Veracode Vulnerability DatabaseVERACODE:3373Remote Code Execution (RCE)
9.8 High
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
10 High
CVSS2
Access Vector
NETWORK
Access Complexity
LOW
Authentication
NONE
Confidentiality Impact
COMPLETE
Integrity Impact
COMPLETE
Availability Impact
COMPLETE
AV:N/AC:L/Au:N/C:C/I:C/A:C
ImageMagick is vulnerable to remote code execution (RCE) attacks. A malicious user can inject and execute arbitrary shellcode by appending a ‘|’ character in front of the filename of the image to be opened.
References
git.imagemagick.org/repos/ImageMagick/commit/40639d173aa8c76b850d625c630b711fee4dcfb8
hg.code.sf.net/p/graphicsmagick/code/file/41876934e762/ChangeLog
hg.code.sf.net/p/graphicsmagick/code/rev/ae3928faa858
lists.opensuse.org/opensuse-security-announce/2016-06/msg00008.html
lists.opensuse.org/opensuse-security-announce/2016-06/msg00009.html
lists.opensuse.org/opensuse-security-announce/2016-06/msg00011.html
lists.opensuse.org/opensuse-security-announce/2016-06/msg00021.html
lists.opensuse.org/opensuse-security-announce/2016-06/msg00030.html
lists.opensuse.org/opensuse-security-announce/2016-06/msg00032.html
lists.opensuse.org/opensuse-security-announce/2016-06/msg00047.html
www.debian.org/security/2016/dsa-3591
www.debian.org/security/2016/dsa-3746
www.openwall.com/lists/oss-security/2016/05/29/7
www.openwall.com/lists/oss-security/2016/05/30/1
www.oracle.com/technetwork/topics/security/bulletinjul2016-3090568.html
www.oracle.com/technetwork/topics/security/linuxbulletinapr2016-2952096.html
www.securityfocus.com/bid/90938
www.securitytracker.com/id/1035984
www.securitytracker.com/id/1035985
www.slackware.com/security/viewer.php?l=slackware-security&y=2016&m=slackware-security.397749
www.ubuntu.com/usn/USN-2990-1
access.redhat.com/errata/RHSA-2016:1237
bugzilla.redhat.com/show_bug.cgi?id=1340814
Related
9.8 High
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
10 High
CVSS2
Access Vector
NETWORK
Access Complexity
LOW
Authentication
NONE
Confidentiality Impact
COMPLETE
Integrity Impact
COMPLETE
Availability Impact
COMPLETE
AV:N/AC:L/Au:N/C:C/I:C/A:C