CVE-2016-3717

Published: May 5, 2016Modified: May 6, 2026

5.5

Vector

CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Exploitability: 1.8 / Impact: 3.6

Source: NVD

Description

The LABEL coder in ImageMagick before 6.9.3-10 and 7.x before 7.0.1-1 allows remote attackers to read arbitrary files via a crafted image.

Affected (19)

Products: Canonical: Ubuntu Linux · Redhat: Enterprise Linux Desktop, Enterprise Linux Hpc Node, Enterprise Linux Hpc Node Eus, Enterprise Linux Server, Enterprise Linux Server Aus, Enterprise Linux Server Eus, Enterprise Linux Server Supplementary Eus, Enterprise Linux Workstation · Imagemagick: Imagemagick

1 product

8 products

Enterprise Linux Desktop

Enterprise Linux Hpc Node

Enterprise Linux Hpc Node Eus

Enterprise Linux Server

Enterprise Linux Server Aus

Enterprise Linux Server Eus

Enterprise Linux Server Supplementary Eus

Enterprise Linux Workstation

1 product

Configuration A

4 vulnerable

Vulnerable Software	Affected Versions
Canonical Ubuntu Linux	Version 12.04
Canonical Ubuntu Linux	Version 14.04
Canonical Ubuntu Linux	Version 15.10
Canonical Ubuntu Linux	Version 16.04

Configuration B

12 vulnerable

Vulnerable Software	Affected Versions
Redhat Enterprise Linux Desktop	Version 6.0
Redhat Enterprise Linux Desktop	Version 7.0
Redhat Enterprise Linux Hpc Node	Version 6.0
Redhat Enterprise Linux Hpc Node	Version 7.0
Redhat Enterprise Linux Hpc Node Eus	Version 7.2
Redhat Enterprise Linux Server	Version 6.0
Redhat Enterprise Linux Server	Version 7.0
Redhat Enterprise Linux Server Aus	Version 7.2
Redhat Enterprise Linux Server Eus	Version 7.2
Redhat Enterprise Linux Server Supplementary Eus	Version 6.7z
Redhat Enterprise Linux Workstation	Version 6.0
Redhat Enterprise Linux Workstation	Version 7.0

Configuration C

3 vulnerable

Vulnerable Software	Affected Versions
Imagemagick Imagemagick	Up to 6.9.3-9
Imagemagick Imagemagick	Version 7.0.0-0
Imagemagick Imagemagick	Version 7.0.1-0

Related CWEs

Exposure of Sensitive Information to an Unauthorized Actor

The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.

References (38)

http://git.imagemagick.org/repos/ImageMagick/blob/a01518e08c840577cabd7d3ff291a9ba735f7276/ChangeLog

Source: secalert@redhat.com

Patch

http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00024.html

Source: secalert@redhat.com

http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00025.html

Source: secalert@redhat.com

http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00028.html

Source: secalert@redhat.com

http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00032.html

Source: secalert@redhat.com

http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00051.html

Source: secalert@redhat.com

http://rhn.redhat.com/errata/RHSA-2016-0726.html

Source: secalert@redhat.com

Third Party Advisory

http://www.debian.org/security/2016/dsa-3580

Source: secalert@redhat.com

http://www.openwall.com/lists/oss-security/2016/05/03/18

Source: secalert@redhat.com

Mailing ListThird Party Advisory

http://www.oracle.com/technetwork/topics/security/bulletinjul2016-3090568.html

Source: secalert@redhat.com

http://www.oracle.com/technetwork/topics/security/linuxbulletinapr2016-2952096.html

Source: secalert@redhat.com

http://www.securityfocus.com/archive/1/538378/100/0/threaded

Source: secalert@redhat.com

http://www.slackware.com/security/viewer.php?l=slackware-security&y=2016&m=slackware-security.440568

Source: secalert@redhat.com

http://www.ubuntu.com/usn/USN-2990-1

Source: secalert@redhat.com

Third Party Advisory

https://lists.debian.org/debian-lts-announce/2018/06/msg00009.html

Source: secalert@redhat.com

https://security.gentoo.org/glsa/201611-21

Source: secalert@redhat.com

https://www.exploit-db.com/exploits/39767/

Source: secalert@redhat.com

https://www.imagemagick.org/discourse-server/viewtopic.php?f=4&t=29588

Source: secalert@redhat.com

Vendor Advisory

https://www.imagemagick.org/script/changelog.php

Source: secalert@redhat.com

http://git.imagemagick.org/repos/ImageMagick/blob/a01518e08c840577cabd7d3ff291a9ba735f7276/ChangeLog

Source: af854a3a-2127-422b-91ae-364da2661108

Patch

http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00024.html

Source: af854a3a-2127-422b-91ae-364da2661108

http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00025.html

Source: af854a3a-2127-422b-91ae-364da2661108

http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00028.html

Source: af854a3a-2127-422b-91ae-364da2661108

http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00032.html

Source: af854a3a-2127-422b-91ae-364da2661108

http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00051.html

Source: af854a3a-2127-422b-91ae-364da2661108

http://rhn.redhat.com/errata/RHSA-2016-0726.html

Source: af854a3a-2127-422b-91ae-364da2661108

Third Party Advisory

http://www.debian.org/security/2016/dsa-3580

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.openwall.com/lists/oss-security/2016/05/03/18

Source: af854a3a-2127-422b-91ae-364da2661108

Mailing ListThird Party Advisory

http://www.oracle.com/technetwork/topics/security/bulletinjul2016-3090568.html

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.oracle.com/technetwork/topics/security/linuxbulletinapr2016-2952096.html

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.securityfocus.com/archive/1/538378/100/0/threaded

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.slackware.com/security/viewer.php?l=slackware-security&y=2016&m=slackware-security.440568

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.ubuntu.com/usn/USN-2990-1

Source: af854a3a-2127-422b-91ae-364da2661108

Third Party Advisory

https://lists.debian.org/debian-lts-announce/2018/06/msg00009.html

Source: af854a3a-2127-422b-91ae-364da2661108

https://security.gentoo.org/glsa/201611-21

Source: af854a3a-2127-422b-91ae-364da2661108

https://www.exploit-db.com/exploits/39767/

Source: af854a3a-2127-422b-91ae-364da2661108

https://www.imagemagick.org/discourse-server/viewtopic.php?f=4&t=29588

Source: af854a3a-2127-422b-91ae-364da2661108

Vendor Advisory

https://www.imagemagick.org/script/changelog.php

Source: af854a3a-2127-422b-91ae-364da2661108

Timeline

No history available yet.