CVE-2016-3714 The (1) EPHEMERAL, (2) HTTPS, (3) MVG, (4) MSL, (5) TEXT, (6) SHOW, (7) WIN, and (8) PLT coders in ImageMagick before 6.9.3-10 and 7.x before 7.0.1-1 allow remote attackers to execute arbitrary code v...
HighCVSS 8.4
EPSS 97.5%
CISA KEV
added 2024-09-09 · due 2024-09-30
Exploited in the wild
Framework module
Public exploit
PoC
- Published
- Updated
- Exploit status
- Exploited in the wild (confirmed)
Description
The (1) EPHEMERAL, (2) HTTPS, (3) MVG, (4) MSL, (5) TEXT, (6) SHOW, (7) WIN, and (8) PLT coders in ImageMagick before 6.9.3-10 and 7.x before 7.0.1-1 allow remote attackers to execute arbitrary code via shell metacharacters in a crafted image, aka "ImageTragick."
CISA Known Exploited Vulnerability
- Date added
- 2024-09-09
- Due date (FCEB)
- 2024-09-30
- Ransomware use
- Unknown
Required action
Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| debian/graphicsmagick(Debian:12) | < 1.3.24-1 | 1.3.24-1 |
| debian/graphicsmagick(Debian:13) | < 1.3.24-1 | 1.3.24-1 |
| debian/graphicsmagick(Debian:14) | < 1.3.24-1 | 1.3.24-1 |
| debian/imagemagick(Debian:12) | < 8:6.9.6.2+dfsg-2 | 8:6.9.6.2+dfsg-2 |
| debian/imagemagick(Debian:13) | < 8:6.9.6.2+dfsg-2 | 8:6.9.6.2+dfsg-2 |
| debian/imagemagick(Debian:14) | < 8:6.9.6.2+dfsg-2 | 8:6.9.6.2+dfsg-2 |
| ImageMagick | <= 6.9.3-9 | No fix listed |
| ImageMagick | = 7.0.0-0 | No fix listed |
| ImageMagick | = 7.0.1-0 | No fix listed |
| Canonical Ubuntu Linux | = 12.04 | No fix listed |
| Canonical Ubuntu Linux | = 14.04 | No fix listed |
| Canonical Ubuntu Linux | = 15.10 | No fix listed |
| Canonical Ubuntu Linux | = 16.04 | No fix listed |
| debian linux | = 8.0 | No fix listed |
| debian linux | = 9.0 | No fix listed |
| openSUSE leap | = 42.1 | No fix listed |
| opensuse | = 13.2 | No fix listed |
| suse linux enterprise server | = 12 | No fix listed |
References
- Debian Security Tracker CVE-2016-3714 vendor-advisory
- git.imagemagick.org patch
- SUSE-SU-2016:1260 third-party-advisory vendor-advisory
- openSUSE-SU-2016:1261 third-party-advisory vendor-advisory
- openSUSE-SU-2016:1266 third-party-advisory vendor-advisory
- SUSE-SU-2016:1275 third-party-advisory vendor-advisory
- SUSE-SU-2016:1301 third-party-advisory vendor-advisory
- openSUSE-SU-2016:1326 third-party-advisory vendor-advisory
- packetstormsecurity.com third-party-advisory vdb-entry
- RHSA-2016:0726 third-party-advisory vendor-advisory
- DSA-3580 third-party-advisory vendor-advisory
- DSA-3746 third-party-advisory vendor-advisory
- [oss-security] 20160503 ImageMagick Is On Fire -- CVE-2016-3714 mailing-list
- [oss-security] 20160504 Re: ImageMagick Is On Fire -- CVE-2016-3714 mailing-list
- www.oracle.com third-party-advisory
- www.oracle.com third-party-advisory
- www.rapid7.com third-party-advisory
- 20160513 May 2016 - HipChat Server - Critical Security Advisory mailing-list third-party-advisory vdb-entry
- 89848 third-party-advisory vdb-entry
- 1035742 third-party-advisory vdb-entry
- SSA:2016-132-01 third-party-advisory vendor-advisory
- USN-2990-1 third-party-advisory vendor-advisory
- access.redhat.com third-party-advisory
- bugzilla.redhat.com issue-tracking
- imagetragick.com vendor-advisory
- GLSA-201611-21 third-party-advisory vendor-advisory
- 39767 exploit third-party-advisory vdb-entry
- 39791 exploit third-party-advisory vdb-entry
- www.imagemagick.org vendor-advisory
- www.imagemagick.org vendor-advisory
- VU#250519 third-party-advisory us-government-resource
- www.cisa.gov government-resource us-government-resource