgi?id=1332492 Issue Tracking

https://security.gentoo.org/glsa/201611-21 No Types Assigned

https://security.gentoo.org/glsa/201611-21 Third Party Advisory

https://www.exploit-db.com/exploits/39767/ No Types Assigned

https://www.exploit-db.com/exploits/39767/ Third Party Advisory, VDB Entry

https://www.exploit-db.com/exploits/39791/ No Types Assigned

https://www.exploit-db.com/exploits/39791/ Third Party Advisory, VDB Entry

https://www.kb.cert.org/vuls/id/250519 US Government Resource

https://www.kb.cert.org/vuls/id/250519 Third Party Advisory, US Government Resource

http://packetstormsecurity.com/files/152364/ImageTragick-ImageMagick-Proof-Of-Concepts.html [No Types Assigned]

http://www.securityfocus.com/archive/1/538378/100/0/threaded [No Types Assigned]

http://www.securityfocus.com/archive/1/archive/1/538378/100/0/threaded [No Types Assigned]

http://www.debian.org/security/2016/dsa-3746 [No Types Assigned]

https://www.exploit-db.com/exploits/39767/ [No Types Assigned]

https://security.gentoo.org/glsa/201611-21 [No Types Assigned]

http://www.securityfocus.com/bid/89848 [No Types Assigned]

http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00024.html [No Types Assigned]

http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00025.html [No Types Assigned]

http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00028.html [No Types Assigned]

http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00032.html [No Types Assigned]

http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00041.html [No Types Assigned]

http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00051.html [No Types Assigned]

http://www.debian.org/security/2016/dsa-3580 [No Types Assigned]

http://www.rapid7.com/db/modules/exploit/unix/fileformat/imagemagick_delegate [No Types Assigned]

http://www.securityfocus.com/archive/1/archive/1/538378/100/0/threaded [No Types Assigned]

http://www.slackware.com/security/viewer.php?l=slackware-security&y=2016&m=slackware-security.440568 [No Types Assigned]

https://www.exploit-db.com/exploits/39791/ [No Types Assigned]

http://www.oracle.com/technetwork/topics/security/linuxbulletinapr2016-2952096.html

http://www.oracle.com/technetwork/topics/security/bulletinjul2016-3090568.html

http://rhn.redhat.com/errata/RHSA-2016-0726.html

Configuration 1
     OR
          *cpe:2.3:a:imagemagick:imagemagick:7.0.1-0:*:*:*:*:*:*:*
          *cpe:2.3:a:imagemagick:imagemagick:7.0.0-0:*:*:*:*:*:*:*
          *cpe:2.3:a:imagemagick:imagemagick:6.9.3-9:*:*:*:*:*:*:* (and previous)

Configuration 1
     OR
          *cpe:2.3:a:imagemagick:imagemagick:7.0.1-0:*:*:*:*:*:*:*
          *cpe:2.3:a:imagemagick:imagemagick:7.0.0-0:*:*:*:*:*:*:*
          *cpe:2.3:a:imagemagick:imagemagick:6.9.3-9:*:*:*:*:*:*:* (and previous)
Configuration 2
     OR
          *cpe:2.3:o:canonical:ubuntu_linux:15.10:*:*:*:*:*:*:*
          *cpe:2.3:o:canonical:ubuntu_linux:16.04:*:*:*:lts:*:*:*
          *cpe:2.3:o:canonical:ubuntu_linux:14.04:*:*:*:lts:*:*:*
          *cpe:2.3:o:canonical:ubuntu_li

http://www.ubuntu.com/usn/USN-2990-1

AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

(AV:N/AC:L/Au:N/C:C/I:C/A:C)

CWE-20

Configuration 1
     OR
          *cpe:2.3:a:imagemagick:imagemagick:7.0.1-0:*:*:*:*:*:*:*
          *cpe:2.3:a:imagemagick:imagemagick:7.0.0-0:*:*:*:*:*:*:*
          *cpe:2.3:a:imagemagick:imagemagick:6.9.3-9:*:*:*:*:*:*:* (and previous)

http://git.imagemagick.org/repos/ImageMagick/blob/a01518e08c840577cabd7d3ff291a9ba735f7276/ChangeLog No Types Assigned

http://git.imagemagick.org/repos/ImageMagick/blob/a01518e08c840577cabd7d3ff291a9ba735f7276/ChangeLog Patch

https://imagetragick.com/ No Types Assigned

https://imagetragick.com/ Advisory

https://www.imagemagick.org/discourse-server/viewtopic.php?f=4&t=29588 No Types Assigned

https://www.imagemagick.org/discourse-server/viewtopic.php?f=4&t=29588 Advisory

https://www.imagemagick.org/script/changelog.php No Types Assigned

https://www.imagemagick.org/script/changelog.php Advisory