CVE-2016-3717: Infoleak
Published May 5, 2016
·Updated
The LABEL coder in ImageMagick before 6.9.3-10 and 7.x before 7.0.1-1 allows remote attackers to read arbitrary files via a crafted image.
Affected Software
19 affected components
Canonical Ubuntu Linux=12.04
Canonical Ubuntu Linux=14.04
Canonical Ubuntu Linux=15.10
Canonical Ubuntu Linux=16.04
redhat Enterprise Linux Desktop=6.0
redhat Enterprise Linux Desktop=7.0
redhat Enterprise Linux Hpc Node=6.0
redhat Enterprise Linux Hpc Node=7.0
redhat Enterprise Linux Hpc Node Eus=7.2
redhat Enterprise Linux Server=6.0
redhat Enterprise Linux Server=7.0
redhat Enterprise Linux Server Aus=7.2
redhat Enterprise Linux Server Eus=7.2
redhat Enterprise Linux Server Supplementary Eus=6.7z
redhat Enterprise Linux Workstation=6.0
redhat Enterprise Linux Workstation=7.0
ImageMagick ImageMagick<=6.9.3-9
ImageMagick ImageMagick=7.0.0-0
ImageMagick ImageMagick=7.0.1-0
Remediation
Event History
May 5, 2016
CVE Published
via MITRE·06:00 PM
Data Sourced
via MITRE·06:00 PM
Description
Frequently Asked Questions
1
What is the severity of CVE-2016-3717?
CVE-2016-3717 is considered a medium severity vulnerability due to its potential to allow unauthorized file reading.
2
How do I fix CVE-2016-3717?
To fix CVE-2016-3717, update ImageMagick to version 6.9.3-10 or 7.0.1-1 or later.
3
What versions of ImageMagick are affected by CVE-2016-3717?
ImageMagick versions before 6.9.3-10 and 7.x before 7.0.1-1 are vulnerable to CVE-2016-3717.
4
Can CVE-2016-3717 be exploited remotely?
Yes, CVE-2016-3717 allows remote attackers to exploit the vulnerability through crafted images.
5
What impact can CVE-2016-3717 have on my system?
CVE-2016-3717 can lead to unauthorized access to arbitrary files on the server, posing a serious risk to data integrity.