CVE-2016-10048: Path Traversal
A path traversal vulnerability was found in ImageMagick. An arbitrary module could be loaded into ImageMagick.
References:
http://seclists.org/oss-sec/2016/q4/758 https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=833735
Upstream patch:
https://github.com/ImageMagick/ImageMagick/commit/fc6080f1321fd21e86ef916195cc110b05d9effb
Other sources
Directory traversal vulnerability in magick/module.c in ImageMagick 6.9.4-7 allows remote attackers to load arbitrary modules via unspecified vectors.
— MITRE
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2016-10048?
CVE-2016-10048 is considered a high severity vulnerability due to its potential for arbitrary code execution.
How do I fix CVE-2016-10048?
To fix CVE-2016-10048, update ImageMagick to a version greater than 6.9.4 or apply any available security patches.
What software is affected by CVE-2016-10048?
CVE-2016-10048 affects ImageMagick versions prior to 6.9.4-7.
How does CVE-2016-10048 work?
CVE-2016-10048 exploits a path traversal vulnerability that allows an arbitrary module to be loaded into ImageMagick.
What could be the impact of CVE-2016-10048?
The impact of CVE-2016-10048 could lead to unauthorized execution of malicious code, potentially compromising the server where ImageMagick is installed.