CVE-2016-5239: Command Injection
It was found that gnuplot delegate functionality in ImageMagick and GraphicsMagick allows system command injection while interpreting gnuplot files.
Upstream patch (ImageMagick):
http://git.imagemagick.org/repos/ImageMagick/commit/70a2cf326ed32bedee144b961005
Upstream patch (GraphicsMagick):
http://hg.code.sf.net/p/graphicsmagick/code/rev/45998a25992d
Other sources
The gnuplot delegate functionality in ImageMagick before 6.9.4-0 and GraphicsMagick allows remote attackers to execute arbitrary commands via unspecified vectors.
— MITRE
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2016-5239?
CVE-2016-5239 is classified as a high severity vulnerability due to the potential for system command injection.
How do I fix CVE-2016-5239?
To fix CVE-2016-5239, update ImageMagick to version 6.9.3-10 or later where the vulnerability has been addressed.
What software is affected by CVE-2016-5239?
CVE-2016-5239 affects ImageMagick versions up to 6.9.3-9.
What types of attacks can be executed through CVE-2016-5239?
CVE-2016-5239 can be exploited to execute arbitrary commands on the host system through specially crafted gnuplot files.
Is CVE-2016-5239 similar to other command injection vulnerabilities?
Yes, CVE-2016-5239 is similar to other command injection vulnerabilities as it allows attackers to execute system commands under certain conditions.