This update for ImageMagick fixes the following issues :

Security issues fixed :

  - Several coders were vulnerable to remote code execution     attacks, these coders have now been disabled by default     but can be re-enabled by editing     '/etc/ImageMagick-*/policy.xml' (bsc#978061)

  - CVE-2016-3714: Insufficient shell characters filtering     leads to (potentially remote) code execution

  - CVE-2016-3715: Possible file deletion by using     ImageMagick's 'ephemeral' pseudo protocol which deletes     files after reading.

  - CVE-2016-3716: Possible file moving by using     ImageMagick's 'msl' pseudo protocol with any extension     in any folder.

  - CVE-2016-3717: Possible local file read by using     ImageMagick's 'label' pseudo protocol to get content of     the files from the server.

  - CVE-2016-3718: Possible Server Side Request Forgery     (SSRF) to make HTTP GET or FTP request.

Bugs fixed :

  - Use external svg loader (rsvg)

This update was imported from the SUSE:SLE-12:Update update project.

Detections

Analytics

openSUSE Security Update : ImageMagick (openSUSE-2016-574) (ImageTragick)

high Nessus Plugin ID 90986

Version 2.17

Version 2.16

Version 2.15

Version 2.14

Version 2.17 Mar 15, 2025, 2:36 AM CISA reference Plugin Feed: 202503150236
Version 2.16 Mar 14, 2025, 3:40 AM CISA reference Plugin Feed: 202503140340
Version 2.15 Sep 10, 2024, 4:59 PM CISA reference Plugin Feed: 202409101659
Version 2.14 Sep 9, 2024, 10:05 PM CISA reference CVSSv2 score source (set to "CVE-2016-3714") Plugin Feed: 202409092205