Detections
Analytics
Scientific Linux Security Update : ImageMagick on SL6.x, SL7.x i386/x86_64 (20160617)
critical Nessus Plugin ID 91712
Language:
Synopsis
The remote Scientific Linux host is missing one or more security updates.Description
Security Fix(es) :- It was discovered that ImageMagick did not properly sanitize certain input before using it to invoke processes. A remote attacker could create a specially crafted image that, when processed by an application using ImageMagick or an unsuspecting user using the ImageMagick utilities, would lead to arbitrary execution of shell commands with the privileges of the user running the application. (CVE-2016-5118)
- It was discovered that ImageMagick did not properly sanitize certain input before passing it to the gnuplot delegate functionality. A remote attacker could create a specially crafted image that, when processed by an application using ImageMagick or an unsuspecting user using the ImageMagick utilities, would lead to arbitrary execution of shell commands with the privileges of the user running the application. (CVE-2016-5239)
- Multiple flaws have been discovered in ImageMagick. A remote attacker could, for example, create specially crafted images that, when processed by an application using ImageMagick or an unsuspecting user using the ImageMagick utilities, would result in a memory corruption and, potentially, execution of arbitrary code, a denial of service, or an application crash.
(CVE-2015-8896, CVE-2015-8895, CVE-2016-5240, CVE-2015-8897, CVE-2015-8898)
Solution
Update the affected packages.See Also
Plugin Details
Severity: Critical
ID: 91712
File Name: sl_20160617_ImageMagick_on_SL6_x.nasl
Version: 2.5
Type: local
Agent: unix
Published: 6/20/2016
Updated: 1/14/2021
Supported Sensors: Nessus Agent, Nessus
Risk Information
VPR
Risk Factor: High
Score: 7.4
CVSS v2
Risk Factor: Critical
Base Score: 10
Vector: CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C
CVSS v3
Risk Factor: Critical
Base Score: 9.8
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Vulnerability Information
CPE: p-cpe:/a:fermilab:scientific_linux:imagemagick-c%2b%2b-devel, p-cpe:/a:fermilab:scientific_linux:imagemagick-perl, x-cpe:/o:fermilab:scientific_linux, p-cpe:/a:fermilab:scientific_linux:imagemagick-devel, p-cpe:/a:fermilab:scientific_linux:imagemagick-doc, p-cpe:/a:fermilab:scientific_linux:imagemagick, p-cpe:/a:fermilab:scientific_linux:imagemagick-c%2b%2b, p-cpe:/a:fermilab:scientific_linux:imagemagick-debuginfo
Required KB Items: Host/local_checks_enabled, Host/cpu, Host/RedHat/release, Host/RedHat/rpm-list
Patch Publication Date: 6/17/2016
Vulnerability Publication Date: 6/10/2016
Reference Information
CVE: CVE-2015-8895, CVE-2015-8896, CVE-2015-8897, CVE-2015-8898, CVE-2016-5118, CVE-2016-5239, CVE-2016-5240