CVE-2016-5239 The gnuplot delegate functionality in ImageMagick before 6.9.4-0 and GraphicsMagick allows remote attackers to execute arbitrary commands via unspecified vectors.
CriticalCVSS 9.8
EPSS 3.2%
- Published
- Updated
- Exploit status
- No public exploit known
Description
The gnuplot delegate functionality in ImageMagick before 6.9.4-0 and GraphicsMagick allows remote attackers to execute arbitrary commands via unspecified vectors.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| debian/graphicsmagick(Debian:12) | < 1.3.24-1 | 1.3.24-1 |
| debian/graphicsmagick(Debian:13) | < 1.3.24-1 | 1.3.24-1 |
| debian/graphicsmagick(Debian:14) | < 1.3.24-1 | 1.3.24-1 |
| debian/imagemagick(Debian:12) | < 8:6.9.6.2+dfsg-2 | 8:6.9.6.2+dfsg-2 |
| debian/imagemagick(Debian:13) | < 8:6.9.6.2+dfsg-2 | 8:6.9.6.2+dfsg-2 |
| debian/imagemagick(Debian:14) | < 8:6.9.6.2+dfsg-2 | 8:6.9.6.2+dfsg-2 |
| ImageMagick | <= 6.9.3-9 | No fix listed |
References
- Debian Security Tracker CVE-2016-5239 vendor-advisory
- git.imagemagick.org issue-tracking patch third-party-advisory
- [oss-security] 20160602 Re: ImageMagick CVEs mailing-list patch third-party-advisory
- www.oracle.com
- 91018 third-party-advisory vdb-entry
- RHSA-2016:1237 vendor-advisory
- [debian-lts-announce] 20180803 [SECURITY] [DLA 1456-1] graphicsmagick security update mailing-list