CVE - CVE-2016-3714

CVE-ID
CVE-2016-3714	Learn more at National Vulnerability Database (NVD) • CVSS Severity Rating • Fix Information • Vulnerable Software Versions • SCAP Mappings • CPE Information
Description
The (1) EPHEMERAL, (2) HTTPS, (3) MVG, (4) MSL, (5) TEXT, (6) SHOW, (7) WIN, and (8) PLT coders in ImageMagick before 6.9.3-10 and 7.x before 7.0.1-1 allow remote attackers to execute arbitrary code via shell metacharacters in a crafted image, aka "ImageTragick."
References
Note: References are provided for the convenience of the reader to help distinguish between vulnerabilities. The list is not intended to be complete.
MISC:1035742 URL:http://www.securitytracker.com/id/1035742 MISC:20160513 May 2016 - HipChat Server - Critical Security Advisory URL:http://www.securityfocus.com/archive/1/538378/100/0/threaded MISC:39767 URL:https://www.exploit-db.com/exploits/39767/ MISC:39791 URL:https://www.exploit-db.com/exploits/39791/ MISC:89848 URL:http://www.securityfocus.com/bid/89848 MISC:DSA-3580 URL:http://www.debian.org/security/2016/dsa-3580 MISC:DSA-3746 URL:http://www.debian.org/security/2016/dsa-3746 MISC:GLSA-201611-21 URL:https://security.gentoo.org/glsa/201611-21 MISC:RHSA-2016:0726 URL:http://rhn.redhat.com/errata/RHSA-2016-0726.html MISC:SSA:2016-132-01 URL:http://www.slackware.com/security/viewer.php?l=slackware-security&y=2016&m=slackware-security.440568 MISC:SUSE-SU-2016:1260 URL:http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00024.html MISC:SUSE-SU-2016:1275 URL:http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00032.html MISC:SUSE-SU-2016:1301 URL:http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00041.html MISC:USN-2990-1 URL:http://www.ubuntu.com/usn/USN-2990-1 MISC:VU#250519 URL:https://www.kb.cert.org/vuls/id/250519 MISC:[oss-security] 20160503 ImageMagick Is On Fire -- CVE-2016-3714 URL:http://www.openwall.com/lists/oss-security/2016/05/03/13 MISC:[oss-security] 20160504 Re: ImageMagick Is On Fire -- CVE-2016-3714 URL:http://www.openwall.com/lists/oss-security/2016/05/03/18 MISC:http://git.imagemagick.org/repos/ImageMagick/blob/a01518e08c840577cabd7d3ff291a9ba735f7276/ChangeLog URL:http://git.imagemagick.org/repos/ImageMagick/blob/a01518e08c840577cabd7d3ff291a9ba735f7276/ChangeLog MISC:http://packetstormsecurity.com/files/152364/ImageTragick-ImageMagick-Proof-Of-Concepts.html URL:http://packetstormsecurity.com/files/152364/ImageTragick-ImageMagick-Proof-Of-Concepts.html MISC:http://www.oracle.com/technetwork/topics/security/bulletinjul2016-3090568.html URL:http://www.oracle.com/technetwork/topics/security/bulletinjul2016-3090568.html MISC:http://www.oracle.com/technetwork/topics/security/linuxbulletinapr2016-2952096.html URL:http://www.oracle.com/technetwork/topics/security/linuxbulletinapr2016-2952096.html MISC:http://www.rapid7.com/db/modules/exploit/unix/fileformat/imagemagick_delegate URL:http://www.rapid7.com/db/modules/exploit/unix/fileformat/imagemagick_delegate MISC:https://access.redhat.com/security/vulnerabilities/2296071 URL:https://access.redhat.com/security/vulnerabilities/2296071 MISC:https://bugzilla.redhat.com/show_bug.cgi?id=1332492 URL:https://bugzilla.redhat.com/show_bug.cgi?id=1332492 MISC:https://imagetragick.com/ URL:https://imagetragick.com/ MISC:https://www.imagemagick.org/discourse-server/viewtopic.php?f=4&t=29588 URL:https://www.imagemagick.org/discourse-server/viewtopic.php?f=4&t=29588 MISC:https://www.imagemagick.org/script/changelog.php URL:https://www.imagemagick.org/script/changelog.php MISC:openSUSE-SU-2016:1261 URL:http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00025.html MISC:openSUSE-SU-2016:1266 URL:http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00028.html MISC:openSUSE-SU-2016:1326 URL:http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00051.html
Assigning CNA
Red Hat, Inc.
Date Record Created
20160330	Disclaimer: The record creation date may reflect when the CVE ID was allocated or reserved, and does not necessarily indicate when this vulnerability was discovered, shared with the affected vendor, publicly disclosed, or updated in CVE.
Phase (Legacy)
Assigned (20160330)
Votes (Legacy)

Comments (Legacy)

Proposed (Legacy)
N/A
This is an record on the CVE List, which provides common identifiers for publicly known cybersecurity vulnerabilities.
Search CVE Using Keywords: You can also search by reference using the CVE Reference Maps.
For More Information: CVE Request Web Form (select "Other" from dropdown)