CVE-2016-3718 The (1) HTTP and (2) FTP coders in ImageMagick before 6.9.3-10 and 7.x before 7.0.1-1 allow remote attackers to conduct server-side request forgery (SSRF) attacks via a crafted image.
MediumCVSS 5.5
EPSS 75.6%
CISA KEV
added 2021-11-03 · due 2022-05-03
Exploited in the wild
- Published
- Updated
- Exploit status
- Exploited in the wild (confirmed)
Description
The (1) HTTP and (2) FTP coders in ImageMagick before 6.9.3-10 and 7.x before 7.0.1-1 allow remote attackers to conduct server-side request forgery (SSRF) attacks via a crafted image.
CISA Known Exploited Vulnerability
- Date added
- 2021-11-03
- Due date (FCEB)
- 2022-05-03
- Ransomware use
- Unknown
Required action
Apply updates per vendor instructions.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| debian/graphicsmagick(Debian:12) | < 1.3.24-1 | 1.3.24-1 |
| debian/graphicsmagick(Debian:13) | < 1.3.24-1 | 1.3.24-1 |
| debian/graphicsmagick(Debian:14) | < 1.3.24-1 | 1.3.24-1 |
| debian/imagemagick(Debian:12) | < 8:6.9.6.2+dfsg-2 | 8:6.9.6.2+dfsg-2 |
| debian/imagemagick(Debian:13) | < 8:6.9.6.2+dfsg-2 | 8:6.9.6.2+dfsg-2 |
| debian/imagemagick(Debian:14) | < 8:6.9.6.2+dfsg-2 | 8:6.9.6.2+dfsg-2 |
| redhat enterprise linux desktop | = 6.0 | No fix listed |
| redhat enterprise linux desktop | = 7.0 | No fix listed |
| redhat enterprise linux eus | = 6.7 | No fix listed |
| redhat enterprise linux eus | = 7.2 | No fix listed |
| redhat enterprise linux eus | = 7.3 | No fix listed |
| redhat enterprise linux eus | = 7.4 | No fix listed |
| redhat enterprise linux eus | = 7.5 | No fix listed |
| redhat enterprise linux eus | = 7.6 | No fix listed |
| redhat enterprise linux eus | = 7.7 | No fix listed |
| redhat enterprise linux for ibm z systems | = 6.0_s390x | No fix listed |
| redhat enterprise linux for ibm z systems | = 7.0_s390x | No fix listed |
| redhat enterprise linux for ibm z systems eus | = 6.7_s390x | No fix listed |
| redhat enterprise linux for ibm z systems eus | = 7.2_s390x | No fix listed |
| redhat enterprise linux for ibm z systems eus | = 7.3_s390x | No fix listed |
| redhat enterprise linux for ibm z systems eus | = 7.4_s390x | No fix listed |
| redhat enterprise linux for ibm z systems eus | = 7.5_s390x | No fix listed |
| redhat enterprise linux for ibm z systems eus | = 7.6_s390x | No fix listed |
| redhat enterprise linux for ibm z systems eus | = 7.7_s390x | No fix listed |
| redhat enterprise linux for power big endian | = 6.0_ppc64 | No fix listed |
Show 65 more
| Product | Affected versions | Fixed in |
|---|---|---|
| redhat enterprise linux for power big endian | = 7.0_ppc64 | No fix listed |
| redhat enterprise linux for power big endian eus | = 6.7_ppc64 | No fix listed |
| redhat enterprise linux for power big endian eus | = 7.2_ppc64 | No fix listed |
| redhat enterprise linux for power big endian eus | = 7.3_ppc64 | No fix listed |
| redhat enterprise linux for power big endian eus | = 7.4_ppc64 | No fix listed |
| redhat enterprise linux for power big endian eus | = 7.5_ppc64 | No fix listed |
| redhat enterprise linux for power big endian eus | = 7.6_ppc64 | No fix listed |
| redhat enterprise linux for power big endian eus | = 7.7_ppc64 | No fix listed |
| redhat enterprise linux for power little endian | = 7.0_ppc64le | No fix listed |
| redhat enterprise linux for power little endian eus | = 7.2_ppc64le | No fix listed |
| redhat enterprise linux for power little endian eus | = 7.3_ppc64le | No fix listed |
| redhat enterprise linux for power little endian eus | = 7.4_ppc64le | No fix listed |
| redhat enterprise linux for power little endian eus | = 7.5_ppc64le | No fix listed |
| redhat enterprise linux for power little endian eus | = 7.6_ppc64le | No fix listed |
| redhat enterprise linux for power little endian eus | = 7.7_ppc64le | No fix listed |
| redhat enterprise linux hpc node | = 6.0 | No fix listed |
| redhat enterprise linux hpc node | = 7.0 | No fix listed |
| redhat enterprise linux hpc node eus | = 7.2 | No fix listed |
| redhat enterprise linux server | = 6.0 | No fix listed |
| redhat enterprise linux server | = 7.0 | No fix listed |
| redhat enterprise linux server aus | = 7.2 | No fix listed |
| redhat enterprise linux server aus | = 7.3 | No fix listed |
| redhat enterprise linux server aus | = 7.4 | No fix listed |
| redhat enterprise linux server aus | = 7.6 | No fix listed |
| redhat enterprise linux server aus | = 7.7 | No fix listed |
| redhat enterprise linux server from rhui | = 6.0 | No fix listed |
| redhat enterprise linux server from rhui | = 7.0 | No fix listed |
| redhat enterprise linux server supplementary eus | = 6.7z | No fix listed |
| redhat enterprise linux server tus | = 7.2 | No fix listed |
| redhat enterprise linux server tus | = 7.3 | No fix listed |
| redhat enterprise linux server tus | = 7.6 | No fix listed |
| redhat enterprise linux server tus | = 7.7 | No fix listed |
| redhat enterprise linux workstation | = 6.0 | No fix listed |
| redhat enterprise linux workstation | = 7.0 | No fix listed |
| ImageMagick | < 6.9.3-10 | 6.9.3-10 |
| ImageMagick | = 7.0.0-0 | No fix listed |
| ImageMagick | = 7.0.1-0 | No fix listed |
| Canonical Ubuntu Linux | = 12.04 | No fix listed |
| Canonical Ubuntu Linux | = 14.04 | No fix listed |
| Canonical Ubuntu Linux | = 15.10 | No fix listed |
| Canonical Ubuntu Linux | = 16.04 | No fix listed |
| oracle linux | = 6 | No fix listed |
| oracle linux | = 7 | No fix listed |
| oracle solaris | = 10 | No fix listed |
| oracle solaris | = 11.3 | No fix listed |
| SUSE linux enterprise debuginfo | = 11-sp2 | No fix listed |
| SUSE linux enterprise debuginfo | = 11-sp3 | No fix listed |
| SUSE linux enterprise debuginfo | = 11-sp4 | No fix listed |
| SUSE manager | = 2.1 | No fix listed |
| SUSE manager proxy | = 2.1 | No fix listed |
| SUSE openstack cloud | = 5 | No fix listed |
| openSUSE leap | = 42.1 | No fix listed |
| opensuse | = 13.2 | No fix listed |
| SUSE linux enterprise desktop | = 12 | No fix listed |
| SUSE linux enterprise desktop | = 12-sp1 | No fix listed |
| SUSE linux enterprise server | = 11-sp2 | No fix listed |
| SUSE linux enterprise server | = 11-sp3 | No fix listed |
| SUSE linux enterprise server | = 11-sp4 | No fix listed |
| SUSE linux enterprise server | = 12 | No fix listed |
| SUSE linux enterprise server | = 12-sp1 | No fix listed |
| SUSE linux enterprise software development kit | = 11-sp4 | No fix listed |
| SUSE linux enterprise software development kit | = 12 | No fix listed |
| SUSE linux enterprise software development kit | = 12-sp1 | No fix listed |
| SUSE linux enterprise workstation extension | = 12 | No fix listed |
| SUSE linux enterprise workstation extension | = 12-sp1 | No fix listed |
References
- Debian Security Tracker CVE-2016-3718 vendor-advisory
- git.imagemagick.org patch vendor-advisory
- SUSE-SU-2016:1260 third-party-advisory vendor-advisory
- openSUSE-SU-2016:1261 third-party-advisory vendor-advisory
- openSUSE-SU-2016:1266 third-party-advisory vendor-advisory
- SUSE-SU-2016:1275 third-party-advisory vendor-advisory
- openSUSE-SU-2016:1326 third-party-advisory vendor-advisory
- RHSA-2016:0726 third-party-advisory vendor-advisory
- DSA-3580 mailing-list third-party-advisory vendor-advisory
- [oss-security] 20160504 Re: ImageMagick Is On Fire -- CVE-2016-3714 mailing-list third-party-advisory
- www.oracle.com third-party-advisory
- www.oracle.com third-party-advisory
- 20160513 May 2016 - HipChat Server - Critical Security Advisory broken-link mailing-list third-party-advisory vdb-entry
- SSA:2016-132-01 third-party-advisory vendor-advisory
- USN-2990-1 third-party-advisory vendor-advisory
- [debian-lts-announce] 20180627 [SECURITY] [DLA 1401-1] graphicsmagick security update mailing-list third-party-advisory
- GLSA-201611-21 third-party-advisory vendor-advisory
- 39767 exploit third-party-advisory vdb-entry
- www.imagemagick.org vendor-advisory
- www.imagemagick.org release-notes
- www.cisa.gov government-resource us-government-resource