The remote host is missing an update for the Debian 'imagemagick' package(s) announced via the DLA-500-1 advisory. It removes the possibility of using pipe in filenames to interact with imagemagick
Reporter | Title | Published | Views | Family All 100 |
---|---|---|---|---|
![]() | CVE-2016-5118 | 10 Jun 201615:59 | – | cve |
![]() | Security fix for the ALT Linux 6 package ImageMagick version 6.6.9.7-alt0.M60P.1 | 11 Jun 201600:00 | – | altlinux |
![]() | Security fix for the ALT Linux 7 package ImageMagick version 6.8.4.10-alt3.M70P.2 | 6 Jun 201600:00 | – | altlinux |
![]() | CVE-2016-5118 | 10 Jun 201615:00 | – | cvelist |
![]() | [SECURITY] [DSA 3591-1] imagemagick security update | 1 Jun 201610:39 | – | debian |
![]() | [SECURITY] [DLA 502-1] graphicsmagick security update | 2 Jun 201609:05 | – | debian |
![]() | [SECURITY] [DSA 3591-1] imagemagick security update | 1 Jun 201610:39 | – | debian |
![]() | [SECURITY] [DLA 500-1] imagemagick security update | 2 Jun 201616:19 | – | debian |
![]() | [SECURITY] [DSA 3746-1] graphicsmagick security update | 24 Dec 201622:03 | – | debian |
![]() | [SECURITY] [DSA 3746-1] graphicsmagick security update | 24 Dec 201622:03 | – | debian |
Source | Link |
---|---|
wiki | www.wiki.debian.org/LTS |
debian | www.debian.org/lts/security/2016/DLA-500-1 |
# SPDX-FileCopyrightText: 2023 Greenbone AG
# Some text descriptions might be excerpted from (a) referenced
# source(s), and are Copyright (C) by the respective right holder(s).
#
# SPDX-License-Identifier: GPL-2.0-only
if(description)
{
script_oid("1.3.6.1.4.1.25623.1.1.1.2.2016.500");
script_cve_id("CVE-2016-5118");
script_tag(name:"creation_date", value:"2023-03-08 12:56:44 +0000 (Wed, 08 Mar 2023)");
script_version("2024-02-02T05:06:10+0000");
script_tag(name:"last_modification", value:"2024-02-02 05:06:10 +0000 (Fri, 02 Feb 2024)");
script_tag(name:"cvss_base", value:"10.0");
script_tag(name:"cvss_base_vector", value:"AV:N/AC:L/Au:N/C:C/I:C/A:C");
script_tag(name:"severity_vector", value:"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H");
script_tag(name:"severity_origin", value:"NVD");
script_tag(name:"severity_date", value:"2016-06-13 17:56:34 +0000 (Mon, 13 Jun 2016)");
script_name("Debian: Security Advisory (DLA-500-1)");
script_category(ACT_GATHER_INFO);
script_copyright("Copyright (C) 2023 Greenbone AG");
script_family("Debian Local Security Checks");
script_dependencies("gather-package-list.nasl");
script_mandatory_keys("ssh/login/debian_linux", "ssh/login/packages", re:"ssh/login/release=DEB7");
script_xref(name:"Advisory-ID", value:"DLA-500-1");
script_xref(name:"URL", value:"https://www.debian.org/lts/security/2016/DLA-500-1");
script_xref(name:"URL", value:"https://wiki.debian.org/LTS");
script_tag(name:"summary", value:"The remote host is missing an update for the Debian 'imagemagick' package(s) announced via the DLA-500-1 advisory.");
script_tag(name:"vuldetect", value:"Checks if a vulnerable package version is present on the target host.");
script_tag(name:"insight", value:"Bob Friesenhahn from the GraphicsMagick project discovered a command injection vulnerability in ImageMagick, a program suite for image manipulation. An attacker with control on input image or the input filename can execute arbitrary commands with the privileges of the user running the application.
This update removes the possibility of using pipe (<pipe>) in filenames to interact with imagemagick.
It is important that you upgrade the libmagickcore5 and not just the imagemagick package. Applications using libmagickcore5 might also be affected and need to be restarted after the upgrade.
For Debian 7 Wheezy, these problems have been fixed in version 8:6.7.7.10-5+deb7u6.
We recommend that you upgrade your imagemagick packages.
Further information about Debian LTS security advisories, how to apply these updates to your system and frequently asked questions can be found at: [link moved to references]");
script_tag(name:"affected", value:"'imagemagick' package(s) on Debian 7.");
script_tag(name:"solution", value:"Please install the updated package(s).");
script_tag(name:"solution_type", value:"VendorFix");
script_tag(name:"qod_type", value:"package");
exit(0);
}
include("revisions-lib.inc");
include("pkg-lib-deb.inc");
release = dpkg_get_ssh_release();
if(!release)
exit(0);
res = "";
report = "";
if(release == "DEB7") {
if(!isnull(res = isdpkgvuln(pkg:"imagemagick", ver:"8:6.7.7.10-5+deb7u6", rls:"DEB7"))) {
report += res;
}
if(!isnull(res = isdpkgvuln(pkg:"imagemagick-common", ver:"8:6.7.7.10-5+deb7u6", rls:"DEB7"))) {
report += res;
}
if(!isnull(res = isdpkgvuln(pkg:"imagemagick-dbg", ver:"8:6.7.7.10-5+deb7u6", rls:"DEB7"))) {
report += res;
}
if(!isnull(res = isdpkgvuln(pkg:"imagemagick-doc", ver:"8:6.7.7.10-5+deb7u6", rls:"DEB7"))) {
report += res;
}
if(!isnull(res = isdpkgvuln(pkg:"libmagick++-dev", ver:"8:6.7.7.10-5+deb7u6", rls:"DEB7"))) {
report += res;
}
if(!isnull(res = isdpkgvuln(pkg:"libmagick++5", ver:"8:6.7.7.10-5+deb7u6", rls:"DEB7"))) {
report += res;
}
if(!isnull(res = isdpkgvuln(pkg:"libmagickcore-dev", ver:"8:6.7.7.10-5+deb7u6", rls:"DEB7"))) {
report += res;
}
if(!isnull(res = isdpkgvuln(pkg:"libmagickcore5", ver:"8:6.7.7.10-5+deb7u6", rls:"DEB7"))) {
report += res;
}
if(!isnull(res = isdpkgvuln(pkg:"libmagickcore5-extra", ver:"8:6.7.7.10-5+deb7u6", rls:"DEB7"))) {
report += res;
}
if(!isnull(res = isdpkgvuln(pkg:"libmagickwand-dev", ver:"8:6.7.7.10-5+deb7u6", rls:"DEB7"))) {
report += res;
}
if(!isnull(res = isdpkgvuln(pkg:"libmagickwand5", ver:"8:6.7.7.10-5+deb7u6", rls:"DEB7"))) {
report += res;
}
if(!isnull(res = isdpkgvuln(pkg:"perlmagick", ver:"8:6.7.7.10-5+deb7u6", rls:"DEB7"))) {
report += res;
}
if(report != "") {
security_message(data:report);
} else if(__pkg_match) {
exit(99);
}
exit(0);
}
exit(0);
Transform Your Security Services
Elevate your offerings with Vulners' advanced Vulnerability Intelligence. Contact us for a demo and discover the difference comprehensive, actionable intelligence can make in your security strategy.
Book a live demo