CVE-2016-3718: ImageMagick Server-Side Request Forgery (SSRF) Vulnerability
Published May 5, 2016
·Updated
The (1) HTTP and (2) FTP coders in ImageMagick before 6.9.3-10 and 7.x before 7.0.1-1 allow remote attackers to conduct server-side request forgery (SSRF) attacks via a crafted image.
Other sources
ImageMagick contains an unspecified vulnerability that allows attackers to perform server-side request forgery (SSRF) via a crafted image.
— CISA
Affected Software
89 affected components
ImageMagick ImageMagick
Canonical Ubuntu Linux=12.04
Canonical Ubuntu Linux=14.04
Canonical Ubuntu Linux=15.10
Canonical Ubuntu Linux=16.04
ImageMagick ImageMagick<=6.9.3-9
ImageMagick ImageMagick=7.0.0-0
ImageMagick ImageMagick=7.0.1-0
redhat Enterprise Linux Desktop=6.0
redhat Enterprise Linux Desktop=7.0
redhat Enterprise Linux Hpc Node=6.0
redhat Enterprise Linux Hpc Node=7.0
redhat Enterprise Linux Hpc Node Eus=7.2
redhat Enterprise Linux Server=6.0
redhat Enterprise Linux Server=7.0
redhat Enterprise Linux Server Aus=7.2
redhat Enterprise Linux Server Eus=7.2
redhat Enterprise Linux Server Supplementary Eus=6.7z
redhat Enterprise Linux Workstation=6.0
redhat Enterprise Linux Workstation=7.0
redhat Enterprise Linux Eus=6.7
redhat Enterprise Linux Eus=7.2
redhat Enterprise Linux Eus=7.3
redhat Enterprise Linux Eus=7.4
redhat Enterprise Linux Eus=7.5
redhat Enterprise Linux Eus=7.6
redhat Enterprise Linux Eus=7.7
redhat Enterprise Linux For Ibm Z Systems=6.0_s390x
redhat Enterprise Linux For Ibm Z Systems=7.0_s390x
redhat Enterprise Linux For Ibm Z Systems Eus=6.7_s390x
redhat Enterprise Linux For Ibm Z Systems Eus=7.2_s390x
redhat Enterprise Linux For Ibm Z Systems Eus=7.3_s390x
redhat Enterprise Linux For Ibm Z Systems Eus=7.4_s390x
redhat Enterprise Linux For Ibm Z Systems Eus=7.5_s390x
redhat Enterprise Linux For Ibm Z Systems Eus=7.6_s390x
redhat Enterprise Linux For Ibm Z Systems Eus=7.7_s390x
redhat Enterprise Linux For Power Big Endian=6.0_ppc64
redhat Enterprise Linux For Power Big Endian=7.0_ppc64
redhat Enterprise Linux For Power Big Endian Eus=6.7_ppc64
redhat Enterprise Linux For Power Big Endian Eus=7.2_ppc64
redhat Enterprise Linux For Power Big Endian Eus=7.3_ppc64
redhat Enterprise Linux For Power Big Endian Eus=7.4_ppc64
redhat Enterprise Linux For Power Big Endian Eus=7.5_ppc64
redhat Enterprise Linux For Power Big Endian Eus=7.6_ppc64
redhat Enterprise Linux For Power Big Endian Eus=7.7_ppc64
redhat Enterprise Linux For Power Little Endian=7.0_ppc64le
redhat Enterprise Linux For Power Little Endian Eus=7.2_ppc64le
redhat Enterprise Linux For Power Little Endian Eus=7.3_ppc64le
redhat Enterprise Linux For Power Little Endian Eus=7.4_ppc64le
redhat Enterprise Linux For Power Little Endian Eus=7.5_ppc64le
redhat Enterprise Linux For Power Little Endian Eus=7.6_ppc64le
redhat Enterprise Linux For Power Little Endian Eus=7.7_ppc64le
redhat Enterprise Linux Server Aus=7.3
redhat Enterprise Linux Server Aus=7.4
redhat Enterprise Linux Server Aus=7.6
redhat Enterprise Linux Server Aus=7.7
redhat Enterprise Linux Server From Rhui=6.0
redhat Enterprise Linux Server From Rhui=7.0
redhat Enterprise Linux Server Tus=7.2
redhat Enterprise Linux Server Tus=7.3
redhat Enterprise Linux Server Tus=7.6
redhat Enterprise Linux Server Tus=7.7
ImageMagick ImageMagick<6.9.3-10
Canonical Ubuntu Linux=14.04
Canonical Ubuntu Linux=16.04
Oracle Linux=6
Oracle Linux=7
Oracle Solaris=10
Oracle Solaris=11.3
SUSE Linux Enterprise Debuginfo=11-sp2
SUSE Linux Enterprise Debuginfo=11-sp3
SUSE Linux Enterprise Debuginfo=11-sp4
SUSE Manager=2.1
SUSE Manager Proxy=2.1
SUSE Openstack Cloud=5
openSUSE Leap=42.1
openSUSE openSUSE=13.2
SUSE Linux Enterprise Desktop=12
SUSE Linux Enterprise Desktop=12-sp1
SUSE Linux Enterprise Server=11-sp2
SUSE Linux Enterprise Server=11-sp3
SUSE Linux Enterprise Server=11-sp4
SUSE Linux Enterprise Server=12
SUSE Linux Enterprise Server=12-sp1
SUSE Linux Enterprise Software Development Kit=11-sp4
SUSE Linux Enterprise Software Development Kit=12
SUSE Linux Enterprise Software Development Kit=12-sp1
SUSE Linux Enterprise Workstation Extension=12
SUSE Linux Enterprise Workstation Extension=12-sp1
Remediation
Event History
May 5, 2016
CVE Published
via MITRE·06:00 PM
Data Sourced
via MITRE·06:00 PM
Description
Data Sourced
via NVD·06:59 PM
RemedyDescriptionSeverityWeaknessAffected Software
Nov 3, 2021
Known Exploited
via CISA·12:00 AM
Mar 1, 58274
Event
via NVD·06:03 AM
Frequently Asked Questions
1
What is the severity of CVE-2016-3718?
CVE-2016-3718 is rated as a moderate severity vulnerability allowing server-side request forgery attacks.
2
How do I fix CVE-2016-3718?
To fix CVE-2016-3718, upgrade ImageMagick to version 6.9.3-10 or later, or 7.0.1-1 or later.
3
What types of software are affected by CVE-2016-3718?
CVE-2016-3718 affects versions of ImageMagick prior to 6.9.3-10 and 7.x prior to 7.0.1-1.
4
What kind of attacks can CVE-2016-3718 enable?
CVE-2016-3718 can enable remote attackers to conduct server-side request forgery (SSRF) attacks via crafted images.
5
Is CVE-2016-3718 an attack vector for all versions of ImageMagick?
CVE-2016-3718 specifically impacts all versions of ImageMagick before 6.9.3-10 and those in the 7.x series before 7.0.1-1.