CVE-2016-5118
published 2016-06-10CVE-2016-5118: The OpenBlob function in blob.c in GraphicsMagick before 1.3.24 and ImageMagick allows remote attackers to execute arbitrary code via a | (pipe) character at…
PriorityP271critical9.8CVSS 3.1
AVNACLPRNUINSUCHIHAH
EPSS
49.98%
98.8th percentile
The OpenBlob function in blob.c in GraphicsMagick before 1.3.24 and ImageMagick allows remote attackers to execute arbitrary code via a | (pipe) character at the start of a filename.
Affected
35 ranges· showing 25
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| canonical | ubuntu_linux | — | — |
| canonical | ubuntu_linux | — | — |
| canonical | ubuntu_linux | — | — |
| canonical | ubuntu_linux | — | — |
| debian | debian_linux | — | — |
| debian | graphicsmagick | < graphicsmagick 1.3.24-1 (bookworm) | graphicsmagick 1.3.24-1 (bookworm) |
| debian | imagemagick | < graphicsmagick 1.3.24-1 (bookworm) | graphicsmagick 1.3.24-1 (bookworm) |
| graphicsmagick | graphicsmagick | <= 1.3.23 | — |
| graphicsmagick | graphicsmagick | >= 0 < 1.3.24-1 | 1.3.24-1 |
| graphicsmagick | graphicsmagick | >= 0 < 1.3.24-1 | 1.3.24-1 |
| graphicsmagick | graphicsmagick | >= 0 < 1.3.24-1 | 1.3.24-1 |
| graphicsmagick | graphicsmagick | >= 0 < 1.3.24-1 | 1.3.24-1 |
| imagemagick | imagemagick | < 7.0.1-7 | 7.0.1-7 |
| imagemagick | imagemagick | >= 0 < 8:6.8.9.9-7.1 | 8:6.8.9.9-7.1 |
| imagemagick | imagemagick | >= 0 < 8:6.8.9.9-7.1 | 8:6.8.9.9-7.1 |
| imagemagick | imagemagick | >= 0 < 8:6.8.9.9-7.1 | 8:6.8.9.9-7.1 |
| imagemagick | imagemagick | >= 0 < 8:6.8.9.9-7.1 | 8:6.8.9.9-7.1 |
| imagemagick | imagemagick | >= 0 < 8:6.7.7.10-6ubuntu3.1 | 8:6.7.7.10-6ubuntu3.1 |
| imagemagick | imagemagick | >= 0 < 8:6.8.9.9-7ubuntu5.1 | 8:6.8.9.9-7ubuntu5.1 |
| opensuse | leap | — | — |
| opensuse | opensuse | — | — |
| oracle | linux | — | — |
| oracle | linux | — | — |
| oracle | solaris | — | — |
| oracle | solaris | — | — |
Detection & IOCsextracted from sources · hover to see the quote
snort
alert http $EXTERNAL_NET any -> $HTTP_SERVERS any (msg:"ET WEB_SERVER Possible CVE-2016-5118 Exploit SVG attempt M2"; flow:established,to_server; http.request_body; content:"<svg"; nocase; content:"|78 6c 69 6e 6b 3a 68 72 65 66 3d 27 7c|"; nocase; reference:url,seclists.org/oss-sec/2016/q2/432; reference:cve,2016-5118; classtype:trojan-activity; sid:2022847; rev:3; metadata:created_at 2016_06_01, cve CVE_2016_5118, confidence Medium, signature_severity Major, updated_at 2020_07_14;)
snort
alert http $EXTERNAL_NET any -> $HTTP_SERVERS any (msg:"ET WEB_SERVER Possible CVE-2016-5118 Exploit MVG attempt M1"; flow:established,to_server; http.request_body; content:"viewbox|20|"; nocase; fast_pattern; content:"|20 27 7c|"; nocase; reference:url,seclists.org/oss-sec/2016/q2/432; reference:cve,2016-5118; classtype:trojan-activity; sid:2022848; rev:4; metadata:created_at 2016_06_01, cve CVE_2016_5118, confidence Medium, signature_severity Major, updated_at 2020_10_06;)
snort
alert http $EXTERNAL_NET any -> $HTTP_SERVERS any (msg:"ET WEB_SERVER Possible CVE-2016-5118 Exploit SVG attempt M1"; flow:established,to_server; http.request_body; content:"<svg"; nocase; content:"|78 6c 69 6e 6b 3a 68 72 65 66 3d 22 7c|"; reference:url,seclists.org/oss-sec/2016/q2/432; reference:cve,2016-5118; classtype:trojan-activity; sid:2022846; rev:3; metadata:created_at 2016_06_01, cve CVE_2016_5118, confidence Medium, signature_severity Major, updated_at 2020_07_14;)
snort
alert http $EXTERNAL_NET any -> $HTTP_SERVERS any (msg:"ET WEB_SERVER Possible CVE-2016-5118 Exploit MVG attempt M2"; flow:established,to_server; http.request_body; content:"viewbox|20|"; nocase; fast_pattern; content:"|20 22 7c|"; nocase; reference:url,seclists.org/oss-sec/2016/q2/432; reference:cve,2016-5118; classtype:trojan-activity; sid:2022849; rev:4; metadata:created_at 2016_06_01, cve CVE_2016_5118, confidence Medium, signature_severity Major, updated_at 2020_10_06;)
bytes
|78 6c 69 6e 6b 3a 68 72 65 66 3d 27 7c|
bytes
|78 6c 69 6e 6b 3a 68 72 65 66 3d 22 7c|
bytes
|20 27 7c|
bytes
|20 22 7c|
- →The exploit is triggered by a pipe character `|` at the start of a filename passed to the OpenBlob function in blob.c, causing shell command execution. Inspect filenames in image upload/processing requests for a leading `|`.
- →SVG-based exploit payloads contain an `xlink:href` attribute whose value begins with a pipe character (both single-quote and double-quote variants observed). Look for `<svg` combined with `xlink:href='|` or `xlink:href="|` in HTTP request bodies.
- →MVG-based exploit payloads contain a `viewbox` directive followed by a pipe character (both single-quote and double-quote variants). Look for `viewbox ` combined with ` '|` or ` "|` in HTTP request bodies.
- →A remote attacker could create a specially crafted image that, when processed by an application using ImageMagick, leads to arbitrary shell command execution with the privileges of the user running the application.
- ·The vulnerability affects GraphicsMagick before version 1.3.24 and ImageMagick (all versions at time of disclosure). Ensure both libraries are patched; GraphicsMagick fix is confirmed in 1.3.24. ↗
- ·Debian packages for GraphicsMagick are resolved at version 1.3.24-1 across all tracked suites (bookworm, bullseye, forky, sid, trixie). ↗
CVSS provenance
nvdv3.19.8CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
nvdv2.010.0CRITICALAV:N/AC:L/Au:N/C:C/I:C/A:C
osv9.8CRITICAL
vendor_debian9.8CRITICAL
vendor_redhat9.8CRITICAL
vendor_ubuntu8.4HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Ubuntu
ImageMagick vulnerabilities
vendor_ubuntu·2016-06-02·CVSS 8.4
CVE-2016-3714 [HIGH] ImageMagick vulnerabilities
Title: ImageMagick vulnerabilities
Summary: Several security issues were fixed in ImageMagick.
Nikolay Ermishkin and Stewie discovered that ImageMagick incorrectly
sanitized untrusted input. A remote attacker could use these issues to
execute arbitrary code. These issues are known as "ImageTragick". This
update disables problematic coders via the /etc/ImageMagick-6/policy.xml
configuration file. In certain environments the coders may need to be
manually re-enabled after making sure that ImageMagick does not process
untrusted input. (CVE-2016-3714, CVE-2016-3715, CVE-2016-3716,
CVE-2016-3717, CVE-2016-3718)
Bob Friesenhahn discovered that ImageMagick allowed injecting commands via
an image file or filename. A remote attacker could use this issue to
execute arbitrary code. (CVE-2016-5118)
Red Hat
ImageMagick: Remote code execution via filename
vendor_redhat·2016-05-29·CVSS 9.8
CVE-2016-5118 [CRITICAL] CWE-20 ImageMagick: Remote code execution via filename
ImageMagick: Remote code execution via filename
The OpenBlob function in blob.c in GraphicsMagick before 1.3.24 and ImageMagick allows remote attackers to execute arbitrary code via a | (pipe) character at the start of a filename.
It was discovered that ImageMagick did not properly sanitize certain input before using it to invoke processes. A remote attacker could create a specially crafted image that, when processed by an application using ImageMagick or an unsuspecting user using the ImageMagick utilities, would lead to arbitrary execution of shell commands with the privileges of the user running the application.
Package: ImageMagick (Red Hat Enterprise Linux 5) - Affected
Package: ImageMagick (Red Hat OpenShift Enterprise 2) - Affected
Debian
CVE-2016-5118: graphicsmagick - The OpenBlob function in blob.c in GraphicsMagick before 1.3.24 and ImageMagick ...
vendor_debian·2016·CVSS 9.8
CVE-2016-5118 [CRITICAL] CVE-2016-5118: graphicsmagick - The OpenBlob function in blob.c in GraphicsMagick before 1.3.24 and ImageMagick ...
The OpenBlob function in blob.c in GraphicsMagick before 1.3.24 and ImageMagick allows remote attackers to execute arbitrary code via a | (pipe) character at the start of a filename.
Scope: local
bookworm: resolved (fixed in 1.3.24-1)
bullseye: resolved (fixed in 1.3.24-1)
forky: resolved (fixed in 1.3.24-1)
sid: resolved (fixed in 1.3.24-1)
trixie: resolved (fixed in 1.3.24-1)
GHSA
GHSA-6w95-mr48-gp8c: The OpenBlob function in blob
ghsa_unreviewed·2022-05-13
CVE-2016-5118 [CRITICAL] CWE-284 GHSA-6w95-mr48-gp8c: The OpenBlob function in blob
The OpenBlob function in blob.c in GraphicsMagick before 1.3.24 and ImageMagick allows remote attackers to execute arbitrary code via a | (pipe) character at the start of a filename.
OSV
CVE-2016-5118: The OpenBlob function in blob
osv·2016-06-10·CVSS 9.8
CVE-2016-5118 [CRITICAL] CVE-2016-5118: The OpenBlob function in blob
The OpenBlob function in blob.c in GraphicsMagick before 1.3.24 and ImageMagick allows remote attackers to execute arbitrary code via a | (pipe) character at the start of a filename.
OSV
imagemagick vulnerabilities
osv·2016-06-02·CVSS 8.4
CVE-2016-3714 [HIGH] imagemagick vulnerabilities
imagemagick vulnerabilities
Nikolay Ermishkin and Stewie discovered that ImageMagick incorrectly
sanitized untrusted input. A remote attacker could use these issues to
execute arbitrary code. These issues are known as "ImageTragick". This
update disables problematic coders via the /etc/ImageMagick-6/policy.xml
configuration file. In certain environments the coders may need to be
manually re-enabled after making sure that ImageMagick does not process
untrusted input. (CVE-2016-3714, CVE-2016-3715, CVE-2016-3716,
CVE-2016-3717, CVE-2016-3718)
Bob Friesenhahn discovered that ImageMagick allowed injecting commands via
an image file or filename. A remote attacker could use this issue to
execute arbitrary code. (CVE-2016-5118)
Suricata
ET WEB_SERVER Possible CVE-2016-5118 Exploit SVG attempt M2
suricata·2016-06-01·CVSS 9.8
CVE-2016-5118 [CRITICAL] ET WEB_SERVER Possible CVE-2016-5118 Exploit SVG attempt M2
ET WEB_SERVER Possible CVE-2016-5118 Exploit SVG attempt M2
Rule: alert http $EXTERNAL_NET any -> $HTTP_SERVERS any (msg:"ET WEB_SERVER Possible CVE-2016-5118 Exploit SVG attempt M2"; flow:established,to_server; http.request_body; content:"<svg"; nocase; content:"|78 6c 69 6e 6b 3a 68 72 65 66 3d 27 7c|"; nocase; reference:url,seclists.org/oss-sec/2016/q2/432; reference:cve,2016-5118; classtype:trojan-activity; sid:2022847; rev:3; metadata:created_at 2016_06_01, cve CVE_2016_5118, confidence Medium, signature_severity Major, updated_at 2020_07_14;)
Suricata
ET WEB_SERVER Possible CVE-2016-5118 Exploit MVG attempt M1
suricata·2016-06-01·CVSS 9.8
CVE-2016-5118 [CRITICAL] ET WEB_SERVER Possible CVE-2016-5118 Exploit MVG attempt M1
ET WEB_SERVER Possible CVE-2016-5118 Exploit MVG attempt M1
Rule: alert http $EXTERNAL_NET any -> $HTTP_SERVERS any (msg:"ET WEB_SERVER Possible CVE-2016-5118 Exploit MVG attempt M1"; flow:established,to_server; http.request_body; content:"viewbox|20|"; nocase; fast_pattern; content:"|20 27 7c|"; nocase; reference:url,seclists.org/oss-sec/2016/q2/432; reference:cve,2016-5118; classtype:trojan-activity; sid:2022848; rev:4; metadata:created_at 2016_06_01, cve CVE_2016_5118, confidence Medium, signature_severity Major, updated_at 2020_10_06;)
Suricata
ET WEB_SERVER Possible CVE-2016-5118 Exploit SVG attempt M1
suricata·2016-06-01·CVSS 9.8
CVE-2016-5118 [CRITICAL] ET WEB_SERVER Possible CVE-2016-5118 Exploit SVG attempt M1
ET WEB_SERVER Possible CVE-2016-5118 Exploit SVG attempt M1
Rule: alert http $EXTERNAL_NET any -> $HTTP_SERVERS any (msg:"ET WEB_SERVER Possible CVE-2016-5118 Exploit SVG attempt M1"; flow:established,to_server; http.request_body; content:"<svg"; nocase; content:"|78 6c 69 6e 6b 3a 68 72 65 66 3d 22 7c|"; reference:url,seclists.org/oss-sec/2016/q2/432; reference:cve,2016-5118; classtype:trojan-activity; sid:2022846; rev:3; metadata:created_at 2016_06_01, cve CVE_2016_5118, confidence Medium, signature_severity Major, updated_at 2020_07_14;)
Suricata
ET WEB_SERVER Possible CVE-2016-5118 Exploit MVG attempt M2
suricata·2016-06-01·CVSS 9.8
CVE-2016-5118 [CRITICAL] ET WEB_SERVER Possible CVE-2016-5118 Exploit MVG attempt M2
ET WEB_SERVER Possible CVE-2016-5118 Exploit MVG attempt M2
Rule: alert http $EXTERNAL_NET any -> $HTTP_SERVERS any (msg:"ET WEB_SERVER Possible CVE-2016-5118 Exploit MVG attempt M2"; flow:established,to_server; http.request_body; content:"viewbox|20|"; nocase; fast_pattern; content:"|20 22 7c|"; nocase; reference:url,seclists.org/oss-sec/2016/q2/432; reference:cve,2016-5118; classtype:trojan-activity; sid:2022849; rev:4; metadata:created_at 2016_06_01, cve CVE_2016_5118, confidence Medium, signature_severity Major, updated_at 2020_10_06;)
No public exploits indexed.
Bugzilla
CVE-2016-5118 graphicsmagick: ImageMagick: Remote code execution via filename [fedora-all]
bugzilla·2016-05-30·CVSS 9.8
CVE-2016-5118 [CRITICAL] CVE-2016-5118 graphicsmagick: ImageMagick: Remote code execution via filename [fedora-all]
CVE-2016-5118 graphicsmagick: ImageMagick: Remote code execution via filename [fedora-all]
This is an automatically created tracking bug! It was created to ensure
that one or more security vulnerabilities are fixed in affected versions
of Fedora.
For comments that are specific to the vulnerability please use bugs filed
against the "Security Response" product referenced in the "Blocks" field.
For more information see:
http://fedoraproject.org/wiki/Security/TrackingBugs
When submitting as an update, use the fedpkg template provided in the next
comment(s). This will include the bug IDs of this tracking bug as well as
the relevant top-level CVE bugs.
Please also mention the CVE IDs being fixed in the RPM changelog and the
fedpkg commit message.
NOTE: this issue affects multiple supported
Bugzilla
CVE-2016-5118 graphicsmagick: ImageMagick: Remote code execution via filename [epel-all]
bugzilla·2016-05-30·CVSS 9.8
CVE-2016-5118 [CRITICAL] CVE-2016-5118 graphicsmagick: ImageMagick: Remote code execution via filename [epel-all]
CVE-2016-5118 graphicsmagick: ImageMagick: Remote code execution via filename [epel-all]
This is an automatically created tracking bug! It was created to ensure
that one or more security vulnerabilities are fixed in affected versions
of Fedora EPEL.
For comments that are specific to the vulnerability please use bugs filed
against the "Security Response" product referenced in the "Blocks" field.
For more information see:
http://fedoraproject.org/wiki/Security/TrackingBugs
When submitting as an update, use the fedpkg template provided in the next
comment(s). This will include the bug IDs of this tracking bug as well as
the relevant top-level CVE bugs.
Please also mention the CVE IDs being fixed in the RPM changelog and the
fedpkg commit message.
NOTE: this issue affects multiple suppor
Bugzilla
CVE-2016-5118 ImageMagick: Remote code execution via filename [fedora-all]
bugzilla·2016-05-30·CVSS 9.8
CVE-2016-5118 [CRITICAL] CVE-2016-5118 ImageMagick: Remote code execution via filename [fedora-all]
CVE-2016-5118 ImageMagick: Remote code execution via filename [fedora-all]
This is an automatically created tracking bug! It was created to ensure
that one or more security vulnerabilities are fixed in affected versions
of Fedora.
For comments that are specific to the vulnerability please use bugs filed
against the "Security Response" product referenced in the "Blocks" field.
For more information see:
http://fedoraproject.org/wiki/Security/TrackingBugs
When submitting as an update, use the fedpkg template provided in the next
comment(s). This will include the bug IDs of this tracking bug as well as
the relevant top-level CVE bugs.
Please also mention the CVE IDs being fixed in the RPM changelog and the
fedpkg commit message.
NOTE: this issue affects multiple supported versions of Fed
Bugzilla
CVE-2016-5118 ImageMagick: Remote code execution via filename
bugzilla·2016-05-30·CVSS 8.4
CVE-2016-5118 [HIGH] CVE-2016-5118 ImageMagick: Remote code execution via filename
CVE-2016-5118 ImageMagick: Remote code execution via filename
All existing releases of GraphicsMagick and ImageMagick support a file open syntax where if the first character of the file specification is a '|', then the remainder of the filename is passed to the shell for execution using the POSIX popen(3C) function. File opening is handled by an OpenBlob() function in the source file blob.c. Unlike the vulnerability described by CVE-2016-3714, this functionality is supported by the core file opening function rather than a delegates subsystem usually used to execute external programs.
References:
http://seclists.org/oss-sec/2016/q2/432
Discussion:
Created GraphicsMagick tracking bugs for this issue:
Affects: fedora-all [bug 1340816]
Affects: epel-all [bug 1340817]
---
Created ImageM
Bugzilla
CVE-2016-5241 GraphicsMagick: SVG converting issues
bugzilla·2016-05-05·CVSS 5.5
CVE-2016-5241 [MEDIUM] CVE-2016-5241 GraphicsMagick: SVG converting issues
CVE-2016-5241 GraphicsMagick: SVG converting issues
Two vulnerabilities were found in GraphicsMagick, both resulting in DoS.
* Infinite loop caused by converting a circularly defined svg file.
Upstream patch:
http://hg.code.sf.net/p/graphicsmagick/code/rev/ddc999ec896c
* Arithmetic exception converting a svg file caused by a X%0 operation in
magick/render.c:3800
(long) (y-fill_pattern->tile_info.y) % fill_pattern->rows,
Upstream patch:
http://hg.code.sf.net/p/graphicsmagick/code/rev/8d175c4edfe7
References (containing reproducers):
http://seclists.org/oss-sec/2016/q2/180
Discussion:
Created GraphicsMagick tracking bugs for this issue:
Affects: fedora-all [bug 1333411]
Affects: epel-all [bug 1333412]
---
CVE assignment:
http://seclists.org/oss-sec/2016/q2/460
CVE-2016-5240
http://git.imagemagick.org/repos/ImageMagick/commit/40639d173aa8c76b850d625c630b711fee4dcfb8http://hg.code.sf.net/p/graphicsmagick/code/file/41876934e762/ChangeLoghttp://hg.code.sf.net/p/graphicsmagick/code/rev/ae3928faa858http://lists.opensuse.org/opensuse-security-announce/2016-06/msg00008.htmlhttp://lists.opensuse.org/opensuse-security-announce/2016-06/msg00009.htmlhttp://lists.opensuse.org/opensuse-security-announce/2016-06/msg00011.htmlhttp://lists.opensuse.org/opensuse-security-announce/2016-06/msg00021.htmlhttp://lists.opensuse.org/opensuse-security-announce/2016-06/msg00030.htmlhttp://lists.opensuse.org/opensuse-security-announce/2016-06/msg00032.htmlhttp://lists.opensuse.org/opensuse-security-announce/2016-06/msg00047.htmlhttp://www.debian.org/security/2016/dsa-3591http://www.debian.org/security/2016/dsa-3746http://www.openwall.com/lists/oss-security/2016/05/29/7http://www.openwall.com/lists/oss-security/2016/05/30/1http://www.oracle.com/technetwork/topics/security/bulletinjul2016-3090568.htmlhttp://www.oracle.com/technetwork/topics/security/linuxbulletinapr2016-2952096.htmlhttp://www.securityfocus.com/bid/90938http://www.securitytracker.com/id/1035984http://www.securitytracker.com/id/1035985http://www.slackware.com/security/viewer.php?l=slackware-security&y=2016&m=slackware-security.397749http://www.ubuntu.com/usn/USN-2990-1https://access.redhat.com/errata/RHSA-2016:1237http://git.imagemagick.org/repos/ImageMagick/commit/40639d173aa8c76b850d625c630b711fee4dcfb8http://hg.code.sf.net/p/graphicsmagick/code/file/41876934e762/ChangeLoghttp://hg.code.sf.net/p/graphicsmagick/code/rev/ae3928faa858http://lists.opensuse.org/opensuse-security-announce/2016-06/msg00008.htmlhttp://lists.opensuse.org/opensuse-security-announce/2016-06/msg00009.htmlhttp://lists.opensuse.org/opensuse-security-announce/2016-06/msg00011.htmlhttp://lists.opensuse.org/opensuse-security-announce/2016-06/msg00021.htmlhttp://lists.opensuse.org/opensuse-security-announce/2016-06/msg00030.htmlhttp://lists.opensuse.org/opensuse-security-announce/2016-06/msg00032.htmlhttp://lists.opensuse.org/opensuse-security-announce/2016-06/msg00047.htmlhttp://www.debian.org/security/2016/dsa-3591http://www.debian.org/security/2016/dsa-3746http://www.openwall.com/lists/oss-security/2016/05/29/7http://www.openwall.com/lists/oss-security/2016/05/30/1http://www.oracle.com/technetwork/topics/security/bulletinjul2016-3090568.htmlhttp://www.oracle.com/technetwork/topics/security/linuxbulletinapr2016-2952096.htmlhttp://www.securityfocus.com/bid/90938http://www.securitytracker.com/id/1035984http://www.securitytracker.com/id/1035985http://www.slackware.com/security/viewer.php?l=slackware-security&y=2016&m=slackware-security.397749http://www.ubuntu.com/usn/USN-2990-1https://access.redhat.com/errata/RHSA-2016:1237
2016-06-10
Published