CVE-2016-3714
published 2016-05-05CVE-2016-3714: The (1) EPHEMERAL, (2) HTTPS, (3) MVG, (4) MSL, (5) TEXT, (6) SHOW, (7) WIN, and (8) PLT coders in ImageMagick before 6.9.3-10 and 7.x before 7.0.1-1 allow…
PriorityP191high8.4CVSS 3.1
AVLACLPRNUINSUCHIHAH
KEVITWEXPLOITInitial access
CISA Known Exploited Vulnerabilitydue 2024-09-30
Exploited in the wild
EPSS
97.48%
99.9th percentile
The (1) EPHEMERAL, (2) HTTPS, (3) MVG, (4) MSL, (5) TEXT, (6) SHOW, (7) WIN, and (8) PLT coders in ImageMagick before 6.9.3-10 and 7.x before 7.0.1-1 allow remote attackers to execute arbitrary code via shell metacharacters in a crafted image, aka "ImageTragick."
Affected
24 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| canonical | ubuntu_linux | — | — |
| canonical | ubuntu_linux | — | — |
| canonical | ubuntu_linux | — | — |
| canonical | ubuntu_linux | — | — |
| debian | debian_linux | — | — |
| debian | debian_linux | — | — |
| debian | graphicsmagick | < graphicsmagick 1.3.24-1 (bookworm) | graphicsmagick 1.3.24-1 (bookworm) |
| debian | imagemagick | < graphicsmagick 1.3.24-1 (bookworm) | graphicsmagick 1.3.24-1 (bookworm) |
| graphicsmagick | graphicsmagick | >= 0 < 1.3.24-1 | 1.3.24-1 |
| graphicsmagick | graphicsmagick | >= 0 < 1.3.24-1 | 1.3.24-1 |
| graphicsmagick | graphicsmagick | >= 0 < 1.3.24-1 | 1.3.24-1 |
| graphicsmagick | graphicsmagick | >= 0 < 1.3.24-1 | 1.3.24-1 |
| imagemagick | imagemagick | <= 6.9.3-9 | — |
| imagemagick | imagemagick | — | — |
| imagemagick | imagemagick | — | — |
| imagemagick | imagemagick | >= 0 < 8:6.9.6.2+dfsg-2 | 8:6.9.6.2+dfsg-2 |
| imagemagick | imagemagick | >= 0 < 8:6.9.6.2+dfsg-2 | 8:6.9.6.2+dfsg-2 |
| imagemagick | imagemagick | >= 0 < 8:6.9.6.2+dfsg-2 | 8:6.9.6.2+dfsg-2 |
| imagemagick | imagemagick | >= 0 < 8:6.9.6.2+dfsg-2 | 8:6.9.6.2+dfsg-2 |
| imagemagick | imagemagick | >= 0 < 8:6.7.7.10-6ubuntu3.1 | 8:6.7.7.10-6ubuntu3.1 |
| imagemagick | imagemagick | >= 0 < 8:6.8.9.9-7ubuntu5.1 | 8:6.8.9.9-7ubuntu5.1 |
| opensuse | leap | — | — |
| opensuse | opensuse | — | — |
| suse | suse_linux_enterprise_server | — | — |
Detection & IOCsextracted from sources · hover to see the quote
- →Detect shell metacharacter injection patterns in image files processed by ImageMagick — specifically pipe/quote sequences embedded in URL-like fields within MVG or SVG files (e.g., `"|<command>"`) ↗
- →Flag image uploads with MVG/SVG content containing `push graphic-context` and `fill 'url(...)'` with embedded shell metacharacters — exploitation does not depend on file extension; a renamed .jpg or .png can carry the payload ↗
- →Monitor invocations of ImageMagick's `identify` utility against untrusted files — it is also vulnerable and can be triggered indirectly via lesspipe.sh (e.g., `less exploit.jpg`) ↗
- →Detect use of dangerous ImageMagick pseudo-protocols in processed image content: `ephemeral:`, `msl:`, `label:@`, and `url(http://` / `url(https://` inside MVG/SVG files ↗
- →The Metasploit module targets SVG, MVG, and MIFF file formats with a default payload of `cmd/unix/reverse_netcat`; monitor for reverse shell connections following ImageMagick processing of uploaded images ↗
- ·On RHEL 5 (will-not-fix), the workaround is to rename coder shared objects (mvg.so, msl.so, label.so) to *.bak rather than editing policy.xml, since policy.xml-based mitigation may not be available on that platform ↗
- ·The workaround policy.xml has been updated over time; earlier versions were incomplete — re-check and re-apply even if a prior workaround was already deployed ↗
CVSS provenance
nvdv3.18.4HIGHCVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
nvdv2.010.0CRITICALAV:N/AC:L/Au:N/C:C/I:C/A:C
osv8.4HIGH
vulncheck8.4HIGH
cisa8.4HIGH
vendor_debian8.4HIGH
vendor_redhat8.4HIGH
vendor_ubuntu8.4HIGH
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
CISA
ImageMagick Improper Input Validation Vulnerability
cisa·2024-09-09·CVSS 8.4
CVE-2016-3714 [HIGH] CWE-20 ImageMagick Improper Input Validation Vulnerability
Vulnerability: ImageMagick Improper Input Validation Vulnerability
Affected: ImageMagick ImageMagick
ImageMagick contains an improper input validation vulnerability that affects the EPHEMERAL, HTTPS, MVG, MSL, TEXT, SHOW, WIN, and PLT coders. This allows a remote attacker to execute arbitrary code via shell metacharacters in a crafted image.
Required Action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Notes: This vulnerability affects a common open-source component, third-party library, or a protocol used by different products. For more information, please see: https://www.imagemagick.org/discourse-server/viewtopic.php?f=4&t=29588#p132726, https://imagemagick.org/archive/releases/; https://nvd.nist.gov/vuln/detail/CVE-2016-
Ubuntu
ImageMagick vulnerabilities
vendor_ubuntu·2016-06-02·CVSS 8.4
CVE-2016-3714 [HIGH] ImageMagick vulnerabilities
Title: ImageMagick vulnerabilities
Summary: Several security issues were fixed in ImageMagick.
Nikolay Ermishkin and Stewie discovered that ImageMagick incorrectly
sanitized untrusted input. A remote attacker could use these issues to
execute arbitrary code. These issues are known as "ImageTragick". This
update disables problematic coders via the /etc/ImageMagick-6/policy.xml
configuration file. In certain environments the coders may need to be
manually re-enabled after making sure that ImageMagick does not process
untrusted input. (CVE-2016-3714, CVE-2016-3715, CVE-2016-3716,
CVE-2016-3717, CVE-2016-3718)
Bob Friesenhahn discovered that ImageMagick allowed injecting commands via
an image file or filename. A remote attacker could use this issue to
execute arbitrary code. (CVE-2016-5118)
Red Hat
ImageMagick: Insufficient shell characters filtering
vendor_redhat·2016-05-03·CVSS 8.4
CVE-2016-3714 [HIGH] CWE-20 ImageMagick: Insufficient shell characters filtering
ImageMagick: Insufficient shell characters filtering
The (1) EPHEMERAL, (2) HTTPS, (3) MVG, (4) MSL, (5) TEXT, (6) SHOW, (7) WIN, and (8) PLT coders in ImageMagick before 6.9.3-10 and 7.x before 7.0.1-1 allow remote attackers to execute arbitrary code via shell metacharacters in a crafted image, aka "ImageTragick."
It was discovered that ImageMagick did not properly sanitize certain input before passing it to the delegate functionality. A remote attacker could create a specially crafted image that, when processed by an application using ImageMagick or an unsuspecting user using the ImageMagick utilities, would lead to arbitrary execution of shell commands with the privileges of the user running the application.
Mitigation: Details can be found under the resolve tab at https://access.red
Debian
CVE-2016-3714: graphicsmagick - The (1) EPHEMERAL, (2) HTTPS, (3) MVG, (4) MSL, (5) TEXT, (6) SHOW, (7) WIN, and...
vendor_debian·2016·CVSS 8.4
CVE-2016-3714 [HIGH] CVE-2016-3714: graphicsmagick - The (1) EPHEMERAL, (2) HTTPS, (3) MVG, (4) MSL, (5) TEXT, (6) SHOW, (7) WIN, and...
The (1) EPHEMERAL, (2) HTTPS, (3) MVG, (4) MSL, (5) TEXT, (6) SHOW, (7) WIN, and (8) PLT coders in ImageMagick before 6.9.3-10 and 7.x before 7.0.1-1 allow remote attackers to execute arbitrary code via shell metacharacters in a crafted image, aka "ImageTragick."
Scope: local
bookworm: resolved (fixed in 1.3.24-1)
bullseye: resolved (fixed in 1.3.24-1)
forky: resolved (fixed in 1.3.24-1)
sid: resolved (fixed in 1.3.24-1)
trixie: resolved (fixed in 1.3.24-1)
VulDB
ImageMagick Image File input validation (USN-2990-1 / VU#250519)
vuldb·2026-04-23·CVSS 8.4
CVE-2016-3714 [HIGH] ImageMagick Image File input validation (USN-2990-1 / VU#250519)
A vulnerability, which was classified as critical, has been found in ImageMagick. Affected by this vulnerability is an unknown functionality of the component Image File Handler. Performing a manipulation results in improper input validation.
This vulnerability is cataloged as CVE-2016-3714. It is possible to initiate the attack remotely. Furthermore, there is an exploit available.
It is advisable to upgrade the affected component.
GHSA
GHSA-24cp-26gx-3pp4: The (1) EPHEMERAL, (2) HTTPS, (3) MVG, (4) MSL, (5) TEXT, (6) SHOW, (7) WIN, and (8) PLT coders in ImageMagick before 6
ghsa_unreviewed·2022-05-14
CVE-2016-3714 [HIGH] CWE-20 GHSA-24cp-26gx-3pp4: The (1) EPHEMERAL, (2) HTTPS, (3) MVG, (4) MSL, (5) TEXT, (6) SHOW, (7) WIN, and (8) PLT coders in ImageMagick before 6
The (1) EPHEMERAL, (2) HTTPS, (3) MVG, (4) MSL, (5) TEXT, (6) SHOW, (7) WIN, and (8) PLT coders in ImageMagick before 6.9.3-10 and 7.x before 7.0.1-1 allow remote attackers to execute arbitrary code via shell metacharacters in a crafted image, aka "ImageTragick."
OSV
imagemagick vulnerabilities
osv·2016-06-02·CVSS 8.4
CVE-2016-3714 [HIGH] imagemagick vulnerabilities
imagemagick vulnerabilities
Nikolay Ermishkin and Stewie discovered that ImageMagick incorrectly
sanitized untrusted input. A remote attacker could use these issues to
execute arbitrary code. These issues are known as "ImageTragick". This
update disables problematic coders via the /etc/ImageMagick-6/policy.xml
configuration file. In certain environments the coders may need to be
manually re-enabled after making sure that ImageMagick does not process
untrusted input. (CVE-2016-3714, CVE-2016-3715, CVE-2016-3716,
CVE-2016-3717, CVE-2016-3718)
Bob Friesenhahn discovered that ImageMagick allowed injecting commands via
an image file or filename. A remote attacker could use this issue to
execute arbitrary code. (CVE-2016-5118)
OSV
CVE-2016-3714: The (1) EPHEMERAL, (2) HTTPS, (3) MVG, (4) MSL, (5) TEXT, (6) SHOW, (7) WIN, and (8) PLT coders in ImageMagick before 6
osv·2016-05-05·CVSS 8.4
CVE-2016-3714 [HIGH] CVE-2016-3714: The (1) EPHEMERAL, (2) HTTPS, (3) MVG, (4) MSL, (5) TEXT, (6) SHOW, (7) WIN, and (8) PLT coders in ImageMagick before 6
The (1) EPHEMERAL, (2) HTTPS, (3) MVG, (4) MSL, (5) TEXT, (6) SHOW, (7) WIN, and (8) PLT coders in ImageMagick before 6.9.3-10 and 7.x before 7.0.1-1 allow remote attackers to execute arbitrary code via shell metacharacters in a crafted image, aka "ImageTragick."
VulnCheck
ImageMagick Improper Input Validation Vulnerability
vulncheck·2016·CVSS 8.4
CVE-2016-3714 [HIGH] CWE-20 ImageMagick Improper Input Validation Vulnerability
ImageMagick Improper Input Validation Vulnerability
ImageMagick contains an improper input validation vulnerability that affects the EPHEMERAL, HTTPS, MVG, MSL, TEXT, SHOW, WIN, and PLT coders. This allows a remote attacker to execute arbitrary code via shell metacharacters in a crafted image.
Affected: ImageMagick ImageMagick
Required Action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Exploitation References: https://www.kb.cert.org/vuls/id/250519; https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
Exploit PoC: https://vulncheck.com/xdb/06fba2780616; https://vulncheck.com/xdb/a180c1b0bb7e; https://vulncheck.com/xdb/bef3b078d296
Remediation Due: 2024-09-30
Suricata
ET WEB_SERVER ImageMagick CVE-2016-3714 Inbound (mvg)
suricata·2016-05-04·CVSS 8.4
CVE-2016-3714 [HIGH] ET WEB_SERVER ImageMagick CVE-2016-3714 Inbound (mvg)
ET WEB_SERVER ImageMagick CVE-2016-3714 Inbound (mvg)
Rule: alert http $EXTERNAL_NET any -> $HTTP_SERVERS any (msg:"ET WEB_SERVER ImageMagick CVE-2016-3714 Inbound (mvg)"; flow:established,to_server; http.request_body; content:"viewbox|20|"; nocase; fast_pattern; pcre:"/https\x3a.+(?<].*?(:[\x22\x27]|\\x2[27])/si"; classtype:web-application-attack; sid:2022789; rev:6; metadata:created_at 2016_05_04, cve CVE_2016_3714, signature_severity Major, tag CISA_KEV, updated_at 2020_10_06;)
Suricata
ET WEB_SERVER ImageMagick CVE-2016-3714 Inbound (svg)
suricata·2016-05-04·CVSS 8.4
CVE-2016-3714 [HIGH] ET WEB_SERVER ImageMagick CVE-2016-3714 Inbound (svg)
ET WEB_SERVER ImageMagick CVE-2016-3714 Inbound (svg)
Rule: alert http $EXTERNAL_NET any -> $HTTP_SERVERS any (msg:"ET WEB_SERVER ImageMagick CVE-2016-3714 Inbound (svg)"; flow:established,to_server; http.request_body; content:"<svg|20|"; nocase; fast_pattern; content:"xlink"; nocase; pcre:"/xlink\s*?\x3a\s*?href\s*?=\s*?(:[\x22\x27]|\\x2[27])https.+?"\s*?\x3b(?:\x7c|&(?:[gl]t|amp)\s*?\x3b)/si"; classtype:web-application-attack; sid:2022790; rev:6; metadata:created_at 2016_05_04, cve CVE_2016_3714, signature_severity Major, tag CISA_KEV, updated_at 2020_10_06;)
Exploit-DB
ImageMagick 6.9.3-9 / 7.0.1-0 - 'ImageTragick' Delegate Arbitrary Command Execution (Metasploit)
exploitdb·2016-05-09
CVE-2016-3714 ImageMagick 6.9.3-9 / 7.0.1-0 - 'ImageTragick' Delegate Arbitrary Command Execution (Metasploit)
ImageMagick 6.9.3-9 / 7.0.1-0 - 'ImageTragick' Delegate Arbitrary Command Execution (Metasploit)
---
##
# This module requires Metasploit: http://metasploit.com/download
# Current source: https://github.com/rapid7/metasploit-framework
##
class MetasploitModule 'ImageMagick Delegate Arbitrary Command Execution',
'Description' => %q{
This module exploits a shell command injection in the way "delegates"
(commands for converting files) are processed in ImageMagick versions
[
'stewie', # Vulnerability discovery
'Nikolay Ermishkin', # Vulnerability discovery
'wvu', # Metasploit module
'hdm' # Metasploit module
],
'References' => [
%w{CVE 2016-3714},
%w{URL https://imagetragick.com/},
%w{URL http://seclists.org/oss-sec/2016/q2/205},
%w{URL https://github.com/ImageMagick/ImageMagick/commit/06c4
Exploit-DB
ImageMagick 7.0.1-0 / 6.9.3-9 - 'ImageTragick ' Multiple Vulnerabilities
exploitdb·2016-05-04·CVSS 8.4
CVE-2016-3718 [HIGH] ImageMagick 7.0.1-0 / 6.9.3-9 - 'ImageTragick ' Multiple Vulnerabilities
ImageMagick 7.0.1-0 / 6.9.3-9 - 'ImageTragick ' Multiple Vulnerabilities
---
Nikolay Ermishkin from the Mail.Ru Security Team discovered several
vulnerabilities in ImageMagick.
We've reported these issues to developers of ImageMagick and they made a
fix for RCE in sources and released new version (6.9.3-9 released
2016-04-30 http://legacy.imagemagick.org/script/changelog.php), but this
fix seems to be incomplete. We are still working with developers.
ImageMagick: Multiple vulnerabilities in image decoder
1. CVE-2016-3714 - Insufficient shell characters filtering leads to
(potentially remote) code execution
Insufficient filtering for filename passed to delegate's command allows
remote code execution during conversion of several file formats.
ImageMagick allows to process files with ex
Bugzilla
CVE-2016-6320 satellite6: stored XSS while provisioning new host
bugzilla·2016-08-10·CVSS 5.4
CVE-2016-6320 [MEDIUM] CVE-2016-6320 satellite6: stored XSS while provisioning new host
CVE-2016-6320 satellite6: stored XSS while provisioning new host
A stored cross-site scripting (XSS) flaw was found in the way input was escaped in the "Device Identifier" field when creating a new host in the Satellite web UI.
Discussion:
Acknowledgments:
Name: Sanket Jagtap (Red Hat)
---
Upstream issue:
http://projects.theforeman.org/issues/16022
Upstream patch:
https://github.com/theforeman/foreman/pull/3714
---
This issue was addressed in:
Satellite 6.2
In RHBA-2016:1885
---
*** Bug 1421803 has been marked as a duplicate of this bug. ***
Bugzilla
CVE-2016-5118 ImageMagick: Remote code execution via filename
bugzilla·2016-05-30·CVSS 8.4
CVE-2016-5118 [HIGH] CVE-2016-5118 ImageMagick: Remote code execution via filename
CVE-2016-5118 ImageMagick: Remote code execution via filename
All existing releases of GraphicsMagick and ImageMagick support a file open syntax where if the first character of the file specification is a '|', then the remainder of the filename is passed to the shell for execution using the POSIX popen(3C) function. File opening is handled by an OpenBlob() function in the source file blob.c. Unlike the vulnerability described by CVE-2016-3714, this functionality is supported by the core file opening function rather than a delegates subsystem usually used to execute external programs.
References:
http://seclists.org/oss-sec/2016/q2/432
Discussion:
Created GraphicsMagick tracking bugs for this issue:
Affects: fedora-all [bug 1340816]
Affects: epel-all [bug 1340817]
---
Created ImageM
Bugzilla
CVE-2016-3714 ImageMagick: Insufficient shell characters filtering
bugzilla·2016-05-03·CVSS 8.4
CVE-2016-3714 [HIGH] CVE-2016-3714 ImageMagick: Insufficient shell characters filtering
CVE-2016-3714 ImageMagick: Insufficient shell characters filtering
A vulnerability was found in ImageMagick. Insufficient filtering for filename passed to delegate's command allows remote code execution during conversion of several file formats.
ImageMagick allows to process files with external libraries. This feature is called 'delegate'. It is implemented as a system() with command string ('command') from the config file delegates.xml with actual value for different params (input/output filenames etc). Due to insufficient %M param filtering it is possible to conduct shell command injection. One of the default delegate's command is used to handle https requests:
"wget" -q -O "%o" "https:%M"
where %M is the actual link from the input. It is possible to pass the value like `https://exam
Bugzilla
CVE-2016-3714 ImageMagick: Insufficient shell characters filtering [fedora-all]
bugzilla·2016-05-03·CVSS 8.4
CVE-2016-3714 [HIGH] CVE-2016-3714 ImageMagick: Insufficient shell characters filtering [fedora-all]
CVE-2016-3714 ImageMagick: Insufficient shell characters filtering [fedora-all]
This is an automatically created tracking bug! It was created to ensure
that one or more security vulnerabilities are fixed in affected versions
of Fedora.
For comments that are specific to the vulnerability please use bugs filed
against the "Security Response" product referenced in the "Blocks" field.
For more information see:
http://fedoraproject.org/wiki/Security/TrackingBugs
When submitting as an update, use the fedpkg template provided in the next
comment(s). This will include the bug IDs of this tracking bug as well as
the relevant top-level CVE bugs.
Please also mention the CVE IDs being fixed in the RPM changelog and the
fedpkg commit message.
NOTE: this issue affects multiple supported versions o
HackerOne
Insufficient shell characters filtering leads to (potentially remote) code execution (CVE-2016-3714)
hackerone·2016-05-03·CVSS 8.4
CVE-2016-3714 [HIGH] Insufficient shell characters filtering leads to (potentially remote) code execution (CVE-2016-3714)
Insufficient shell characters filtering leads to (potentially remote) code execution (CVE-2016-3714)
The (1) EPHEMERAL, (2) HTTPS, (3) MVG, (4) MSL, (5) TEXT, (6) SHOW, (7) WIN, and (8) PLT coders in ImageMagick before 6.9.3-10 and 7.x before 7.0.1-1 allow remote attackers to execute arbitrary code via shell metacharacters in a crafted image, aka "ImageTragick."
See also:
http://www.openwall.com/lists/oss-security/2016/05/03/18
https://imagetragick.com/
Qualys
Update: Patch Tuesday May 2016 | Qualys
blogs_qualys·2016-05-12·CVSS 7.5
CVE-2016-4117 [HIGH] Update: Patch Tuesday May 2016 | Qualys
Update: Adobe released the patch for Adobe Flash that addresses the current 0-day CVE-2016-4117 in APSB16-15. It also patches another 24 vulnerabilities that are mostly rated critical. Patch as quickly as possible. Chrome and Internet Explorer 11/Edge users will get their patches from Google and Microsoft automatically.
Original: Today is the second Tuesday of the month, when both Microsoft and Adobe publish the security updates to their products – the so-called Patch Tuesday.
But before we get into the details of their updates for the month (17 in all) let’s reiterate the urgency of another vulnerability that might have slipped by you. The popular open source program ImageMagick is currently under active attack on the Internet. Vulnerability CVE-2016-3714 (called ImageTragick in the ass
Qualys
Update: Patch Tuesday May 2016 | Qualys
blogs_qualys·2016-05-12·CVSS 7.5
CVE-2016-4117 [HIGH] Update: Patch Tuesday May 2016 | Qualys
Update : Adobe released the patch for Adobe Flash that addresses the current 0-day CVE-2016-4117 in APSB16-15 . It also patches another 24 vulnerabilities that are mostly rated critical. Patch as quickly as possible. Chrome and Internet Explorer 11/Edge users will get their patches from Google and Microsoft automatically.
Original : Today is the second Tuesday of the month, when both Microsoft and Adobe publish the security updates to their products – the so-called Patch Tuesday.
But before we get into the details of their updates for the month (17 in all) let’s reiterate the urgency of another vulnerability that might have slipped by you. The popular open source program ImageMagick is currently under active attack on the Internet. Vulnerability CVE-2016-3714 (called ImageTragick in the
http://git.imagemagick.org/repos/ImageMagick/blob/a01518e08c840577cabd7d3ff291a9ba735f7276/ChangeLoghttp://lists.opensuse.org/opensuse-security-announce/2016-05/msg00024.htmlhttp://lists.opensuse.org/opensuse-security-announce/2016-05/msg00025.htmlhttp://lists.opensuse.org/opensuse-security-announce/2016-05/msg00028.htmlhttp://lists.opensuse.org/opensuse-security-announce/2016-05/msg00032.htmlhttp://lists.opensuse.org/opensuse-security-announce/2016-05/msg00041.htmlhttp://lists.opensuse.org/opensuse-security-announce/2016-05/msg00051.htmlhttp://packetstormsecurity.com/files/152364/ImageTragick-ImageMagick-Proof-Of-Concepts.htmlhttp://rhn.redhat.com/errata/RHSA-2016-0726.htmlhttp://www.debian.org/security/2016/dsa-3580http://www.debian.org/security/2016/dsa-3746http://www.openwall.com/lists/oss-security/2016/05/03/13http://www.openwall.com/lists/oss-security/2016/05/03/18http://www.oracle.com/technetwork/topics/security/bulletinjul2016-3090568.htmlhttp://www.oracle.com/technetwork/topics/security/linuxbulletinapr2016-2952096.htmlhttp://www.rapid7.com/db/modules/exploit/unix/fileformat/imagemagick_delegatehttp://www.securityfocus.com/archive/1/538378/100/0/threadedhttp://www.securityfocus.com/bid/89848http://www.securitytracker.com/id/1035742http://www.slackware.com/security/viewer.php?l=slackware-security&y=2016&m=slackware-security.440568http://www.ubuntu.com/usn/USN-2990-1https://access.redhat.com/security/vulnerabilities/2296071https://bugzilla.redhat.com/show_bug.cgi?id=1332492https://imagetragick.com/https://security.gentoo.org/glsa/201611-21https://www.exploit-db.com/exploits/39767/https://www.exploit-db.com/exploits/39791/https://www.imagemagick.org/discourse-server/viewtopic.php?f=4&t=29588https://www.imagemagick.org/script/changelog.phphttps://www.kb.cert.org/vuls/id/250519http://git.imagemagick.org/repos/ImageMagick/blob/a01518e08c840577cabd7d3ff291a9ba735f7276/ChangeLoghttp://lists.opensuse.org/opensuse-security-announce/2016-05/msg00024.htmlhttp://lists.opensuse.org/opensuse-security-announce/2016-05/msg00025.htmlhttp://lists.opensuse.org/opensuse-security-announce/2016-05/msg00028.htmlhttp://lists.opensuse.org/opensuse-security-announce/2016-05/msg00032.htmlhttp://lists.opensuse.org/opensuse-security-announce/2016-05/msg00041.htmlhttp://lists.opensuse.org/opensuse-security-announce/2016-05/msg00051.htmlhttp://packetstormsecurity.com/files/152364/ImageTragick-ImageMagick-Proof-Of-Concepts.htmlhttp://rhn.redhat.com/errata/RHSA-2016-0726.htmlhttp://www.debian.org/security/2016/dsa-3580http://www.debian.org/security/2016/dsa-3746http://www.openwall.com/lists/oss-security/2016/05/03/13http://www.openwall.com/lists/oss-security/2016/05/03/18http://www.oracle.com/technetwork/topics/security/bulletinjul2016-3090568.htmlhttp://www.oracle.com/technetwork/topics/security/linuxbulletinapr2016-2952096.htmlhttp://www.rapid7.com/db/modules/exploit/unix/fileformat/imagemagick_delegatehttp://www.securityfocus.com/archive/1/538378/100/0/threadedhttp://www.securityfocus.com/bid/89848http://www.securitytracker.com/id/1035742http://www.slackware.com/security/viewer.php?l=slackware-security&y=2016&m=slackware-security.440568http://www.ubuntu.com/usn/USN-2990-1https://access.redhat.com/security/vulnerabilities/2296071https://bugzilla.redhat.com/show_bug.cgi?id=1332492https://imagetragick.com/https://security.gentoo.org/glsa/201611-21https://www.exploit-db.com/exploits/39767/https://www.exploit-db.com/exploits/39791/https://www.imagemagick.org/discourse-server/viewtopic.php?f=4&t=29588https://www.imagemagick.org/script/changelog.phphttps://www.kb.cert.org/vuls/id/250519https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2016-3714
2016-05-05
Published
2024-09-09
Added to CISA KEV
Exploited in the wild