Recent Vulnerabilities Research Posts Trends Blog About Contact

Related Vulnerabilities: CVE-2016-3714 CVE-2016-3715 CVE-2016-3716 CVE-2016-3717 CVE-2016-3718

It was discovered that ImageMagick did not properly sanitize certain input before passing it to the delegate functionality. A remote attacker could create a specially crafted image that, when processed by an application using ImageMagick or an unsuspecting user using the ImageMagick utilities, would lead to arbitrary execution of shell commands with the privileges of the user running the application. (CVE-2016-3714) It was discovered that certain ImageMagick coders and pseudo-protocols did not properly prevent security sensitive operations when processing specially crafted images. A remote attacker could create a specially crafted image that, when processed by an application using ImageMagick or an unsuspecting user using the ImageMagick utilities, would allow the attacker to disclose the contents of arbitrary files. (CVE-2016-3715, CVE-2016-3716, CVE-2016-3717) A server-side request forgery flaw was discovered in the way ImageMagick processed certain images. A remote attacker could exploit this flaw to mislead an application using ImageMagick or an unsuspecting user using the ImageMagick utilities into, for example, performing HTTP(S) requests or opening FTP sessions via specially crafted images. (CVE-2016-3718) Note: This update contains an updated /etc/ImageMagick/policy.xml file that disables the EPHEMERAL, HTTPS, HTTP, URL, FTP, MVG, MSL, TEXT, and LABEL coders. If you experience any problems after the update, it may be necessary to manually adjust the policy.xml file to match your requirements. Please take additional precautions to ensure that your applications using the ImageMagick library do not process malicious or untrusted files before doing so.

Source

ALAS-2016-699

Amazon Linux AMI Security Advisory: ALAS-2016-699
Advisory Release Date: 2016-05-11 11:00 Pacific
Advisory Updated Date: 2016-05-11 11:00 Pacific

Severity: Important

References: CVE-2016-3714 CVE-2016-3715 CVE-2016-3716 CVE-2016-3717 CVE-2016-3718

Issue Overview:

It was discovered that ImageMagick did not properly sanitize certain input before passing it to the delegate functionality. A remote attacker could create a specially crafted image that, when processed by an application using ImageMagick or an unsuspecting user using the ImageMagick utilities, would lead to arbitrary execution of shell commands with the privileges of the user running the application. (CVE-2016-3714)

It was discovered that certain ImageMagick coders and pseudo-protocols did not properly prevent security sensitive operations when processing specially crafted images. A remote attacker could create a specially crafted image that, when processed by an application using ImageMagick or an unsuspecting user using the ImageMagick utilities, would allow the attacker to disclose the contents of arbitrary files. (CVE-2016-3715, CVE-2016-3716, CVE-2016-3717)

A server-side request forgery flaw was discovered in the way ImageMagick processed certain images. A remote attacker could exploit this flaw to mislead an application using ImageMagick or an unsuspecting user using the ImageMagick utilities into, for example, performing HTTP(S) requests or opening FTP sessions via specially crafted images. (CVE-2016-3718)

Note: This update contains an updated /etc/ImageMagick/policy.xml file that disables the EPHEMERAL, HTTPS, HTTP, URL, FTP, MVG, MSL, TEXT, and LABEL coders. If you experience any problems after the update, it may be necessary to manually adjust the policy.xml file to match your requirements. Please take additional precautions to ensure that your applications using the ImageMagick library do not process malicious or untrusted files before doing so.

Affected Packages:

ImageMagick

Issue Correction:
Run yum update ImageMagick to update your system.

New Packages:

i686:
    ImageMagick-doc-6.7.8.9-13.19.amzn1.i686
    ImageMagick-perl-6.7.8.9-13.19.amzn1.i686
    ImageMagick-c++-6.7.8.9-13.19.amzn1.i686
    ImageMagick-6.7.8.9-13.19.amzn1.i686
    ImageMagick-debuginfo-6.7.8.9-13.19.amzn1.i686
    ImageMagick-devel-6.7.8.9-13.19.amzn1.i686
    ImageMagick-c++-devel-6.7.8.9-13.19.amzn1.i686

src:
    ImageMagick-6.7.8.9-13.19.amzn1.src

x86_64:
    ImageMagick-debuginfo-6.7.8.9-13.19.amzn1.x86_64
    ImageMagick-6.7.8.9-13.19.amzn1.x86_64
    ImageMagick-c++-6.7.8.9-13.19.amzn1.x86_64
    ImageMagick-devel-6.7.8.9-13.19.amzn1.x86_64
    ImageMagick-c++-devel-6.7.8.9-13.19.amzn1.x86_64
    ImageMagick-doc-6.7.8.9-13.19.amzn1.x86_64
    ImageMagick-perl-6.7.8.9-13.19.amzn1.x86_64

Vulmon Search is a vulnerability search engine. It gives comprehensive vulnerability information through a very simple user interface.

Home Recent Vulnerabilities Research Posts Trends Blog About Contact

Vulmon Search Vulmon Research Vulmon Alerts Vulmap

Twitter Reddit Linkedin Facebook

ALAS-2016-699

ALAS-2016-699

Vulmon Search

About

Products

Connect