CVE-2016-3718

MEDIUMCISA KEV

5.5

Descricao

The (1) HTTP and (2) FTP coders in ImageMagick before 6.9.3-10 and 7.x before 7.0.1-1 allow remote attackers to conduct server-side request forgery (SSRF) attacks via a crafted image.

Detalhes CVE

Pontuacao CVSS v3.15.5

SeveridadeMEDIUM

Vetor CVSSCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N

Vetor de ataqueLOCAL

ComplexidadeLOW

Privilegios necessariosNONE

Interacao do usuarioREQUIRED

Publicado5/5/2016

Ultima modificacao4/22/2026

Fontekev

Avistamentos honeypot0

CISA KEV

FornecedorImageMagick

ProdutoImageMagick

Nome da vulnerabilidadeImageMagick Server-Side Request Forgery (SSRF) Vulnerability

Data inclusao KEV2021-11-03

Prazo de remediacao2022-05-03

Uso em ransomwareUnknown

Produtos afetados

canonical:ubuntu_linuximagemagick:imagemagickopensuse:leapopensuse:opensuseoracle:linuxoracle:solarisredhat:enterprise_linux_desktopredhat:enterprise_linux_eusredhat:enterprise_linux_for_ibm_z_systemsredhat:enterprise_linux_for_ibm_z_systems_eusredhat:enterprise_linux_for_power_big_endianredhat:enterprise_linux_for_power_big_endian_eusredhat:enterprise_linux_for_power_little_endianredhat:enterprise_linux_for_power_little_endian_eusredhat:enterprise_linux_hpc_noderedhat:enterprise_linux_hpc_node_eusredhat:enterprise_linux_serverredhat:enterprise_linux_server_ausredhat:enterprise_linux_server_from_rhuiredhat:enterprise_linux_server_supplementary_eusredhat:enterprise_linux_server_tusredhat:enterprise_linux_workstationsuse:linux_enterprise_debuginfosuse:linux_enterprise_desktopsuse:linux_enterprise_serversuse:linux_enterprise_software_development_kitsuse:linux_enterprise_workstation_extensionsuse:managersuse:manager_proxysuse:openstack_cloud

Fraquezas (CWE)

CWE-918CWE-918

Referencias

http://git.imagemagick.org/repos/ImageMagick/blob/a01518e08c840577cabd7d3ff291a9ba735f7276/ChangeLog(secalert@redhat.com)

http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00024.html(secalert@redhat.com)

http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00025.html(secalert@redhat.com)

http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00028.html(secalert@redhat.com)

http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00032.html(secalert@redhat.com)

http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00051.html(secalert@redhat.com)

http://rhn.redhat.com/errata/RHSA-2016-0726.html(secalert@redhat.com)

http://www.debian.org/security/2016/dsa-3580(secalert@redhat.com)

http://www.openwall.com/lists/oss-security/2016/05/03/18(secalert@redhat.com)

http://www.oracle.com/technetwork/topics/security/bulletinjul2016-3090568.html(secalert@redhat.com)

http://www.oracle.com/technetwork/topics/security/linuxbulletinapr2016-2952096.html(secalert@redhat.com)

http://www.securityfocus.com/archive/1/538378/100/0/threaded(secalert@redhat.com)

http://www.slackware.com/security/viewer.php?l=slackware-security&y=2016&m=slackware-security.440568(secalert@redhat.com)

http://www.ubuntu.com/usn/USN-2990-1(secalert@redhat.com)

https://lists.debian.org/debian-lts-announce/2018/06/msg00009.html(secalert@redhat.com)

https://security.gentoo.org/glsa/201611-21(secalert@redhat.com)

https://www.exploit-db.com/exploits/39767/(secalert@redhat.com)

https://www.imagemagick.org/discourse-server/viewtopic.php?f=4&t=29588(secalert@redhat.com)

https://www.imagemagick.org/script/changelog.php(secalert@redhat.com)

http://git.imagemagick.org/repos/ImageMagick/blob/a01518e08c840577cabd7d3ff291a9ba735f7276/ChangeLog(af854a3a-2127-422b-91ae-364da2661108)

http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00024.html(af854a3a-2127-422b-91ae-364da2661108)

http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00025.html(af854a3a-2127-422b-91ae-364da2661108)

http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00028.html(af854a3a-2127-422b-91ae-364da2661108)

http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00032.html(af854a3a-2127-422b-91ae-364da2661108)

http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00051.html(af854a3a-2127-422b-91ae-364da2661108)

http://rhn.redhat.com/errata/RHSA-2016-0726.html(af854a3a-2127-422b-91ae-364da2661108)

http://www.debian.org/security/2016/dsa-3580(af854a3a-2127-422b-91ae-364da2661108)

http://www.openwall.com/lists/oss-security/2016/05/03/18(af854a3a-2127-422b-91ae-364da2661108)

http://www.oracle.com/technetwork/topics/security/bulletinjul2016-3090568.html(af854a3a-2127-422b-91ae-364da2661108)

http://www.oracle.com/technetwork/topics/security/linuxbulletinapr2016-2952096.html(af854a3a-2127-422b-91ae-364da2661108)

http://www.securityfocus.com/archive/1/538378/100/0/threaded(af854a3a-2127-422b-91ae-364da2661108)

http://www.slackware.com/security/viewer.php?l=slackware-security&y=2016&m=slackware-security.440568(af854a3a-2127-422b-91ae-364da2661108)

http://www.ubuntu.com/usn/USN-2990-1(af854a3a-2127-422b-91ae-364da2661108)

https://lists.debian.org/debian-lts-announce/2018/06/msg00009.html(af854a3a-2127-422b-91ae-364da2661108)

https://security.gentoo.org/glsa/201611-21(af854a3a-2127-422b-91ae-364da2661108)

https://www.exploit-db.com/exploits/39767/(af854a3a-2127-422b-91ae-364da2661108)

https://www.imagemagick.org/discourse-server/viewtopic.php?f=4&t=29588(af854a3a-2127-422b-91ae-364da2661108)

https://www.imagemagick.org/script/changelog.php(af854a3a-2127-422b-91ae-364da2661108)

https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2016-3718(134c704f-9b21-4f2e-91b3-4a467353bcc0)

Correlacoes IOC

Sem correlacoes registradas

This product uses data from the NVD API but is not endorsed or certified by the NVD.