CVE-2016-5118

Published: Jun 10, 2016Modified: May 6, 2026

9.8

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Exploitability: 3.9 / Impact: 5.9

Source: NVD

Description

The OpenBlob function in blob.c in GraphicsMagick before 1.3.24 and ImageMagick allows remote attackers to execute arbitrary code via a | (pipe) character at the start of a filename.

Affected (24)

Products: Graphicsmagick: Graphicsmagick · Suse: Linux Enterprise Debuginfo, Linux Enterprise Software Development Kit, Studio Onsite, Linux Enterprise Desktop, Linux Enterprise Server, Linux Enterprise Workstation Extension · Oracle: Solaris, Linux · +4 more

Show all products

Graphicsmagick

1 product

Graphicsmagick

Suse

6 products

Linux Enterprise Debuginfo

Linux Enterprise Software Development Kit

Studio Onsite

Linux Enterprise Desktop

Linux Enterprise Server

Linux Enterprise Workstation Extension

2 products

2 products

1 product

1 product

1 product

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Graphicsmagick Graphicsmagick	Up to 1.3.23

Configuration B

3 vulnerable

Vulnerable Software	Affected Versions
Suse Linux Enterprise Debuginfo	Version 11 sp4
Suse Linux Enterprise Software Development Kit	Version 11 sp4
Suse Studio Onsite	Version 1.3

Configuration C

2 vulnerable

Vulnerable Software	Affected Versions
Oracle Solaris	Version 10
Oracle Solaris	Version 11.3

Configuration D

2 vulnerable

Vulnerable Software	Affected Versions
Oracle Linux	Version 6
Oracle Linux	Version 7

Configuration E

2 vulnerable

Vulnerable Software	Affected Versions
Opensuse Leap	Version 42.1
Opensuse Opensuse	Version 13.2

Configuration F

4 vulnerable

Vulnerable Software	Affected Versions
Canonical Ubuntu Linux	Version 12.04
Canonical Ubuntu Linux	Version 14.04
Canonical Ubuntu Linux	Version 15.10
Canonical Ubuntu Linux	Version 16.04

Configuration G

1 vulnerable

Vulnerable Software	Affected Versions
Debian Debian Linux	Version 8.0

Configuration H

8 vulnerable

Vulnerable Software	Affected Versions
Suse Linux Enterprise Desktop	Version 12.0 sp1
Suse Linux Enterprise Desktop	Version 12
Suse Linux Enterprise Server	Version 12.0 sp1
Suse Linux Enterprise Server	Version 12
Suse Linux Enterprise Software Development Kit	Version 12.0 sp1
Suse Linux Enterprise Software Development Kit	Version 12
Suse Linux Enterprise Workstation Extension	Version 12
Suse Linux Enterprise Workstation Extension	Version 12 sp1

Configuration I

1 vulnerable

Vulnerable Software	Affected Versions
Imagemagick Imagemagick	Before 7.0.1-7

References (44)

http://git.imagemagick.org/repos/ImageMagick/commit/40639d173aa8c76b850d625c630b711fee4dcfb8

Source: cve@mitre.org

Broken LinkVendor Advisory

http://hg.code.sf.net/p/graphicsmagick/code/file/41876934e762/ChangeLog

Source: cve@mitre.org

Release NotesVendor Advisory

http://hg.code.sf.net/p/graphicsmagick/code/rev/ae3928faa858

Source: cve@mitre.org

Broken Link

http://lists.opensuse.org/opensuse-security-announce/2016-06/msg00008.html

Source: cve@mitre.org

Third Party Advisory

http://lists.opensuse.org/opensuse-security-announce/2016-06/msg00009.html

Source: cve@mitre.org

Third Party Advisory

http://lists.opensuse.org/opensuse-security-announce/2016-06/msg00011.html

Source: cve@mitre.org

Third Party Advisory

http://lists.opensuse.org/opensuse-security-announce/2016-06/msg00021.html

Source: cve@mitre.org

Third Party Advisory

http://lists.opensuse.org/opensuse-security-announce/2016-06/msg00030.html

Source: cve@mitre.org

Mailing ListThird Party Advisory

http://lists.opensuse.org/opensuse-security-announce/2016-06/msg00032.html

Source: cve@mitre.org

Third Party Advisory

http://lists.opensuse.org/opensuse-security-announce/2016-06/msg00047.html

Source: cve@mitre.org

Mailing ListThird Party Advisory

http://www.debian.org/security/2016/dsa-3591

Source: cve@mitre.org

Third Party Advisory

http://www.debian.org/security/2016/dsa-3746

Source: cve@mitre.org

Third Party Advisory

http://www.openwall.com/lists/oss-security/2016/05/29/7

Source: cve@mitre.org

Mailing ListRelease Notes

http://www.openwall.com/lists/oss-security/2016/05/30/1

Source: cve@mitre.org

Mailing ListThird Party Advisory

http://www.oracle.com/technetwork/topics/security/bulletinjul2016-3090568.html

Source: cve@mitre.org

Third Party Advisory

http://www.oracle.com/technetwork/topics/security/linuxbulletinapr2016-2952096.html

Source: cve@mitre.org

Third Party Advisory

http://www.securityfocus.com/bid/90938

Source: cve@mitre.org

Broken LinkThird Party AdvisoryVDB Entry

http://www.securitytracker.com/id/1035984

Source: cve@mitre.org

Third Party AdvisoryVDB Entry

http://www.securitytracker.com/id/1035985

Source: cve@mitre.org

Broken LinkThird Party AdvisoryVDB Entry

http://www.slackware.com/security/viewer.php?l=slackware-security&y=2016&m=slackware-security.397749

Source: cve@mitre.org

Third Party Advisory

http://www.ubuntu.com/usn/USN-2990-1

Source: cve@mitre.org

Third Party Advisory

https://access.redhat.com/errata/RHSA-2016:1237

Source: cve@mitre.org

Third Party Advisory

http://git.imagemagick.org/repos/ImageMagick/commit/40639d173aa8c76b850d625c630b711fee4dcfb8