CVE-2016-3715
published 2016-05-05CVE-2016-3715: The EPHEMERAL coder in ImageMagick before 6.9.3-10 and 7.x before 7.0.1-1 allows remote attackers to delete arbitrary files via a crafted image.
PriorityP187medium5.5CVSS 3.1
AVLACLPRNUIRSUCNIHAN
KEVITWEXPLOIT
CISA Known Exploited Vulnerabilitydue 2022-05-03
Exploited in the wild
EPSS
75.38%
99.5th percentile
The EPHEMERAL coder in ImageMagick before 6.9.3-10 and 7.x before 7.0.1-1 allows remote attackers to delete arbitrary files via a crafted image.
Affected
88 ranges· showing 25
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| canonical | ubuntu_linux | — | — |
| canonical | ubuntu_linux | — | — |
| canonical | ubuntu_linux | — | — |
| canonical | ubuntu_linux | — | — |
| debian | graphicsmagick | < graphicsmagick 1.3.24-1 (bookworm) | graphicsmagick 1.3.24-1 (bookworm) |
| debian | imagemagick | < graphicsmagick 1.3.24-1 (bookworm) | graphicsmagick 1.3.24-1 (bookworm) |
| graphicsmagick | graphicsmagick | >= 0 < 1.3.24-1 | 1.3.24-1 |
| graphicsmagick | graphicsmagick | >= 0 < 1.3.24-1 | 1.3.24-1 |
| graphicsmagick | graphicsmagick | >= 0 < 1.3.24-1 | 1.3.24-1 |
| graphicsmagick | graphicsmagick | >= 0 < 1.3.24-1 | 1.3.24-1 |
| imagemagick | imagemagick | < 6.9.3-10 | 6.9.3-10 |
| imagemagick | imagemagick | — | — |
| imagemagick | imagemagick | — | — |
| imagemagick | imagemagick | >= 0 < 8:6.9.6.2+dfsg-2 | 8:6.9.6.2+dfsg-2 |
| imagemagick | imagemagick | >= 0 < 8:6.9.6.2+dfsg-2 | 8:6.9.6.2+dfsg-2 |
| imagemagick | imagemagick | >= 0 < 8:6.9.6.2+dfsg-2 | 8:6.9.6.2+dfsg-2 |
| imagemagick | imagemagick | >= 0 < 8:6.9.6.2+dfsg-2 | 8:6.9.6.2+dfsg-2 |
| imagemagick | imagemagick | >= 0 < 8:6.7.7.10-6ubuntu3.1 | 8:6.7.7.10-6ubuntu3.1 |
| imagemagick | imagemagick | >= 0 < 8:6.8.9.9-7ubuntu5.1 | 8:6.8.9.9-7ubuntu5.1 |
| opensuse | leap | — | — |
| opensuse | opensuse | — | — |
| oracle | linux | — | — |
| oracle | linux | — | — |
| oracle | solaris | — | — |
| oracle | solaris | — | — |
Detection & IOCsextracted from sources · hover to see the quote
snort
alert http $EXTERNAL_NET any -> $HTTP_SERVERS any (msg:"ET WEB_SERVER ImageMagick CVE-2016-3715 File Deletion Inbound (ephermeral:+ mvg)"; flow:established,to_server; http.request_body; content:"viewbox|20|"; nocase; fast_pattern; content:"ephemeral"; nocase; pcre:"/^\s*\x3a\s*[./]/Ri"; classtype:web-application-attack; sid:2022792; rev:5; metadata:created_at 2016_05_04, cve CVE_2016_3715, signature_severity Major, tag CISA_KEV, updated_at 2020_10_06;)
- →Malicious MVG/SVG image files exploiting CVE-2016-3715 use the 'ephemeral:' pseudo-protocol in an 'image over' directive combined with a 'viewbox' directive. Detect HTTP request bodies containing both 'viewbox' and 'ephemeral' followed by a colon and a path character (e.g., '/' or '.'). ↗
- →ImageMagick guesses file type by content, not extension. A crafted exploit file may be renamed to .jpg or .png to bypass file-type checks — inspect file content for MVG/SVG markers regardless of extension. ↗
- →The 'identify' tool is also vulnerable and can be invoked via lesspipe.sh (e.g., 'less exploit.jpg'), creating additional attack vectors beyond direct 'convert' usage. ↗
- ·On RHEL 5 (where policy.xml is not available), the workaround is to rename the vulnerable coder shared libraries (mvg.so, msl.so, label.so) to disable them. ↗
- ·The fix released in ImageMagick 6.9.3-9 (2016-04-30) was incomplete; the fully patched versions are 6.9.3-10 and 7.0.1-1. ↗
CVSS provenance
nvdv3.15.5MEDIUMCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N
nvdv2.05.8MEDIUMAV:N/AC:M/Au:N/C:N/I:P/A:P
osv8.4HIGH
vulncheck5.5MEDIUM
cisa5.5MEDIUM
vendor_ubuntu8.4HIGH
vendor_debian5.5MEDIUM
vendor_redhat5.5MEDIUM
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
CISA
ImageMagick Arbitrary File Deletion Vulnerability
cisa·2021-11-03·CVSS 5.5
CVE-2016-3715 [MEDIUM] CWE-284 ImageMagick Arbitrary File Deletion Vulnerability
Vulnerability: ImageMagick Arbitrary File Deletion Vulnerability
Affected: ImageMagick ImageMagick
ImageMagick contains an unspecified vulnerability that could allow users to delete files by using ImageMagick's 'ephemeral' pseudo protocol, which deletes files after reading.
Required Action: Apply updates per vendor instructions.
Notes: https://nvd.nist.gov/vuln/detail/CVE-2016-3715
Remediation Due Date: 2022-05-03
Ubuntu
ImageMagick vulnerabilities
vendor_ubuntu·2016-06-02·CVSS 8.4
CVE-2016-3714 [HIGH] ImageMagick vulnerabilities
Title: ImageMagick vulnerabilities
Summary: Several security issues were fixed in ImageMagick.
Nikolay Ermishkin and Stewie discovered that ImageMagick incorrectly
sanitized untrusted input. A remote attacker could use these issues to
execute arbitrary code. These issues are known as "ImageTragick". This
update disables problematic coders via the /etc/ImageMagick-6/policy.xml
configuration file. In certain environments the coders may need to be
manually re-enabled after making sure that ImageMagick does not process
untrusted input. (CVE-2016-3714, CVE-2016-3715, CVE-2016-3716,
CVE-2016-3717, CVE-2016-3718)
Bob Friesenhahn discovered that ImageMagick allowed injecting commands via
an image file or filename. A remote attacker could use this issue to
execute arbitrary code. (CVE-2016-5118)
Red Hat
ImageMagick: File deletion
vendor_redhat·2016-05-03·CVSS 5.5
CVE-2016-3715 [MEDIUM] CWE-20 ImageMagick: File deletion
ImageMagick: File deletion
The EPHEMERAL coder in ImageMagick before 6.9.3-10 and 7.x before 7.0.1-1 allows remote attackers to delete arbitrary files via a crafted image.
It was discovered that certain ImageMagick coders and pseudo-protocols did not properly prevent security sensitive operations when processing specially crafted images. A remote attacker could create a specially crafted image that, when processed by an application using ImageMagick or an unsuspecting user using the ImageMagick utilities, would allow the attacker to delete arbitrary files.
Mitigation: Details can be found under the resolve tab at https://access.redhat.com/security/vulnerabilities/2296071
Red Hat Enterprise Linux 6 and 7
As a workaround the /etc/ImageMagick/policy.xml file can be edited to disable proces
Debian
CVE-2016-3715: graphicsmagick - The EPHEMERAL coder in ImageMagick before 6.9.3-10 and 7.x before 7.0.1-1 allows...
vendor_debian·2016·CVSS 5.5
CVE-2016-3715 [MEDIUM] CVE-2016-3715: graphicsmagick - The EPHEMERAL coder in ImageMagick before 6.9.3-10 and 7.x before 7.0.1-1 allows...
The EPHEMERAL coder in ImageMagick before 6.9.3-10 and 7.x before 7.0.1-1 allows remote attackers to delete arbitrary files via a crafted image.
Scope: local
bookworm: resolved (fixed in 1.3.24-1)
bullseye: resolved (fixed in 1.3.24-1)
forky: resolved (fixed in 1.3.24-1)
sid: resolved (fixed in 1.3.24-1)
trixie: resolved (fixed in 1.3.24-1)
VulDB
ImageMagick up to 6.9.3-9/7.0.1 EPHEMERAL Coder File access control (USN-2990-1 / EDB-39767)
vuldb·2026-04-23·CVSS 5.5
CVE-2016-3715 [MEDIUM] ImageMagick up to 6.9.3-9/7.0.1 EPHEMERAL Coder File access control (USN-2990-1 / EDB-39767)
A vulnerability has been found in ImageMagick up to 6.9.3-9/7.0.1 and classified as problematic. Impacted is an unknown function of the component EPHEMERAL Coder. This manipulation causes improper access controls (File).
This vulnerability is tracked as CVE-2016-3715. The attack is restricted to local execution. Moreover, an exploit is present.
The affected component should be upgraded.
GHSA
GHSA-vmpp-w9w7-m326: The EPHEMERAL coder in ImageMagick before 6
ghsa_unreviewed·2022-05-14
CVE-2016-3715 [MEDIUM] CWE-284 GHSA-vmpp-w9w7-m326: The EPHEMERAL coder in ImageMagick before 6
The EPHEMERAL coder in ImageMagick before 6.9.3-10 and 7.x before 7.0.1-1 allows remote attackers to delete arbitrary files via a crafted image.
OSV
imagemagick vulnerabilities
osv·2016-06-02·CVSS 8.4
CVE-2016-3714 [HIGH] imagemagick vulnerabilities
imagemagick vulnerabilities
Nikolay Ermishkin and Stewie discovered that ImageMagick incorrectly
sanitized untrusted input. A remote attacker could use these issues to
execute arbitrary code. These issues are known as "ImageTragick". This
update disables problematic coders via the /etc/ImageMagick-6/policy.xml
configuration file. In certain environments the coders may need to be
manually re-enabled after making sure that ImageMagick does not process
untrusted input. (CVE-2016-3714, CVE-2016-3715, CVE-2016-3716,
CVE-2016-3717, CVE-2016-3718)
Bob Friesenhahn discovered that ImageMagick allowed injecting commands via
an image file or filename. A remote attacker could use this issue to
execute arbitrary code. (CVE-2016-5118)
OSV
CVE-2016-3715: The EPHEMERAL coder in ImageMagick before 6
osv·2016-05-05·CVSS 5.5
CVE-2016-3715 [MEDIUM] CVE-2016-3715: The EPHEMERAL coder in ImageMagick before 6
The EPHEMERAL coder in ImageMagick before 6.9.3-10 and 7.x before 7.0.1-1 allows remote attackers to delete arbitrary files via a crafted image.
VulnCheck
ImageMagick Arbitrary File Deletion Vulnerability
vulncheck·2016·CVSS 5.5
CVE-2016-3715 [MEDIUM] CWE-284 ImageMagick Arbitrary File Deletion Vulnerability
ImageMagick Arbitrary File Deletion Vulnerability
ImageMagick contains an unspecified vulnerability that could allow users to delete files by using ImageMagick's 'ephemeral' pseudo protocol, which deletes files after reading.
Affected: ImageMagick ImageMagick
Required Action: Apply updates per vendor instructions.
Exploitation References: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
Remediation Due: 2022-05-03
Suricata
ET WEB_SERVER ImageMagick CVE-2016-3715 File Deletion Inbound (ephermeral:+ mvg)
suricata·2016-05-04·CVSS 5.5
CVE-2016-3715 [MEDIUM] ET WEB_SERVER ImageMagick CVE-2016-3715 File Deletion Inbound (ephermeral:+ mvg)
ET WEB_SERVER ImageMagick CVE-2016-3715 File Deletion Inbound (ephermeral:+ mvg)
Rule: alert http $EXTERNAL_NET any -> $HTTP_SERVERS any (msg:"ET WEB_SERVER ImageMagick CVE-2016-3715 File Deletion Inbound (ephermeral:+ mvg)"; flow:established,to_server; http.request_body; content:"viewbox|20|"; nocase; fast_pattern; content:"ephemeral"; nocase; pcre:"/^\s*\x3a\s*[./]/Ri"; classtype:web-application-attack; sid:2022792; rev:5; metadata:created_at 2016_05_04, cve CVE_2016_3715, signature_severity Major, tag CISA_KEV, updated_at 2020_10_06;)
Bugzilla
CVE-2016-6319 foreman: Persistent XSS in Foreman remote execution plugin
bugzilla·2016-08-10·CVSS 6.1
CVE-2016-6319 [MEDIUM] CVE-2016-6319 foreman: Persistent XSS in Foreman remote execution plugin
CVE-2016-6319 foreman: Persistent XSS in Foreman remote execution plugin
Marek Hulán of Red Hat reports:
User can define a job template and specify input name containing JS code. When
someone tries to invoke such job, the form is generated based on this name
without proper escaping so the JS gets executed.
Upstream issue:
http://projects.theforeman.org/issues/16019
Proposed upstream patch:
https://github.com/theforeman/foreman/pull/3715/commits/4b63d2c7cdad76ed2bf96d9f8dff7e0c5cdabda6
Discussion:
Acknowledgments:
Name: Marek Hulán (Red Hat)
---
This issue has been addressed in the following products:
Red Hat Satellite 6.3 for RHEL 7
Via RHSA-2018:0336 https://access.redhat.com/errata/RHSA-2018:0336
Bugzilla
CVE-2016-3715 ImageMagick: File deletion
bugzilla·2016-05-03·CVSS 5.5
CVE-2016-3715 [MEDIUM] CVE-2016-3715 ImageMagick: File deletion
CVE-2016-3715 ImageMagick: File deletion
A vulnerability was found in ImageMagick. It is possible to delete files by using ImageMagick's 'ephemeral' pseudo protocol which deletes files after reading.
Discussion:
Mitigation:
Details can be found under the resolve tab at https://access.redhat.com/security/vulnerabilities/2296071
Red Hat Enterprise Linux 6 and 7
As a workaround the /etc/ImageMagick/policy.xml file can be edited to disable processing of MVG, HTTPS, HTTP, URL, FTP, EPHEMERAL, MSL, LABEL, TEXT,
SHOW, WIN and PLT commands within image files, simply add the following lines:
within the policy map stanza:
...
Red Hat Enterprise Linux 5
In the following folders:
/usr/lib64/ImageMagick-6.2.8/modules-Q16/coders/ (64bit package)
or
/usr/lib/ImageMagick-6.2.8/modules-Q16/cod
Bugzilla
CVE-2016-3715 ImageMagick: File deletion [fedora-all]
bugzilla·2016-05-03·CVSS 5.5
CVE-2016-3715 [MEDIUM] CVE-2016-3715 ImageMagick: File deletion [fedora-all]
CVE-2016-3715 ImageMagick: File deletion [fedora-all]
This is an automatically created tracking bug! It was created to ensure
that one or more security vulnerabilities are fixed in affected versions
of Fedora.
For comments that are specific to the vulnerability please use bugs filed
against the "Security Response" product referenced in the "Blocks" field.
For more information see:
http://fedoraproject.org/wiki/Security/TrackingBugs
When submitting as an update, use the fedpkg template provided in the next
comment(s). This will include the bug IDs of this tracking bug as well as
the relevant top-level CVE bugs.
Please also mention the CVE IDs being fixed in the RPM changelog and the
fedpkg commit message.
NOTE: this issue affects multiple supported versions of Fedora. While only
one t
http://git.imagemagick.org/repos/ImageMagick/blob/a01518e08c840577cabd7d3ff291a9ba735f7276/ChangeLoghttp://lists.opensuse.org/opensuse-security-announce/2016-05/msg00024.htmlhttp://lists.opensuse.org/opensuse-security-announce/2016-05/msg00025.htmlhttp://lists.opensuse.org/opensuse-security-announce/2016-05/msg00028.htmlhttp://lists.opensuse.org/opensuse-security-announce/2016-05/msg00032.htmlhttp://lists.opensuse.org/opensuse-security-announce/2016-05/msg00051.htmlhttp://rhn.redhat.com/errata/RHSA-2016-0726.htmlhttp://www.debian.org/security/2016/dsa-3580http://www.debian.org/security/2016/dsa-3746http://www.openwall.com/lists/oss-security/2016/05/03/18http://www.oracle.com/technetwork/topics/security/bulletinjul2016-3090568.htmlhttp://www.oracle.com/technetwork/topics/security/linuxbulletinapr2016-2952096.htmlhttp://www.securityfocus.com/archive/1/538378/100/0/threadedhttp://www.securityfocus.com/bid/89852http://www.slackware.com/security/viewer.php?l=slackware-security&y=2016&m=slackware-security.440568http://www.ubuntu.com/usn/USN-2990-1https://security.gentoo.org/glsa/201611-21https://www.exploit-db.com/exploits/39767/https://www.imagemagick.org/discourse-server/viewtopic.php?f=4&t=29588https://www.imagemagick.org/script/changelog.phphttp://git.imagemagick.org/repos/ImageMagick/blob/a01518e08c840577cabd7d3ff291a9ba735f7276/ChangeLoghttp://lists.opensuse.org/opensuse-security-announce/2016-05/msg00024.htmlhttp://lists.opensuse.org/opensuse-security-announce/2016-05/msg00025.htmlhttp://lists.opensuse.org/opensuse-security-announce/2016-05/msg00028.htmlhttp://lists.opensuse.org/opensuse-security-announce/2016-05/msg00032.htmlhttp://lists.opensuse.org/opensuse-security-announce/2016-05/msg00051.htmlhttp://rhn.redhat.com/errata/RHSA-2016-0726.htmlhttp://www.debian.org/security/2016/dsa-3580http://www.debian.org/security/2016/dsa-3746http://www.openwall.com/lists/oss-security/2016/05/03/18http://www.oracle.com/technetwork/topics/security/bulletinjul2016-3090568.htmlhttp://www.oracle.com/technetwork/topics/security/linuxbulletinapr2016-2952096.htmlhttp://www.securityfocus.com/archive/1/538378/100/0/threadedhttp://www.securityfocus.com/bid/89852http://www.slackware.com/security/viewer.php?l=slackware-security&y=2016&m=slackware-security.440568http://www.ubuntu.com/usn/USN-2990-1https://security.gentoo.org/glsa/201611-21https://www.exploit-db.com/exploits/39767/https://www.imagemagick.org/discourse-server/viewtopic.php?f=4&t=29588https://www.imagemagick.org/script/changelog.phphttps://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2016-3715
2016-05-05
Published
2021-11-03
Added to CISA KEV
Exploited in the wild