2016-05-10
ALT-BU-2016-2753-1
Branch p8 update bulletin.
Package ImageMagick updated to version 6.9.3.10-alt1 for branch p8 in task 164370.
Closed vulnerabilities
Published: 2016-05-05
BDU:2016-01146
Уязвимость консольного графического редактора ImageMagick, позволяющая нарушителю выполнить произвольный код
Severity: CRITICAL (10.0)
References:
Published: 2016-05-05
BDU:2016-01573
Уязвимость консольного графического редактора ImageMagick, позволяющая нарушителю удалить произвольные файлы
Severity: MEDIUM (5.8)
References:
Published: 2017-03-15
BDU:2017-01647
Уязвимость компонента gnuplot консольного графического редактора ImageMagick и GraphicsMagick, позволяющая нарушителю выполнить произвольные команды
Severity: HIGH (7.5)
References:
Published: 2016-05-05
Modified: 2025-01-28
Modified: 2025-01-28
CVE-2016-3714
The (1) EPHEMERAL, (2) HTTPS, (3) MVG, (4) MSL, (5) TEXT, (6) SHOW, (7) WIN, and (8) PLT coders in ImageMagick before 6.9.3-10 and 7.x before 7.0.1-1 allow remote attackers to execute arbitrary code via shell metacharacters in a crafted image, aka "ImageTragick."
Severity: HIGH (8.4)
Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
References:
- http://git.imagemagick.org/repos/ImageMagick/blob/a01518e08c840577cabd7d3ff291a9ba735f7276/ChangeLog
- http://git.imagemagick.org/repos/ImageMagick/blob/a01518e08c840577cabd7d3ff291a9ba735f7276/ChangeLog
- SUSE-SU-2016:1260
- SUSE-SU-2016:1260
- openSUSE-SU-2016:1261
- openSUSE-SU-2016:1261
- openSUSE-SU-2016:1266
- openSUSE-SU-2016:1266
- SUSE-SU-2016:1275
- SUSE-SU-2016:1275
- SUSE-SU-2016:1301
- SUSE-SU-2016:1301
- openSUSE-SU-2016:1326
- openSUSE-SU-2016:1326
- http://packetstormsecurity.com/files/152364/ImageTragick-ImageMagick-Proof-Of-Concepts.html
- http://packetstormsecurity.com/files/152364/ImageTragick-ImageMagick-Proof-Of-Concepts.html
- RHSA-2016:0726
- RHSA-2016:0726
- DSA-3580
- DSA-3580
- DSA-3746
- DSA-3746
- [oss-security] 20160503 ImageMagick Is On Fire -- CVE-2016-3714
- [oss-security] 20160503 ImageMagick Is On Fire -- CVE-2016-3714
- [oss-security] 20160504 Re: ImageMagick Is On Fire -- CVE-2016-3714
- [oss-security] 20160504 Re: ImageMagick Is On Fire -- CVE-2016-3714
- http://www.oracle.com/technetwork/topics/security/bulletinjul2016-3090568.html
- http://www.oracle.com/technetwork/topics/security/bulletinjul2016-3090568.html
- http://www.oracle.com/technetwork/topics/security/linuxbulletinapr2016-2952096.html
- http://www.oracle.com/technetwork/topics/security/linuxbulletinapr2016-2952096.html
- http://www.rapid7.com/db/modules/exploit/unix/fileformat/imagemagick_delegate
- http://www.rapid7.com/db/modules/exploit/unix/fileformat/imagemagick_delegate
- 20160513 May 2016 - HipChat Server - Critical Security Advisory
- 20160513 May 2016 - HipChat Server - Critical Security Advisory
- 89848
- 89848
- 1035742
- 1035742
- SSA:2016-132-01
- SSA:2016-132-01
- USN-2990-1
- USN-2990-1
- https://access.redhat.com/security/vulnerabilities/2296071
- https://access.redhat.com/security/vulnerabilities/2296071
- https://bugzilla.redhat.com/show_bug.cgi?id=1332492
- https://bugzilla.redhat.com/show_bug.cgi?id=1332492
- https://imagetragick.com/
- https://imagetragick.com/
- GLSA-201611-21
- GLSA-201611-21
- 39767
- 39767
- 39791
- 39791
- https://www.imagemagick.org/discourse-server/viewtopic.php?f=4&t=29588
- https://www.imagemagick.org/discourse-server/viewtopic.php?f=4&t=29588
- https://www.imagemagick.org/script/changelog.php
- https://www.imagemagick.org/script/changelog.php
- VU#250519
- VU#250519
Published: 2016-05-05
Modified: 2025-04-02
Modified: 2025-04-02
CVE-2016-3715
The EPHEMERAL coder in ImageMagick before 6.9.3-10 and 7.x before 7.0.1-1 allows remote attackers to delete arbitrary files via a crafted image.
Severity: MEDIUM (5.5)
Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N
References:
- http://git.imagemagick.org/repos/ImageMagick/blob/a01518e08c840577cabd7d3ff291a9ba735f7276/ChangeLog
- http://git.imagemagick.org/repos/ImageMagick/blob/a01518e08c840577cabd7d3ff291a9ba735f7276/ChangeLog
- SUSE-SU-2016:1260
- SUSE-SU-2016:1260
- openSUSE-SU-2016:1261
- openSUSE-SU-2016:1261
- openSUSE-SU-2016:1266
- openSUSE-SU-2016:1266
- SUSE-SU-2016:1275
- SUSE-SU-2016:1275
- openSUSE-SU-2016:1326
- openSUSE-SU-2016:1326
- RHSA-2016:0726
- RHSA-2016:0726
- DSA-3580
- DSA-3580
- DSA-3746
- DSA-3746
- [oss-security] 20160504 Re: ImageMagick Is On Fire -- CVE-2016-3714
- [oss-security] 20160504 Re: ImageMagick Is On Fire -- CVE-2016-3714
- http://www.oracle.com/technetwork/topics/security/bulletinjul2016-3090568.html
- http://www.oracle.com/technetwork/topics/security/bulletinjul2016-3090568.html
- http://www.oracle.com/technetwork/topics/security/linuxbulletinapr2016-2952096.html
- http://www.oracle.com/technetwork/topics/security/linuxbulletinapr2016-2952096.html
- 20160513 May 2016 - HipChat Server - Critical Security Advisory
- 20160513 May 2016 - HipChat Server - Critical Security Advisory
- 89852
- 89852
- SSA:2016-132-01
- SSA:2016-132-01
- USN-2990-1
- USN-2990-1
- GLSA-201611-21
- GLSA-201611-21
- 39767
- 39767
- https://www.imagemagick.org/discourse-server/viewtopic.php?f=4&t=29588
- https://www.imagemagick.org/discourse-server/viewtopic.php?f=4&t=29588
- https://www.imagemagick.org/script/changelog.php
- https://www.imagemagick.org/script/changelog.php
Published: 2016-05-05
Modified: 2024-11-21
Modified: 2024-11-21
CVE-2016-3716
The MSL coder in ImageMagick before 6.9.3-10 and 7.x before 7.0.1-1 allows remote attackers to move arbitrary files via a crafted image.
Severity: LOW (3.3)
Vector: CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
References:
- http://git.imagemagick.org/repos/ImageMagick/blob/a01518e08c840577cabd7d3ff291a9ba735f7276/ChangeLog
- http://git.imagemagick.org/repos/ImageMagick/blob/a01518e08c840577cabd7d3ff291a9ba735f7276/ChangeLog
- SUSE-SU-2016:1260
- SUSE-SU-2016:1260
- openSUSE-SU-2016:1261
- openSUSE-SU-2016:1261
- openSUSE-SU-2016:1266
- openSUSE-SU-2016:1266
- SUSE-SU-2016:1275
- SUSE-SU-2016:1275
- RHSA-2016:0726
- RHSA-2016:0726
- DSA-3580
- DSA-3580
- [oss-security] 20160504 Re: ImageMagick Is On Fire -- CVE-2016-3714
- [oss-security] 20160504 Re: ImageMagick Is On Fire -- CVE-2016-3714
- http://www.oracle.com/technetwork/topics/security/bulletinjul2016-3090568.html
- http://www.oracle.com/technetwork/topics/security/bulletinjul2016-3090568.html
- http://www.oracle.com/technetwork/topics/security/linuxbulletinapr2016-2952096.html
- http://www.oracle.com/technetwork/topics/security/linuxbulletinapr2016-2952096.html
- 20160513 May 2016 - HipChat Server - Critical Security Advisory
- 20160513 May 2016 - HipChat Server - Critical Security Advisory
- SSA:2016-132-01
- SSA:2016-132-01
- USN-2990-1
- USN-2990-1
- [debian-lts-announce] 20180627 [SECURITY] [DLA 1401-1] graphicsmagick security update
- [debian-lts-announce] 20180627 [SECURITY] [DLA 1401-1] graphicsmagick security update
- GLSA-201611-21
- GLSA-201611-21
- 39767
- 39767
- https://www.imagemagick.org/discourse-server/viewtopic.php?f=4&t=29588
- https://www.imagemagick.org/discourse-server/viewtopic.php?f=4&t=29588
- https://www.imagemagick.org/script/changelog.php
- https://www.imagemagick.org/script/changelog.php
Published: 2016-05-05
Modified: 2024-11-21
Modified: 2024-11-21
CVE-2016-3717
The LABEL coder in ImageMagick before 6.9.3-10 and 7.x before 7.0.1-1 allows remote attackers to read arbitrary files via a crafted image.
Severity: MEDIUM (5.5)
Vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
References:
- http://git.imagemagick.org/repos/ImageMagick/blob/a01518e08c840577cabd7d3ff291a9ba735f7276/ChangeLog
- http://git.imagemagick.org/repos/ImageMagick/blob/a01518e08c840577cabd7d3ff291a9ba735f7276/ChangeLog
- SUSE-SU-2016:1260
- SUSE-SU-2016:1260
- openSUSE-SU-2016:1261
- openSUSE-SU-2016:1261
- openSUSE-SU-2016:1266
- openSUSE-SU-2016:1266
- SUSE-SU-2016:1275
- SUSE-SU-2016:1275
- openSUSE-SU-2016:1326
- openSUSE-SU-2016:1326
- RHSA-2016:0726
- RHSA-2016:0726
- DSA-3580
- DSA-3580
- [oss-security] 20160504 Re: ImageMagick Is On Fire -- CVE-2016-3714
- [oss-security] 20160504 Re: ImageMagick Is On Fire -- CVE-2016-3714
- http://www.oracle.com/technetwork/topics/security/bulletinjul2016-3090568.html
- http://www.oracle.com/technetwork/topics/security/bulletinjul2016-3090568.html
- http://www.oracle.com/technetwork/topics/security/linuxbulletinapr2016-2952096.html
- http://www.oracle.com/technetwork/topics/security/linuxbulletinapr2016-2952096.html
- 20160513 May 2016 - HipChat Server - Critical Security Advisory
- 20160513 May 2016 - HipChat Server - Critical Security Advisory
- SSA:2016-132-01
- SSA:2016-132-01
- USN-2990-1
- USN-2990-1
- [debian-lts-announce] 20180627 [SECURITY] [DLA 1401-1] graphicsmagick security update
- [debian-lts-announce] 20180627 [SECURITY] [DLA 1401-1] graphicsmagick security update
- GLSA-201611-21
- GLSA-201611-21
- 39767
- 39767
- https://www.imagemagick.org/discourse-server/viewtopic.php?f=4&t=29588
- https://www.imagemagick.org/discourse-server/viewtopic.php?f=4&t=29588
- https://www.imagemagick.org/script/changelog.php
- https://www.imagemagick.org/script/changelog.php
Published: 2016-05-05
Modified: 2025-04-02
Modified: 2025-04-02
CVE-2016-3718
The (1) HTTP and (2) FTP coders in ImageMagick before 6.9.3-10 and 7.x before 7.0.1-1 allow remote attackers to conduct server-side request forgery (SSRF) attacks via a crafted image.
Severity: MEDIUM (5.5)
Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N
References:
- http://git.imagemagick.org/repos/ImageMagick/blob/a01518e08c840577cabd7d3ff291a9ba735f7276/ChangeLog
- http://git.imagemagick.org/repos/ImageMagick/blob/a01518e08c840577cabd7d3ff291a9ba735f7276/ChangeLog
- SUSE-SU-2016:1260
- SUSE-SU-2016:1260
- openSUSE-SU-2016:1261
- openSUSE-SU-2016:1261
- openSUSE-SU-2016:1266
- openSUSE-SU-2016:1266
- SUSE-SU-2016:1275
- SUSE-SU-2016:1275
- openSUSE-SU-2016:1326
- openSUSE-SU-2016:1326
- RHSA-2016:0726
- RHSA-2016:0726
- DSA-3580
- DSA-3580
- [oss-security] 20160504 Re: ImageMagick Is On Fire -- CVE-2016-3714
- [oss-security] 20160504 Re: ImageMagick Is On Fire -- CVE-2016-3714
- http://www.oracle.com/technetwork/topics/security/bulletinjul2016-3090568.html
- http://www.oracle.com/technetwork/topics/security/bulletinjul2016-3090568.html
- http://www.oracle.com/technetwork/topics/security/linuxbulletinapr2016-2952096.html
- http://www.oracle.com/technetwork/topics/security/linuxbulletinapr2016-2952096.html
- 20160513 May 2016 - HipChat Server - Critical Security Advisory
- 20160513 May 2016 - HipChat Server - Critical Security Advisory
- SSA:2016-132-01
- SSA:2016-132-01
- USN-2990-1
- USN-2990-1
- [debian-lts-announce] 20180627 [SECURITY] [DLA 1401-1] graphicsmagick security update
- [debian-lts-announce] 20180627 [SECURITY] [DLA 1401-1] graphicsmagick security update
- GLSA-201611-21
- GLSA-201611-21
- 39767
- 39767
- https://www.imagemagick.org/discourse-server/viewtopic.php?f=4&t=29588
- https://www.imagemagick.org/discourse-server/viewtopic.php?f=4&t=29588
- https://www.imagemagick.org/script/changelog.php
- https://www.imagemagick.org/script/changelog.php
Published: 2017-03-15
Modified: 2024-11-21
Modified: 2024-11-21
CVE-2016-5239
The gnuplot delegate functionality in ImageMagick before 6.9.4-0 and GraphicsMagick allows remote attackers to execute arbitrary commands via unspecified vectors.
Severity: CRITICAL (9.8)
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
References:
- http://git.imagemagick.org/repos/ImageMagick/commit/70a2cf326ed32bedee144b961005c63846541a16
- http://git.imagemagick.org/repos/ImageMagick/commit/70a2cf326ed32bedee144b961005c63846541a16
- [oss-security] 20160602 Re: ImageMagick CVEs
- [oss-security] 20160602 Re: ImageMagick CVEs
- http://www.oracle.com/technetwork/topics/security/linuxbulletinapr2016-2952096.html
- http://www.oracle.com/technetwork/topics/security/linuxbulletinapr2016-2952096.html
- 91018
- 91018
- RHSA-2016:1237
- RHSA-2016:1237
- [debian-lts-announce] 20180803 [SECURITY] [DLA 1456-1] graphicsmagick security update
- [debian-lts-announce] 20180803 [SECURITY] [DLA 1456-1] graphicsmagick security update