First published: Thu May 05 2016(Updated: )
The (1) HTTP and (2) FTP coders in ImageMagick before 6.9.3-10 and 7.x before 7.0.1-1 allow remote attackers to conduct server-side request forgery (SSRF) attacks via a crafted image.
Credit: secalert@redhat.com secalert@redhat.com
Affected Software | Affected Version | How to fix |
---|---|---|
ImageMagick | ||
Ubuntu | =12.04 | |
Ubuntu | =14.04 | |
Ubuntu | =15.10 | |
Ubuntu | =16.04 | |
ImageMagick | <=6.9.3-9 | |
ImageMagick | =7.0.0-0 | |
ImageMagick | =7.0.1-0 | |
Red Hat Enterprise Linux Desktop | =6.0 | |
Red Hat Enterprise Linux Desktop | =7.0 | |
Red Hat Enterprise Linux HPC Node | =6.0 | |
Red Hat Enterprise Linux HPC Node | =7.0 | |
Red Hat Enterprise Linux HPC Node | =7.2 | |
Red Hat Enterprise Linux Server | =6.0 | |
Red Hat Enterprise Linux Server | =7.0 | |
Red Hat Enterprise Linux Server | =7.2 | |
Red Hat Enterprise Linux Server | =7.2 | |
Red Hat Enterprise Linux Server Supplementary EUS | =6.7z | |
Red Hat Enterprise Linux Workstation | =6.0 | |
Red Hat Enterprise Linux Workstation | =7.0 | |
Red Hat Enterprise Linux Server EUS | =6.7 | |
Red Hat Enterprise Linux Server EUS | =7.2 | |
Red Hat Enterprise Linux Server EUS | =7.3 | |
Red Hat Enterprise Linux Server EUS | =7.4 | |
Red Hat Enterprise Linux Server EUS | =7.5 | |
Red Hat Enterprise Linux Server EUS | =7.6 | |
Red Hat Enterprise Linux Server EUS | =7.7 | |
Red Hat Enterprise Linux for IBM Z Systems | =6.0_s390x | |
Red Hat Enterprise Linux for IBM Z Systems | =7.0_s390x | |
Red Hat Enterprise Linux for IBM Z Systems (s390x) | =6.7_s390x | |
Red Hat Enterprise Linux for IBM Z Systems (s390x) | =7.2_s390x | |
Red Hat Enterprise Linux for IBM Z Systems (s390x) | =7.3_s390x | |
Red Hat Enterprise Linux for IBM Z Systems (s390x) | =7.4_s390x | |
Red Hat Enterprise Linux for IBM Z Systems (s390x) | =7.5_s390x | |
Red Hat Enterprise Linux for IBM Z Systems (s390x) | =7.6_s390x | |
Red Hat Enterprise Linux for IBM Z Systems (s390x) | =7.7_s390x | |
Red Hat Enterprise Linux for Power, big endian | =6.0_ppc64 | |
Red Hat Enterprise Linux for Power, big endian | =7.0_ppc64 | |
Red Hat Enterprise Linux for Power, Big Endian EUS | =6.7_ppc64 | |
Red Hat Enterprise Linux for Power, Big Endian EUS | =7.2_ppc64 | |
Red Hat Enterprise Linux for Power, Big Endian EUS | =7.3_ppc64 | |
Red Hat Enterprise Linux for Power, Big Endian EUS | =7.4_ppc64 | |
Red Hat Enterprise Linux for Power, Big Endian EUS | =7.5_ppc64 | |
Red Hat Enterprise Linux for Power, Big Endian EUS | =7.6_ppc64 | |
Red Hat Enterprise Linux for Power, Big Endian EUS | =7.7_ppc64 | |
Red Hat Enterprise Linux for Power, little endian | =7.0_ppc64le | |
Red Hat Enterprise Linux for Power, little endian - Extended Update Support | =7.2_ppc64le | |
Red Hat Enterprise Linux for Power, little endian - Extended Update Support | =7.3_ppc64le | |
Red Hat Enterprise Linux for Power, little endian - Extended Update Support | =7.4_ppc64le | |
Red Hat Enterprise Linux for Power, little endian - Extended Update Support | =7.5_ppc64le | |
Red Hat Enterprise Linux for Power, little endian - Extended Update Support | =7.6_ppc64le | |
Red Hat Enterprise Linux for Power, little endian - Extended Update Support | =7.7_ppc64le | |
Red Hat Enterprise Linux Server | =7.3 | |
Red Hat Enterprise Linux Server | =7.4 | |
Red Hat Enterprise Linux Server | =7.6 | |
Red Hat Enterprise Linux Server | =7.7 | |
Red Hat Enterprise Linux Server Supplementary EUS | =6.0 | |
Red Hat Enterprise Linux Server Supplementary EUS | =7.0 | |
Red Hat Enterprise Linux Server | =7.2 | |
Red Hat Enterprise Linux Server | =7.3 | |
Red Hat Enterprise Linux Server | =7.6 | |
Red Hat Enterprise Linux Server | =7.7 | |
ImageMagick | <6.9.3-10 | |
Ubuntu | =14.04 | |
Ubuntu | =16.04 | |
Oracle Linux | =6 | |
Oracle Linux | =7 | |
Oracle Solaris and Zettabyte File System (ZFS) | =10 | |
Oracle Solaris and Zettabyte File System (ZFS) | =11.3 | |
SUSE Linux Enterprise Debuginfo | =11-sp2 | |
SUSE Linux Enterprise Debuginfo | =11-sp3 | |
SUSE Linux Enterprise Debuginfo | =11-sp4 | |
SUSE Manager Server | =2.1 | |
SUSE Manager Proxy | =2.1 | |
openSUSE OpenStack Cloud | =5 | |
SUSE Linux | =42.1 | |
openSUSE | =13.2 | |
SUSE Linux Enterprise Desktop | =12 | |
SUSE Linux Enterprise Desktop | =12-sp1 | |
SUSE Linux Enterprise Server | =11-sp2 | |
SUSE Linux Enterprise Server | =11-sp3 | |
SUSE Linux Enterprise Server | =11-sp4 | |
SUSE Linux Enterprise Server | =12 | |
SUSE Linux Enterprise Server | =12-sp1 | |
SUSE Linux Enterprise Software Development Kit | =11-sp4 | |
SUSE Linux Enterprise Software Development Kit | =12 | |
SUSE Linux Enterprise Software Development Kit | =12-sp1 | |
SUSE Linux Workstation Extension | =12 | |
SUSE Linux Workstation Extension | =12-sp1 |
http://git.imagemagick.org/repos/ImageMagick/blob/a01518e08c840577cabd7d3ff291a9ba735f7276/ChangeLog
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
CVE-2016-3718 is rated as a moderate severity vulnerability allowing server-side request forgery attacks.
To fix CVE-2016-3718, upgrade ImageMagick to version 6.9.3-10 or later, or 7.0.1-1 or later.
CVE-2016-3718 affects versions of ImageMagick prior to 6.9.3-10 and 7.x prior to 7.0.1-1.
CVE-2016-3718 can enable remote attackers to conduct server-side request forgery (SSRF) attacks via crafted images.
CVE-2016-3718 specifically impacts all versions of ImageMagick before 6.9.3-10 and those in the 7.x series before 7.0.1-1.