CVE-2016-5118 The OpenBlob function in blob.c in GraphicsMagick before 1.3.24 and ImageMagick allows remote attackers to execute arbitrary code via a | (pipe) character at the start of a filename.
CriticalCVSS 9.8
EPSS 50.0%
- Published
- Updated
- Exploit status
- No public exploit known
Description
The OpenBlob function in blob.c in GraphicsMagick before 1.3.24 and ImageMagick allows remote attackers to execute arbitrary code via a | (pipe) character at the start of a filename.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| debian/graphicsmagick(Debian:12) | < 1.3.24-1 | 1.3.24-1 |
| debian/graphicsmagick(Debian:13) | < 1.3.24-1 | 1.3.24-1 |
| debian/graphicsmagick(Debian:14) | < 1.3.24-1 | 1.3.24-1 |
| debian/imagemagick(Debian:12) | < 8:6.8.9.9-7.1 | 8:6.8.9.9-7.1 |
| debian/imagemagick(Debian:13) | < 8:6.8.9.9-7.1 | 8:6.8.9.9-7.1 |
| debian/imagemagick(Debian:14) | < 8:6.8.9.9-7.1 | 8:6.8.9.9-7.1 |
| graphicsmagick | <= 1.3.23 | No fix listed |
| SUSE linux enterprise debuginfo | = 11-sp4 | No fix listed |
| SUSE studio onsite | = 1.3 | No fix listed |
| SUSE linux enterprise software development kit | = 11-sp4 | No fix listed |
| SUSE linux enterprise software development kit | = 12 | No fix listed |
| SUSE linux enterprise software development kit | = 12.0-sp1 | No fix listed |
| oracle solaris | = 10 | No fix listed |
| oracle solaris | = 11.3 | No fix listed |
| oracle linux | = 6 | No fix listed |
| oracle linux | = 7 | No fix listed |
| openSUSE leap | = 42.1 | No fix listed |
| opensuse | = 13.2 | No fix listed |
| Canonical Ubuntu Linux | = 12.04 | No fix listed |
| Canonical Ubuntu Linux | = 14.04 | No fix listed |
| Canonical Ubuntu Linux | = 15.10 | No fix listed |
| Canonical Ubuntu Linux | = 16.04 | No fix listed |
| debian linux | = 8.0 | No fix listed |
| SUSE linux enterprise desktop | = 12 | No fix listed |
| SUSE linux enterprise desktop | = 12.0-sp1 | No fix listed |
Show 7 more
| Product | Affected versions | Fixed in |
|---|---|---|
| SUSE linux enterprise server | = 12 | No fix listed |
| SUSE linux enterprise server | = 12.0-sp1 | No fix listed |
| SUSE linux enterprise workstation extension | = 12 | No fix listed |
| SUSE linux enterprise workstation extension | = 12-sp1 | No fix listed |
| ImageMagick | < 7.0.1-7 | 7.0.1-7 |
| alpine/imagemagick(Alpine:v3.2) | < 6.9.6.8-r0 | 6.9.6.8-r0 |
| alpine/imagemagick(Alpine:v3.3) | < 6.9.6.8-r0 | 6.9.6.8-r0 |
References
- Debian Security Tracker CVE-2016-5118 vendor-advisory
- git.imagemagick.org broken-link vendor-advisory
- hg.code.sf.net release-notes vendor-advisory
- hg.code.sf.net broken-link
- openSUSE-SU-2016:1521 third-party-advisory vendor-advisory
- openSUSE-SU-2016:1522 third-party-advisory vendor-advisory
- openSUSE-SU-2016:1534 third-party-advisory vendor-advisory
- SUSE-SU-2016:1570 third-party-advisory vendor-advisory
- SUSE-SU-2016:1610 mailing-list third-party-advisory vendor-advisory
- SUSE-SU-2016:1614 third-party-advisory vendor-advisory
- openSUSE-SU-2016:1653 mailing-list third-party-advisory vendor-advisory
- DSA-3591 third-party-advisory vendor-advisory
- DSA-3746 third-party-advisory vendor-advisory
- [oss-security] 20160529 CVE Request: GraphicsMagick and ImageMagick popen() shell vulnerability via filename mailing-list release-notes
- [oss-security] 20160529 Re: CVE Request: GraphicsMagick and ImageMagick popen() shell vulnerability via filename mailing-list third-party-advisory
- www.oracle.com third-party-advisory
- www.oracle.com third-party-advisory
- 90938 broken-link third-party-advisory vdb-entry
- 1035984 third-party-advisory vdb-entry
- 1035985 broken-link third-party-advisory vdb-entry
- SSA:2016-152-01 third-party-advisory vendor-advisory
- USN-2990-1 third-party-advisory vendor-advisory
- RHSA-2016:1237 third-party-advisory vendor-advisory
- security.alpinelinux.org vendor-advisory
- bugs.debian.org issue-tracking
- bugs.debian.org issue-tracking