Security Fix(es) :

  - It was discovered that ImageMagick did not properly     sanitize certain input before passing it to the delegate     functionality. A remote attacker could create a     specially crafted image that, when processed by an     application using ImageMagick or an unsuspecting user     using the ImageMagick utilities, would lead to arbitrary     execution of shell commands with the privileges of the     user running the application. (CVE-2016-3714)

  - It was discovered that certain ImageMagick coders and     pseudo-protocols did not properly prevent security     sensitive operations when processing specially crafted     images. A remote attacker could create a specially     crafted image that, when processed by an application     using ImageMagick or an unsuspecting user using the     ImageMagick utilities, would allow the attacker to     delete, move, or disclose the contents of arbitrary     files. (CVE-2016-3715, CVE-2016-3716, CVE-2016-3717)

  - A server-side request forgery flaw was discovered in the     way ImageMagick processed certain images. A remote     attacker could exploit this flaw to mislead an     application using ImageMagick or an unsuspecting user     using the ImageMagick utilities into, for example,     performing HTTP(S) requests or opening FTP sessions via     specially crafted images. (CVE-2016-3718)

Note: This update contains an updated /etc/ImageMagick/policy.xml file that disables the EPHEMERAL, HTTPS, HTTP, URL, FTP, MVG, MSL, TEXT, and LABEL coders. If you experience any problems after the update, it may be necessary to manually adjust the policy.xml file to match your requirements. Please take additional precautions to ensure that your applications using the ImageMagick library do not process malicious or untrusted files before doing so.

Detections

Analytics

Scientific Linux Security Update : ImageMagick on SL6.x, SL7.x i386/x86_64 (20160509) (ImageTragick)

high Nessus Plugin ID 91039

Version 2.16

Version 2.15

Version 2.16 Sep 10, 2024, 4:59 PM CISA reference Plugin Feed: 202409101659
Version 2.15 Sep 9, 2024, 10:05 PM CISA reference CVSSv2 score source (set to "CVE-2016-3714") Plugin Feed: 202409092205