CVE-2016-5691: Input Validation
Published Dec 13, 2016
·Updated
The DCM reader in ImageMagick before 6.9.4-5 and 7.x before 7.0.1-7 allows remote attackers to have unspecified impact by leveraging lack of validation of (1) pixel.red, (2) pixel.green, and (3) pixel.blue.
Affected Software
10 affected componentsFixes available
Oracle Solaris=11.3
ImageMagick<=6.9.4-4
ImageMagick=7.0.1-0
ImageMagick=7.0.1-1
ImageMagick=7.0.1-2
ImageMagick=7.0.1-3
ImageMagick=7.0.1-4
ImageMagick=7.0.1-5
ImageMagick=7.0.1-6
debian/imagemagick
8:6.9.11.60+dfsg-1.3+deb11u48:6.9.11.60+dfsg-1.3+deb11u58:6.9.11.60+dfsg-1.6+deb12u28:6.9.11.60+dfsg-1.6+deb12u18:7.1.1.43+dfsg1-18:7.1.1.47+dfsg1-1
Event History
Dec 13, 2016
CVE Published
via MITRE·03:00 PM
Data Sourced
via MITRE·03:00 PM
Description
Apr 28, 2025
Data Sourced
via Debian·02:16 AM
DescriptionAffected Software
Frequently Asked Questions
1
What is the severity of CVE-2016-5691?
CVE-2016-5691 is considered a critical vulnerability as it allows remote attackers to exploit the lack of validation in the DCM reader of ImageMagick.
2
How do I fix CVE-2016-5691?
To fix CVE-2016-5691, update ImageMagick to version 6.9.4-5, 7.0.1-7, or later versions.
3
Which versions of ImageMagick are affected by CVE-2016-5691?
CVE-2016-5691 affects ImageMagick versions earlier than 6.9.4-5 and all 7.x versions before 7.0.1-7.
4
What type of attacks can CVE-2016-5691 facilitate?
CVE-2016-5691 can facilitate remote code execution attacks due to the improper validation of pixel data.
5
Is CVE-2016-5691 exploited in the wild?
There is no public information available confirming active exploitation of CVE-2016-5691 in the wild.