CVE-2016-5118

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2016-5118
The OpenBlob function in blob.c in GraphicsMagick before 1.3.24 and ImageMagick allows remote attackers to execute arbitrary code via a | (pipe) character at the start of a filename.

9.8 /10

CVSS v3 : CRITICAL

V3 Legend

Vector :

Exploitability : 3.9 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

10.0 /10

CVSS v2.0 : HIGH

V2 Legend

Vector : AV:N/AC:L/Au:N/C:C/I:C/A:C

Exploitability : 10.0 / Impact : 10.0

Access Vector NETWORK

Access Complexity LOW

Authentication NONE

Confidentiality Impact COMPLETE

Integrity Impact COMPLETE

Availability Impact COMPLETE

References
Link Resource
http://git.imagemagick.org/repos/ImageMagick/commit/40639d173aa8c76b850d625c630b711fee4dcfb8 Broken Link Vendor Advisory
http://hg.code.sf.net/p/graphicsmagick/code/file/41876934e762/ChangeLog Release Notes Vendor Advisory
http://hg.code.sf.net/p/graphicsmagick/code/rev/ae3928faa858 Broken Link
http://lists.opensuse.org/opensuse-security-announce/2016-06/msg00008.html Third Party Advisory
http://lists.opensuse.org/opensuse-security-announce/2016-06/msg00009.html Third Party Advisory
http://lists.opensuse.org/opensuse-security-announce/2016-06/msg00011.html Third Party Advisory
http://lists.opensuse.org/opensuse-security-announce/2016-06/msg00021.html Third Party Advisory
http://lists.opensuse.org/opensuse-security-announce/2016-06/msg00030.html Mailing List Third Party Advisory
http://lists.opensuse.org/opensuse-security-announce/2016-06/msg00032.html Third Party Advisory
http://lists.opensuse.org/opensuse-security-announce/2016-06/msg00047.html Mailing List Third Party Advisory
http://www.debian.org/security/2016/dsa-3591 Third Party Advisory
http://www.debian.org/security/2016/dsa-3746 Third Party Advisory
http://www.openwall.com/lists/oss-security/2016/05/29/7 Mailing List Release Notes
http://www.openwall.com/lists/oss-security/2016/05/30/1 Mailing List Third Party Advisory
http://www.oracle.com/technetwork/topics/security/bulletinjul2016-3090568.html Third Party Advisory
http://www.oracle.com/technetwork/topics/security/linuxbulletinapr2016-2952096.html Third Party Advisory
http://www.securityfocus.com/bid/90938 Broken Link Third Party Advisory VDB Entry
http://www.securitytracker.com/id/1035984 Third Party Advisory VDB Entry
http://www.securitytracker.com/id/1035985 Broken Link Third Party Advisory VDB Entry
http://www.slackware.com/security/viewer.php?l=slackware-security&y=2016&m=slackware-security.397749 Third Party Advisory
http://www.ubuntu.com/usn/USN-2990-1 Third Party Advisory
https://access.redhat.com/errata/RHSA-2016:1237 Third Party Advisory
Configurations

Configuration 1 (hide)

cpe:2.3:a:graphicsmagick:graphicsmagick:*:*:*:*:*:*:*:*

Configuration 2 (hide)

OR cpe:2.3:a:suse:linux_enterprise_debuginfo:11:sp4:*:*:*:*:*:*
cpe:2.3:a:suse:studio_onsite:1.3:*:*:*:*:*:*:*
cpe:2.3:o:suse:linux_enterprise_software_development_kit:11:sp4:*:*:*:*:*:*

Configuration 3 (hide)

OR cpe:2.3:o:oracle:solaris:10:*:*:*:*:*:*:*
cpe:2.3:o:oracle:solaris:11.3:*:*:*:*:*:*:*

Configuration 4 (hide)

OR cpe:2.3:o:oracle:linux:6:*:*:*:*:*:*:*
cpe:2.3:o:oracle:linux:7:*:*:*:*:*:*:*

Configuration 5 (hide)

OR cpe:2.3:o:opensuse:leap:42.1:*:*:*:*:*:*:*
cpe:2.3:o:opensuse:opensuse:13.2:*:*:*:*:*:*:*

Configuration 6 (hide)

OR cpe:2.3:o:canonical:ubuntu_linux:12.04:*:*:*:lts:*:*:*
cpe:2.3:o:canonical:ubuntu_linux:14.04:*:*:*:lts:*:*:*
cpe:2.3:o:canonical:ubuntu_linux:15.10:*:*:*:*:*:*:*
cpe:2.3:o:canonical:ubuntu_linux:16.04:*:*:*:lts:*:*:*

Configuration 7 (hide)

cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*

Configuration 8 (hide)

OR cpe:2.3:o:suse:linux_enterprise_desktop:12:-:*:*:*:*:*:*
cpe:2.3:o:suse:linux_enterprise_desktop:12.0:sp1:*:*:*:*:*:*
cpe:2.3:o:suse:linux_enterprise_server:12:-:*:*:*:*:*:*
cpe:2.3:o:suse:linux_enterprise_server:12.0:sp1:*:*:*:*:*:*
cpe:2.3:o:suse:linux_enterprise_software_development_kit:12:-:*:*:*:*:*:*
cpe:2.3:o:suse:linux_enterprise_software_development_kit:12.0:sp1:*:*:*:*:*:*
cpe:2.3:o:suse:linux_enterprise_workstation_extension:12:-:*:*:*:*:*:*
cpe:2.3:o:suse:linux_enterprise_workstation_extension:12:sp1:*:*:*:*:*:*

Configuration 9 (hide)

cpe:2.3:a:imagemagick:imagemagick:*:*:*:*:*:*:*:*
History

19 Nov 2024, 20:24

Type Values Removed Values Added
CPE cpe:2.3:a:imagemagick:imagemagick:-:*:*:*:*:*:*:* cpe:2.3:a:imagemagick:imagemagick:*:*:*:*:*:*:*:*

01 Aug 2023, 18:21

Type Values Removed Values Added
CPE cpe:2.3:o:novell:suse_linux_enterprise_software_development_kit:12.0:*:*:*:*:*:*:*
cpe:2.3:o:novell:suse_linux_enterprise_server:12.0:*:*:*:*:*:*:*
cpe:2.3:o:novell:suse_linux_enterprise_desktop:12.0:*:*:*:*:*:*:*
cpe:2.3:o:novell:suse_linux_enterprise_server:12.0:sp1:*:*:*:*:*:*
cpe:2.3:o:novell:suse_linux_enterprise_software_development_kit:12.0:sp1:*:*:*:*:*:*
cpe:2.3:o:novell:suse_linux_enterprise_desktop:12.0:sp1:*:*:*:*:*:*
cpe:2.3:o:novell:suse_linux_enterprise_workstation_extension:12.0:sp1:*:*:*:*:*:*
cpe:2.3:o:novell:suse_linux_enterprise_workstation_extension:12.0:*:*:*:*:*:*:*		 cpe:2.3:o:suse:linux_enterprise_software_development_kit:12.0:sp1:*:*:*:*:*:*
cpe:2.3:o:suse:linux_enterprise_server:12.0:sp1:*:*:*:*:*:*
cpe:2.3:o:suse:linux_enterprise_workstation_extension:12:sp1:*:*:*:*:*:*
cpe:2.3:o:suse:linux_enterprise_desktop:12:-:*:*:*:*:*:*
cpe:2.3:a:imagemagick:imagemagick:-:*:*:*:*:*:*:*
cpe:2.3:o:suse:linux_enterprise_workstation_extension:12:-:*:*:*:*:*:*
cpe:2.3:o:suse:linux_enterprise_server:12:-:*:*:*:*:*:*
cpe:2.3:o:suse:linux_enterprise_software_development_kit:12:-:*:*:*:*:*:*
cpe:2.3:o:suse:linux_enterprise_desktop:12.0:sp1:*:*:*:*:*:*
References (MLIST) http://www.openwall.com/lists/oss-security/2016/05/29/7 - Release Notes (MLIST) http://www.openwall.com/lists/oss-security/2016/05/29/7 - Mailing List, Release Notes
References (SECTRACK) http://www.securitytracker.com/id/1035985 - Third Party Advisory (SECTRACK) http://www.securitytracker.com/id/1035985 - Broken Link, Third Party Advisory, VDB Entry
References (BID) http://www.securityfocus.com/bid/90938 - (BID) http://www.securityfocus.com/bid/90938 - Broken Link, Third Party Advisory, VDB Entry
References (CONFIRM) http://git.imagemagick.org/repos/ImageMagick/commit/40639d173aa8c76b850d625c630b711fee4dcfb8 - Vendor Advisory (CONFIRM) http://git.imagemagick.org/repos/ImageMagick/commit/40639d173aa8c76b850d625c630b711fee4dcfb8 - Broken Link, Vendor Advisory
References (DEBIAN) http://www.debian.org/security/2016/dsa-3746 - (DEBIAN) http://www.debian.org/security/2016/dsa-3746 - Third Party Advisory
References (SUSE) http://lists.opensuse.org/opensuse-security-announce/2016-06/msg00047.html - (SUSE) http://lists.opensuse.org/opensuse-security-announce/2016-06/msg00047.html - Mailing List, Third Party Advisory
References (SECTRACK) http://www.securitytracker.com/id/1035984 - Third Party Advisory (SECTRACK) http://www.securitytracker.com/id/1035984 - Third Party Advisory, VDB Entry
References (SUSE) http://lists.opensuse.org/opensuse-security-announce/2016-06/msg00030.html - (SUSE) http://lists.opensuse.org/opensuse-security-announce/2016-06/msg00030.html - Mailing List, Third Party Advisory
References (MLIST) http://www.openwall.com/lists/oss-security/2016/05/30/1 - Third Party Advisory (MLIST) http://www.openwall.com/lists/oss-security/2016/05/30/1 - Mailing List, Third Party Advisory
References (SLACKWARE) http://www.slackware.com/security/viewer.php?l=slackware-security&y=2016&m=slackware-security.397749 - (SLACKWARE) http://www.slackware.com/security/viewer.php?l=slackware-security&y=2016&m=slackware-security.397749 - Third Party Advisory
References (REDHAT) https://access.redhat.com/errata/RHSA-2016:1237 - (REDHAT) https://access.redhat.com/errata/RHSA-2016:1237 - Third Party Advisory
References (CONFIRM) http://hg.code.sf.net/p/graphicsmagick/code/rev/ae3928faa858 - (CONFIRM) http://hg.code.sf.net/p/graphicsmagick/code/rev/ae3928faa858 - Broken Link
First Time Imagemagick imagemagick
Suse linux Enterprise Server
Imagemagick
Suse linux Enterprise Desktop
Suse linux Enterprise Workstation Extension
CWE CWE-284 NVD-CWE-noinfo
Information

Published : 2016-06-10 15:59

Updated : 2024-11-19 20:24

NVD link : CVE-2016-5118

Mitre link : CVE-2016-5118

CVE.ORG link : CVE-2016-5118

JSON object : View

Products Affected

opensuse

  • opensuse
  • leap

suse

  • linux_enterprise_workstation_extension
  • linux_enterprise_software_development_kit
  • linux_enterprise_server
  • studio_onsite
  • linux_enterprise_desktop
  • linux_enterprise_debuginfo

oracle

  • linux
  • solaris

canonical

  • ubuntu_linux

imagemagick

  • imagemagick

debian

  • debian_linux

graphicsmagick

  • graphicsmagick
CWE
NVD-CWE-noinfo

NetmanageIT Website NetmanageIT OSINT Web NetmanageIT OpenCTI NetmanageIT PDF Tools NetmanageIT CTO Corner Blog NetmanageIT Email Header Analyzer NetmanageIT Password Pusher NetmanageIT Internet Health and Latency Dashboard NetmanageIT Dedicated Speed Test Site NetmanageIT Ubuntu Mirror 10Gbps Copyright OpenCVE 2024