vulnwire
8.4high

CVE-2016-3714KEVin critical feed3 exploits

The (1) EPHEMERAL, (2) HTTPS, (3) MVG, (4) MSL, (5) TEXT, (6) SHOW, (7) WIN, and (8) PLT coders in ImageMagick before 6.9.3-10 and 7.x befo…

Published 10 y ago · modified 4 mo ago · JSON

CVSS
8.4
v3.1 · CNA
CISA KEV
Yes
added 2024-09-09
EPSS
97.5%
percentile 100%
Public exploits
3
Metasploit · Exploit-DB

The (1) EPHEMERAL, (2) HTTPS, (3) MVG, (4) MSL, (5) TEXT, (6) SHOW, (7) WIN, and (8) PLT coders in ImageMagick before 6.9.3-10 and 7.x before 7.0.1-1 allow remote attackers to execute arbitrary code via shell metacharacters in a crafted image, aka "ImageTragick."

Known exploited (CISA KEV)

Added
2 y ago
Due date
2024-09-30 (2 y ago)
Ransomware use
Unknown
Required action
Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Vendor / product
ImageMagick / ImageMagick
CISA name
ImageMagick Improper Input Validation Vulnerability

CISA SSVC assessment

Exploitation
Active — exploited in the wild
Automatable
yes
Technical impact
total
Assessed
2 y ago

Exploit prediction (EPSS)

97.48% probability of exploitation in the next 30 days, higher than 100% of all scored CVEs.

Exploits and detections

  • Metasploit exploit/unix/fileformat/imagemagick_delegate ImageMagick Delegate Arbitrary Command Execution · metasploit exploit, excellent rank · 2016-05-03
  • EDB-39791 ImageMagick 6.9.3-9 / 7.0.1-0 - 'ImageTragick' Delegate Arbitrary Command Execution (Metasploit) · local · 2016-05-09
  • EDB-39767 ImageMagick 7.0.1-0 / 6.9.3-9 - 'ImageTragick ' Multiple Vulnerabilities · dos · 2016-05-04

CVSS scores

Assigned byVersionScoreVector
CISA ADP3.18.4CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
NVD3.18.4CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CNA3.18.4CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
NVD2.010.0AV:N/AC:L/Au:N/C:C/I:C/A:C

Affected products

  • imagemagick imagemagick
  • canonical ubuntu_linux
  • debian debian_linux
  • opensuse opensuse
  • opensuse leap
  • suse suse_linux_enterprise_server

Classification

Weakness
  • CWE-20 Improper Input Validation

References

  • access.redhat.com /security/vulnerabilities/2296071 · x_refsource_CONFIRM, x_transferred
  • git.imagemagick.org /repos/ImageMagick/blob/a01518e08c840577cabd7d3ff291a9ba735f7276/ChangeLog · x_refsource_CONFIRM, x_transferred
  • lists.opensuse.org /opensuse-security-announce/2016-05/msg00028.html · vendor-advisory, x_refsource_SUSE, x_transferred
  • securitytracker.com /id/1035742 · vdb-entry, x_refsource_SECTRACK, x_transferred
  • imagetragick.com / · x_refsource_MISC, x_transferred
  • oracle.com /technetwork/topics/security/linuxbulletinapr2016-2952096.html · x_refsource_CONFIRM, x_transferred
  • imagemagick.org /discourse-server/viewtopic.php?f=4&t=29588 · x_refsource_CONFIRM, x_transferred
  • openwall.com /lists/oss-security/2016/05/03/13 · mailing-list, x_refsource_MLIST, x_transferred
  • lists.opensuse.org /opensuse-security-announce/2016-05/msg00041.html · vendor-advisory, x_refsource_SUSE, x_transferred
  • lists.opensuse.org /opensuse-security-announce/2016-05/msg00051.html · vendor-advisory, x_refsource_SUSE, x_transferred
  • ubuntu.com /usn/USN-2990-1 · vendor-advisory, x_refsource_UBUNTU, x_transferred
  • lists.opensuse.org /opensuse-security-announce/2016-05/msg00025.html · vendor-advisory, x_refsource_SUSE, x_transferred
  • securityfocus.com /archive/1/538378/100/0/threaded · mailing-list, x_refsource_BUGTRAQ, x_transferred
  • exploit-db.com /exploits/39767/ · exploit, x_refsource_EXPLOIT-DB, x_transferred
  • lists.opensuse.org /opensuse-security-announce/2016-05/msg00024.html · vendor-advisory, x_refsource_SUSE, x_transferred
  • rapid7.com /db/modules/exploit/unix/fileformat/imagemagick_delegate · x_refsource_MISC, x_transferred
  • oracle.com /technetwork/topics/security/bulletinjul2016-3090568.html · x_refsource_CONFIRM, x_transferred
  • openwall.com /lists/oss-security/2016/05/03/18 · mailing-list, x_refsource_MLIST, x_transferred
  • debian.org /security/2016/dsa-3746 · vendor-advisory, x_refsource_DEBIAN, x_transferred
  • security.gentoo.org /glsa/201611-21 · vendor-advisory, x_refsource_GENTOO, x_transferred
  • lists.opensuse.org /opensuse-security-announce/2016-05/msg00032.html · vendor-advisory, x_refsource_SUSE, x_transferred
  • slackware.com /security/viewer.php?l=slackware-security&y=2016&m=slackware-security.440568 · vendor-advisory, x_refsource_SLACKWARE, x_transferred
  • imagemagick.org /script/changelog.php · x_refsource_CONFIRM, x_transferred
  • exploit-db.com /exploits/39791/ · exploit, x_refsource_EXPLOIT-DB, x_transferred
  • debian.org /security/2016/dsa-3580 · vendor-advisory, x_refsource_DEBIAN, x_transferred
  • securityfocus.com /bid/89848 · vdb-entry, x_refsource_BID, x_transferred
  • rhn.redhat.com /errata/RHSA-2016-0726.html · vendor-advisory, x_refsource_REDHAT, x_transferred
  • bugzilla.redhat.com /show_bug.cgi?id=1332492 · x_refsource_CONFIRM, x_transferred
  • kb.cert.org /vuls/id/250519 · third-party-advisory, x_refsource_CERT-VN, x_transferred
  • packetstormsecurity.com /files/152364/ImageTragick-ImageMagick-Proof-Of-Concepts.html · x_refsource_MISC, x_transferred
  • cisa.gov /known-exploited-vulnerabilities-catalog?field_cve=CVE-2016-3714 · government-resource

Sources

vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.