CVE-2016-3716

Published: May 5, 2016Modified: May 6, 2026

3.3

Vector

CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

Exploitability: 1.8 / Impact: 1.4

Source: NVD

Description

The MSL coder in ImageMagick before 6.9.3-10 and 7.x before 7.0.1-1 allows remote attackers to move arbitrary files via a crafted image.

Affected (19)

Products: Canonical: Ubuntu Linux · Imagemagick: Imagemagick · Redhat: Enterprise Linux Desktop, Enterprise Linux Hpc Node, Enterprise Linux Hpc Node Eus, Enterprise Linux Server, Enterprise Linux Server Aus, Enterprise Linux Server Eus, Enterprise Linux Server Supplementary Eus, Enterprise Linux Workstation

1 product

1 product

8 products

Enterprise Linux Desktop

Enterprise Linux Hpc Node

Enterprise Linux Hpc Node Eus

Enterprise Linux Server

Enterprise Linux Server Aus

Enterprise Linux Server Eus

Enterprise Linux Server Supplementary Eus

Enterprise Linux Workstation

Configuration A

4 vulnerable

Vulnerable Software	Affected Versions
Canonical Ubuntu Linux	Version 12.04
Canonical Ubuntu Linux	Version 14.04
Canonical Ubuntu Linux	Version 15.10
Canonical Ubuntu Linux	Version 16.04

Configuration B

3 vulnerable

Vulnerable Software	Affected Versions
Imagemagick Imagemagick	Up to 6.9.3-9
Imagemagick Imagemagick	Version 7.0.0-0
Imagemagick Imagemagick	Version 7.0.1-0

Configuration C

12 vulnerable

Vulnerable Software	Affected Versions
Redhat Enterprise Linux Desktop	Version 6.0
Redhat Enterprise Linux Desktop	Version 7.0
Redhat Enterprise Linux Hpc Node	Version 6.0
Redhat Enterprise Linux Hpc Node	Version 7.0
Redhat Enterprise Linux Hpc Node Eus	Version 7.2
Redhat Enterprise Linux Server	Version 6.0
Redhat Enterprise Linux Server	Version 7.0
Redhat Enterprise Linux Server Aus	Version 7.2
Redhat Enterprise Linux Server Eus	Version 7.2
Redhat Enterprise Linux Server Supplementary Eus	Version 6.7z
Redhat Enterprise Linux Workstation	Version 6.0
Redhat Enterprise Linux Workstation	Version 7.0

Related CWEs

References (36)

http://git.imagemagick.org/repos/ImageMagick/blob/a01518e08c840577cabd7d3ff291a9ba735f7276/ChangeLog

Source: secalert@redhat.com

PatchVendor Advisory

http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00024.html

Source: secalert@redhat.com

http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00025.html

Source: secalert@redhat.com

http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00028.html

Source: secalert@redhat.com

http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00032.html

Source: secalert@redhat.com

http://rhn.redhat.com/errata/RHSA-2016-0726.html

Source: secalert@redhat.com

Third Party Advisory

http://www.debian.org/security/2016/dsa-3580

Source: secalert@redhat.com

http://www.openwall.com/lists/oss-security/2016/05/03/18

Source: secalert@redhat.com

Exploit

http://www.oracle.com/technetwork/topics/security/bulletinjul2016-3090568.html

Source: secalert@redhat.com

http://www.oracle.com/technetwork/topics/security/linuxbulletinapr2016-2952096.html

Source: secalert@redhat.com

http://www.securityfocus.com/archive/1/538378/100/0/threaded

Source: secalert@redhat.com

http://www.slackware.com/security/viewer.php?l=slackware-security&y=2016&m=slackware-security.440568

Source: secalert@redhat.com

http://www.ubuntu.com/usn/USN-2990-1

Source: secalert@redhat.com

Third Party Advisory

https://lists.debian.org/debian-lts-announce/2018/06/msg00009.html

Source: secalert@redhat.com

https://security.gentoo.org/glsa/201611-21

Source: secalert@redhat.com

https://www.exploit-db.com/exploits/39767/

Source: secalert@redhat.com

https://www.imagemagick.org/discourse-server/viewtopic.php?f=4&t=29588

Source: secalert@redhat.com

Vendor Advisory

https://www.imagemagick.org/script/changelog.php

Source: secalert@redhat.com

Vendor Advisory

http://git.imagemagick.org/repos/ImageMagick/blob/a01518e08c840577cabd7d3ff291a9ba735f7276/ChangeLog

Source: af854a3a-2127-422b-91ae-364da2661108

PatchVendor Advisory

http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00024.html

Source: af854a3a-2127-422b-91ae-364da2661108

http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00025.html

Source: af854a3a-2127-422b-91ae-364da2661108

http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00028.html

Source: af854a3a-2127-422b-91ae-364da2661108

http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00032.html

Source: af854a3a-2127-422b-91ae-364da2661108

http://rhn.redhat.com/errata/RHSA-2016-0726.html

Source: af854a3a-2127-422b-91ae-364da2661108

Third Party Advisory

http://www.debian.org/security/2016/dsa-3580

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.openwall.com/lists/oss-security/2016/05/03/18

Source: af854a3a-2127-422b-91ae-364da2661108

Exploit

http://www.oracle.com/technetwork/topics/security/bulletinjul2016-3090568.html

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.oracle.com/technetwork/topics/security/linuxbulletinapr2016-2952096.html

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.securityfocus.com/archive/1/538378/100/0/threaded

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.slackware.com/security/viewer.php?l=slackware-security&y=2016&m=slackware-security.440568

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.ubuntu.com/usn/USN-2990-1

Source: af854a3a-2127-422b-91ae-364da2661108

Third Party Advisory

https://lists.debian.org/debian-lts-announce/2018/06/msg00009.html

Source: af854a3a-2127-422b-91ae-364da2661108

https://security.gentoo.org/glsa/201611-21

Source: af854a3a-2127-422b-91ae-364da2661108

https://www.exploit-db.com/exploits/39767/

Source: af854a3a-2127-422b-91ae-364da2661108

https://www.imagemagick.org/discourse-server/viewtopic.php?f=4&t=29588

Source: af854a3a-2127-422b-91ae-364da2661108

Vendor Advisory

https://www.imagemagick.org/script/changelog.php

Source: af854a3a-2127-422b-91ae-364da2661108

Vendor Advisory

Timeline

No history available yet.