The remote Ubuntu 14.04 LTS / 16.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-2990-1 advisory.

    Nikolay Ermishkin and Stewie discovered that ImageMagick incorrectly sanitized untrusted input. A remote     attacker could use these issues to execute arbitrary code. These issues are known as ImageTragick. This     update disables problematic coders via the /etc/ImageMagick-6/policy.xml configuration file. In certain     environments the coders may need to be manually re-enabled after making sure that ImageMagick does not     process untrusted input. (CVE-2016-3714, CVE-2016-3715, CVE-2016-3716, CVE-2016-3717, CVE-2016-3718)

    Bob Friesenhahn discovered that ImageMagick allowed injecting commands via an image file or filename. A     remote attacker could use this issue to execute arbitrary code. (CVE-2016-5118)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Detections

Analytics

Ubuntu 14.04 LTS / 16.04 LTS : ImageMagick vulnerabilities (USN-2990-1)

critical Nessus Plugin ID 91450

Version 2.18

Version 2.17

Version 2.16

Version 2.15

Version 2.13

Version 2.18 Mar 15, 2025, 2:36 AM CISA reference Plugin Feed: 202503150236
Version 2.17 Mar 14, 2025, 3:40 AM CISA reference Plugin Feed: 202503140340
Version 2.16 Sep 10, 2024, 4:59 PM CISA reference Plugin Feed: 202409101659
Version 2.15 Sep 9, 2024, 10:05 PM CISA reference Plugin Feed: 202409092205
Version 2.13 Oct 21, 2023, 3:09 AM CVSSv2 score source (set to "CVE-2016-5118") Detection Plugin metadata Plugin Feed: 202310210309