CVE-2016-3714

Katalog CVE

CVSS 8.4 · High KEV · sudah dieksploitasi EPSS 97,5%

Kerentanan Improper Input Validation pada imagemagick, canonical ubuntu linux +4 lainnya. Skor CVSS 3.1 8.4 (High) menurut NVD. Masuk katalog KEV CISA pada 9 September 2024, artinya sudah terbukti dieksploitasi.

Deskripsi (NVD)

The (1) EPHEMERAL, (2) HTTPS, (3) MVG, (4) MSL, (5) TEXT, (6) SHOW, (7) WIN, and (8) PLT coders in ImageMagick before 6.9.3-10 and 7.x before 7.0.1-1 allow remote attackers to execute arbitrary code via shell metacharacters in a crafted image, aka "ImageTragick."

Rincian

Terbit di NVD

5 Mei 2016

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

8.4 (High), sumber NVD
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-20: Improper Input Validation

EPSS (30 hari)

97,5% peluang dieksploitasi; lebih tinggi dari 99,9% CVE lain

Known Exploited Vulnerabilities (CISA)

Nama

ImageMagick Improper Input Validation Vulnerability

Masuk KEV

9 September 2024

Tenggat CISA

30 September 2024 (untuk instansi federal AS)

Ransomware

Belum tercatat

Tindakan wajib

Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://imagetragick.com/ advisory vendor
• https://www.imagemagick.org/discourse-server/viewtopic.php?f=4&t=29588 advisory vendor
• https://www.imagemagick.org/script/changelog.php advisory vendor
• http://git.imagemagick.org/repos/ImageMagick/blob/a01518e08c840577cabd7d3ff291a9ba735f7276/ChangeLog patch
• https://www.kb.cert.org/vuls/id/250519 advisory pihak ketiga · pemerintah AS
• https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2016-3714 pemerintah AS
• http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00024.html advisory pihak ketiga
• http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00025.html advisory pihak ketiga
• http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00028.html advisory pihak ketiga
• http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00032.html advisory pihak ketiga
• http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00041.html advisory pihak ketiga
• http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00051.html advisory pihak ketiga
• http://packetstormsecurity.com/files/152364/ImageTragick-ImageMagick-Proof-Of-Concepts.html advisory pihak ketiga · vdb entry
• http://rhn.redhat.com/errata/RHSA-2016-0726.html advisory pihak ketiga
• http://www.debian.org/security/2016/dsa-3580 advisory pihak ketiga
• http://www.debian.org/security/2016/dsa-3746 advisory pihak ketiga
• http://www.oracle.com/technetwork/topics/security/bulletinjul2016-3090568.html advisory pihak ketiga
• http://www.oracle.com/technetwork/topics/security/linuxbulletinapr2016-2952096.html advisory pihak ketiga
• http://www.rapid7.com/db/modules/exploit/unix/fileformat/imagemagick_delegate advisory pihak ketiga
• http://www.securityfocus.com/archive/1/538378/100/0/threaded advisory pihak ketiga · vdb entry
• http://www.securityfocus.com/bid/89848 advisory pihak ketiga · vdb entry
• http://www.securitytracker.com/id/1035742 advisory pihak ketiga · vdb entry
• http://www.slackware.com/security/viewer.php?l=slackware-security&y=2016&m=slackware-security.440568 advisory pihak ketiga
• http://www.ubuntu.com/usn/USN-2990-1 advisory pihak ketiga
• https://access.redhat.com/security/vulnerabilities/2296071 advisory pihak ketiga