← Back to CVEs

CVE-2016-3714

HIGHCISA KEV

8.4

Description

The (1) EPHEMERAL, (2) HTTPS, (3) MVG, (4) MSL, (5) TEXT, (6) SHOW, (7) WIN, and (8) PLT coders in ImageMagick before 6.9.3-10 and 7.x before 7.0.1-1 allow remote attackers to execute arbitrary code via shell metacharacters in a crafted image, aka "ImageTragick."

CVE Details

CVSS v3.1 Score8.4

SeverityHIGH

CVSS VectorCVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack VectorLOCAL

ComplexityLOW

Privileges RequiredNONE

User InteractionNONE

Published5/5/2016

Last Modified4/21/2026

Sourcekev

Honeypot Sightings0

CISA KEV

VendorImageMagick

ProductImageMagick

Vulnerability NameImageMagick Improper Input Validation Vulnerability

KEV Date Added2024-09-09

Remediation Due Date2024-09-30

Ransomware UseUnknown

Affected Products

canonical:ubuntu_linuxdebian:debian_linuximagemagick:imagemagickopensuse:leapopensuse:opensusesuse:suse_linux_enterprise_server

Weaknesses (CWE)

CWE-20CWE-20

References

http://git.imagemagick.org/repos/ImageMagick/blob/a01518e08c840577cabd7d3ff291a9ba735f7276/ChangeLog(secalert@redhat.com)

http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00024.html(secalert@redhat.com)

http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00025.html(secalert@redhat.com)

http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00028.html(secalert@redhat.com)

http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00032.html(secalert@redhat.com)

http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00041.html(secalert@redhat.com)

http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00051.html(secalert@redhat.com)

http://packetstormsecurity.com/files/152364/ImageTragick-ImageMagick-Proof-Of-Concepts.html(secalert@redhat.com)

http://rhn.redhat.com/errata/RHSA-2016-0726.html(secalert@redhat.com)

http://www.debian.org/security/2016/dsa-3580(secalert@redhat.com)

http://www.debian.org/security/2016/dsa-3746(secalert@redhat.com)

http://www.openwall.com/lists/oss-security/2016/05/03/13(secalert@redhat.com)

http://www.openwall.com/lists/oss-security/2016/05/03/18(secalert@redhat.com)

http://www.oracle.com/technetwork/topics/security/bulletinjul2016-3090568.html(secalert@redhat.com)

http://www.oracle.com/technetwork/topics/security/linuxbulletinapr2016-2952096.html(secalert@redhat.com)

http://www.rapid7.com/db/modules/exploit/unix/fileformat/imagemagick_delegate(secalert@redhat.com)

http://www.securityfocus.com/archive/1/538378/100/0/threaded(secalert@redhat.com)

http://www.securityfocus.com/bid/89848(secalert@redhat.com)

http://www.securitytracker.com/id/1035742(secalert@redhat.com)

http://www.slackware.com/security/viewer.php?l=slackware-security&y=2016&m=slackware-security.440568(secalert@redhat.com)

http://www.ubuntu.com/usn/USN-2990-1(secalert@redhat.com)

https://access.redhat.com/security/vulnerabilities/2296071(secalert@redhat.com)

https://bugzilla.redhat.com/show_bug.cgi?id=1332492(secalert@redhat.com)

https://imagetragick.com/(secalert@redhat.com)

https://security.gentoo.org/glsa/201611-21(secalert@redhat.com)

https://www.exploit-db.com/exploits/39767/(secalert@redhat.com)

https://www.exploit-db.com/exploits/39791/(secalert@redhat.com)

https://www.imagemagick.org/discourse-server/viewtopic.php?f=4&t=29588(secalert@redhat.com)

https://www.imagemagick.org/script/changelog.php(secalert@redhat.com)

https://www.kb.cert.org/vuls/id/250519(secalert@redhat.com)

http://git.imagemagick.org/repos/ImageMagick/blob/a01518e08c840577cabd7d3ff291a9ba735f7276/ChangeLog(af854a3a-2127-422b-91ae-364da2661108)

http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00024.html(af854a3a-2127-422b-91ae-364da2661108)

http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00025.html(af854a3a-2127-422b-91ae-364da2661108)

http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00028.html(af854a3a-2127-422b-91ae-364da2661108)

http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00032.html(af854a3a-2127-422b-91ae-364da2661108)

http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00041.html(af854a3a-2127-422b-91ae-364da2661108)

http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00051.html(af854a3a-2127-422b-91ae-364da2661108)

http://packetstormsecurity.com/files/152364/ImageTragick-ImageMagick-Proof-Of-Concepts.html(af854a3a-2127-422b-91ae-364da2661108)

http://rhn.redhat.com/errata/RHSA-2016-0726.html(af854a3a-2127-422b-91ae-364da2661108)

http://www.debian.org/security/2016/dsa-3580(af854a3a-2127-422b-91ae-364da2661108)

http://www.debian.org/security/2016/dsa-3746(af854a3a-2127-422b-91ae-364da2661108)

http://www.openwall.com/lists/oss-security/2016/05/03/13(af854a3a-2127-422b-91ae-364da2661108)

http://www.openwall.com/lists/oss-security/2016/05/03/18(af854a3a-2127-422b-91ae-364da2661108)

http://www.oracle.com/technetwork/topics/security/bulletinjul2016-3090568.html(af854a3a-2127-422b-91ae-364da2661108)

http://www.oracle.com/technetwork/topics/security/linuxbulletinapr2016-2952096.html(af854a3a-2127-422b-91ae-364da2661108)

http://www.rapid7.com/db/modules/exploit/unix/fileformat/imagemagick_delegate(af854a3a-2127-422b-91ae-364da2661108)

http://www.securityfocus.com/archive/1/538378/100/0/threaded(af854a3a-2127-422b-91ae-364da2661108)

http://www.securityfocus.com/bid/89848(af854a3a-2127-422b-91ae-364da2661108)

http://www.securitytracker.com/id/1035742(af854a3a-2127-422b-91ae-364da2661108)

http://www.slackware.com/security/viewer.php?l=slackware-security&y=2016&m=slackware-security.440568(af854a3a-2127-422b-91ae-364da2661108)

http://www.ubuntu.com/usn/USN-2990-1(af854a3a-2127-422b-91ae-364da2661108)

https://access.redhat.com/security/vulnerabilities/2296071(af854a3a-2127-422b-91ae-364da2661108)

https://bugzilla.redhat.com/show_bug.cgi?id=1332492(af854a3a-2127-422b-91ae-364da2661108)

https://imagetragick.com/(af854a3a-2127-422b-91ae-364da2661108)

https://security.gentoo.org/glsa/201611-21(af854a3a-2127-422b-91ae-364da2661108)

https://www.exploit-db.com/exploits/39767/(af854a3a-2127-422b-91ae-364da2661108)

https://www.exploit-db.com/exploits/39791/(af854a3a-2127-422b-91ae-364da2661108)

https://www.imagemagick.org/discourse-server/viewtopic.php?f=4&t=29588(af854a3a-2127-422b-91ae-364da2661108)

https://www.imagemagick.org/script/changelog.php(af854a3a-2127-422b-91ae-364da2661108)

https://www.kb.cert.org/vuls/id/250519(af854a3a-2127-422b-91ae-364da2661108)

https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2016-3714(134c704f-9b21-4f2e-91b3-4a467353bcc0)

IOC Correlations

No correlations recorded

This product uses data from the NVD API but is not endorsed or certified by the NVD.