⚠ Actively exploited
Added to CISA KEV on 2021-11-03. Federal agencies required to patch by 2022-05-03. Required action: Apply updates per vendor instructions..

CVE-2016-3715

CWE-552 — Files Accessible to External PartiesCWE-20 — Improper Input ValidationCWE-284 — Improper Access Control15 documents12 sources
Severity
5.5MEDIUM
EPSS
77.7%
top 1.00%
CISA KEV
KEV
Added 2021-11-03
Due 2022-05-03
Exploit
Exploited in wild
Active exploitation observed
Affected products
30
Imagemagick ImagemagickCanonical Ubuntu LinuxOpensuse Leap+27 more
Timeline
PublishedMay 5
KEV addedNov 3
KEV dueMay 3
Latest updateMay 14
CISA Required Action: Apply updates per vendor instructions.

Description

The EPHEMERAL coder in ImageMagick before 6.9.3-10 and 7.x before 7.0.1-1 allows remote attackers to delete arbitrary files via a crafted image.

CVSS vector

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:NExploitability: 1.8 | Impact: 3.6

Affected Packages19 packages

▶NVDimagemagick/imagemagick< 6.9.3-10+2
▶Debianimagemagick< 8:6.9.6.2+dfsg-2+3
▶Debiangraphicsmagick< 1.3.24-1+3
▶NVDoracle/linux6, 7+1
▶NVDsuse/manager2.1

Also affects: Ubuntu Linux 12.04, 14.04, 15.10, 16.04, Enterprise Linux 6.7, 7.2, 7.3, 7.4, 7.5, 7.6, 7.7, 6.0, 7.0, 6.0_ppc64, 7.0_ppc64, 6.7_ppc64, 7.2_ppc64, 7.3_ppc64, 7.4_ppc64, 7.5_ppc64, 7.6_ppc64, 7.7_ppc64, 6.7z

Patches

Patch: git.imagemagick.org ↗Patch: git.imagemagick.org ↗

🔴Vulnerability Details

5
GHSA
GHSA-vmpp-w9w7-m326: The EPHEMERAL coder in ImageMagick before 6↗2022-05-14
▶
OSV
imagemagick vulnerabilities↗2016-06-02
▶
CVEList
CVE-2016-3715: The EPHEMERAL coder in ImageMagick before 6↗2016-05-05
▶
OSV
CVE-2016-3715: The EPHEMERAL coder in ImageMagick before 6↗2016-05-05
▶
VulnCheck
ImageMagick Arbitrary File Deletion Vulnerability↗2016
▶

💥Exploits & PoCs

1
Exploit-DB
ImageMagick 7.0.1-0 / 6.9.3-9 - 'ImageTragick ' Multiple Vulnerabilities↗2016-05-04
▶

🔍Detection Rules

1
Suricata
ET WEB_SERVER ImageMagick CVE-2016-3715 File Deletion Inbound (ephermeral:+ mvg)↗2016-05-04
▶

📋Vendor Advisories

4
CISA
ImageMagick Arbitrary File Deletion Vulnerability↗2021-11-03
▶
Ubuntu
ImageMagick vulnerabilities↗2016-06-02
▶
Red Hat
ImageMagick: File deletion↗2016-05-03
▶
Debian
CVE-2016-3715: graphicsmagick - The EPHEMERAL coder in ImageMagick before 6.9.3-10 and 7.x before 7.0.1-1 allows...↗2016
▶

💬Community

3
Bugzilla
CVE-2016-6319 foreman: Persistent XSS in Foreman remote execution plugin↗2016-08-10
▶
Bugzilla
CVE-2016-3715 ImageMagick: File deletion↗2016-05-03
▶
Bugzilla
CVE-2016-3715 ImageMagick: File deletion [fedora-all]↗2016-05-03
▶