Published: 10/06/2016 Updated: 01/08/2023

CVSS v2 Base Score: 10 | Impact Score: 10 | Exploitability Score: 10

CVSS v3 Base Score: 9.8 | Impact Score: 5.9 | Exploitability Score: 3.9

VMScore: 890

Vector: AV:N/AC:L/Au:N/C:C/I:C/A:C

The OpenBlob function in blob.c in GraphicsMagick prior to 1.3.24 and ImageMagick allows remote malicious users to execute arbitrary code via a | (pipe) character at the start of a filename.

Vulnerable Product	Search on Vulmon	Subscribe to Product
graphicsmagick graphicsmagick
suse studio onsite 1.3
suse linux enterprise software development kit 11
suse linux enterprise debuginfo 11
oracle solaris 11.3
oracle solaris 10
oracle linux 6
oracle linux 7
opensuse leap 42.1
opensuse opensuse 13.2
canonical ubuntu linux 12.04
canonical ubuntu linux 16.04
canonical ubuntu linux 15.10
canonical ubuntu linux 14.04
debian debian linux 8.0
suse linux enterprise desktop 12.0
suse linux enterprise software development kit 12.0
suse linux enterprise server 12.0
suse linux enterprise workstation extension 12
suse linux enterprise server 12
suse linux enterprise software development kit 12
suse linux enterprise desktop 12
imagemagick imagemagick -

Several security issues were fixed in ImageMagick ...

Bob Friesenhahn from the GraphicsMagick project discovered a command injection vulnerability in ImageMagick, a program suite for image manipulation An attacker with control on input image or the input filename can execute arbitrary commands with the privileges of the user running the application This update removes the possibility of using pipe ...

Debian Bug report logs - #825799 imagemagick: CVE-2016-5118 Package: src:imagemagick; Maintainer for src:imagemagick is ImageMagick Packaging Team <pkg-gmagick-im-team@listsaliothdebianorg>; Reported by: Salvatore Bonaccorso <carnil@debianorg> Date: Mon, 30 May 2016 05:33:01 UTC Severity: grave Tags: patch, secur ...

Debian Bug report logs - #814732 graphicsmagick: SVG parsing issues (CVE-2016-2317, CVE-2016-2318) Package: src:graphicsmagick; Maintainer for src:graphicsmagick is Laszlo Boszormenyi (GCS) <gcs@debianorg>; Reported by: Salvatore Bonaccorso <carnil@debianorg> Date: Sun, 14 Feb 2016 19:27:01 UTC Severity: important ...

It was discovered that GraphicsMagick did not properly sanitize certain input before using it to invoke processes A remote attacker could create a specially crafted image that, when processed by an application using GraphicsMagick or an unsuspecting user using the GraphicsMagick utilities, would lead to arbitrary execution of shell commands with t ...

It was discovered that ImageMagick did not properly sanitize certain input before using it to invoke processes A remote attacker could create a specially crafted image that, when processed by an application using ImageMagick or an unsuspecting user using the ImageMagick utilities, would lead to arbitrary execution of shell commands with the privil ...

NVD-CWE-noinfo http://lists.opensuse.org/opensuse-security-announce/2016-06/msg00008.html http://www.securitytracker.com/id/1035985 http://lists.opensuse.org/opensuse-security-announce/2016-06/msg00009.html http://www.debian.org/security/2016/dsa-3591 http://www.openwall.com/lists/oss-security/2016/05/29/7 http://git.imagemagick.org/repos/ImageMagick/commit/40639d173aa8c76b850d625c630b711fee4dcfb8 http://hg.code.sf.net/p/graphicsmagick/code/rev/ae3928faa858 http://lists.opensuse.org/opensuse-security-announce/2016-06/msg00011.html http://www.securitytracker.com/id/1035984 http://hg.code.sf.net/p/graphicsmagick/code/file/41876934e762/ChangeLog http://www.openwall.com/lists/oss-security/2016/05/30/1 http://lists.opensuse.org/opensuse-security-announce/2016-06/msg00021.html http://www.slackware.com/security/viewer.php?l=slackware-security&y=2016&m=slackware-security.397749 http://www.ubuntu.com/usn/USN-2990-1 http://lists.opensuse.org/opensuse-security-announce/2016-06/msg00032.html http://www.oracle.com/technetwork/topics/security/bulletinjul2016-3090568.html http://www.oracle.com/technetwork/topics/security/linuxbulletinapr2016-2952096.html http://lists.opensuse.org/opensuse-security-announce/2016-06/msg00047.html http://lists.opensuse.org/opensuse-security-announce/2016-06/msg00030.html http://www.securityfocus.com/bid/90938 http://www.debian.org/security/2016/dsa-3746 https://access.redhat.com/errata/RHSA-2016:1237 https://nvd.nist.gov https://usn.ubuntu.com/2990-1/

CVE-2016-5118

Vulnerability Summary

Vendor Advisories

References

Vulmon Search

About

Products

Connect