This update for ImageMagick fixes the following issues :

Security issues fixed :

  - Several coders were vulnerable to remote code execution     attacks, these coders have now been disabled. They can     be re-enabled by exporting the following environment     variable     MAGICK_CODER_MODULE_PATH=/usr/lib64/ImageMagick-6.4.3/mo     dules-Q16/coders/vu lnerable/ (bsc#978061)

  - CVE-2016-3714: Insufficient shell characters filtering     leads to (potentially remote) code execution

  - CVE-2016-3715: Possible file deletion by using     ImageMagick's 'ephemeral' pseudo protocol which deletes     files after reading.

  - CVE-2016-3716: Possible file moving by using     ImageMagick's 'msl' pseudo protocol with any extension     in any folder.

  - CVE-2016-3717: Possible local file read by using     ImageMagick's 'label' pseudo protocol to get content of     the files from the server.

  - CVE-2016-3718: Possible Server Side Request Forgery     (SSRF) to make HTTP GET or FTP request.

Bugs fixed :

  - Use external svg loader (rsvg)

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for ImageMagick fixes the following issues :

  - bsc#978061: A vulnerability in ImageMagick's 'https'     module allowed users to execute arbitrary shell commands     on the host performing the image conversion. The issue     had the potential for remote command injection. This     update mitigates the vulnerability by disabling all     access to the 'https' module in the 'delegates.xml'     config file. (CVE-2016-3714)

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the ImageMagick packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - It was discovered that ImageMagick did not properly     sanitize certain input before passing it to the     delegate functionality. A remote attacker could create     a specially crafted image that, when processed by an     application using ImageMagick or an unsuspecting user     using the ImageMagick utilities, would lead to     arbitrary execution of shell commands with the     privileges of the user running the     application.(CVE-2016-3714)

  - It was discovered that certain ImageMagick coders and     pseudo-protocols did not properly prevent security     sensitive operations when processing specially crafted     images. A remote attacker could create a specially     crafted image that, when processed by an application     using ImageMagick or an unsuspecting user using the     ImageMagick utilities, would allow the attacker to     delete, move, or disclose the contents of arbitrary     files. (CVE-2016-3715, CVE-2016-3716, CVE-2016-3717)

  - A server-side request forgery flaw was discovered in     the way ImageMagick processed certain images. A remote     attacker could exploit this flaw to mislead an     application using ImageMagick or an unsuspecting user     using the ImageMagick utilities into, for example,     performing HTTP(S) requests or opening FTP sessions via     specially crafted images. (CVE-2016-3718)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - The (1) EPHEMERAL, (2) HTTPS, (3) MVG, (4) MSL, (5) TEXT, (6) SHOW, (7) WIN, and (8) PLT coders in     ImageMagick before 6.9.3-10 and 7.x before 7.0.1-1 allow remote attackers to execute arbitrary code via     shell metacharacters in a crafted image, aka ImageTragick. (CVE-2016-3714)

Note that Nessus relies on the presence of the package as reported by the vendor.

The remote MiracleLinux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2016-233:02 advisory.

    ImageMagick is an image display and manipulation tool for the X     Window System. ImageMagick can read and write JPEG, TIFF, PNM, GIF,     and Photo CD image formats. It can resize, rotate, sharpen, color     reduce, or add special effects to an image, and when finished you can     either save the completed work in the original format or a different     one. ImageMagick also includes command line programs for creating     animated or transparent .gifs, creating composite images, creating     thumbnail images, and more.
    ImageMagick is one of your choices if you need a program to manipulate     and display images. If you want to develop your own applications     which use ImageMagick code or APIs, you need to install     ImageMagick-devel as well.
    Security issues fixed with this release:
    CVE-2016-3714     The (1) EPHEMERAL, (2) HTTPS, (3) MVG, (4) MSL, (5) TEXT, (6) SHOW,     (7) WIN, and (8) PLT coders in ImageMagick before 6.9.3-10 and 7.x     before 7.0.1-1 allow remote attackers to execute arbitrary code via     shell metacharacters in a crafted image, aka ImageTragick.
    CVE-2016-3715     The EPHEMERAL coder in ImageMagick before 6.9.3-10 and 7.x before     7.0.1-1 allows remote attackers to delete arbitrary files via a     crafted image.
    CVE-2016-3716     The MSL coder in ImageMagick before 6.9.3-10 and 7.x before 7.0.1-1     allows remote attackers to move arbitrary files via a crafted image.
    CVE-2016-3717     The LABEL coder in ImageMagick before 6.9.3-10 and 7.x before 7.0.1-1     allows remote attackers to read arbitrary files via a crafted image.
    CVE-2016-3718     The (1) HTTP and (2) FTP coders in ImageMagick before 6.9.3-10 and 7.x     before 7.0.1-1 allow remote attackers to conduct server-side request     forgery (SSRF) attacks via a crafted image.

Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote MiracleLinux 4 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2016-450:01 advisory.

    ImageMagick is an image display and manipulation tool for the X     Window System. ImageMagick can read and write JPEG, TIFF, PNM, GIF,     and Photo CD image formats. It can resize, rotate, sharpen, color     reduce, or add special effects to an image, and when finished you can     either save the completed work in the original format or a different     one. ImageMagick also includes command line programs for creating     animated or transparent .gifs, creating composite images, creating     thumbnail images, and more.
    ImageMagick is one of your choices if you need a program to manipulate     and display images. If you want to develop your own applications     which use ImageMagick code or APIs, you need to install     ImageMagick-devel as well.
    Security issues fixed with this release:
    CVE-2016-3714     The (1) EPHEMERAL, (2) HTTPS, (3) MVG, (4) MSL, (5) TEXT, (6) SHOW,     (7) WIN, and (8) PLT coders in ImageMagick before 6.9.3-10 and 7.x     before 7.0.1-1 allow remote attackers to execute arbitrary code via     shell metacharacters in a crafted image, aka ImageTragick.
    CVE-2016-3715     The EPHEMERAL coder in ImageMagick before 6.9.3-10 and 7.x before     7.0.1-1 allows remote attackers to delete arbitrary files via a     crafted image.
    CVE-2016-3716     The MSL coder in ImageMagick before 6.9.3-10 and 7.x before 7.0.1-1     allows remote attackers to move arbitrary files via a crafted image.
    CVE-2016-3717     The LABEL coder in ImageMagick before 6.9.3-10 and 7.x before 7.0.1-1     allows remote attackers to read arbitrary files via a crafted image.
    CVE-2016-3718     The (1) HTTP and (2) FTP coders in ImageMagick before 6.9.3-10 and 7.x     before 7.0.1-1 allow remote attackers to conduct server-side request     forgery (SSRF) attacks via a crafted image.

Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
91119	SUSE SLES11 Security Update : ImageMagick (SUSE-SU-2016:1275-1) (ImageTragick)	Nessus	SuSE Local Security Checks	2016/5/13	2025/3/14	high
91180	SUSE SLES11 Security Update : ImageMagick (SUSE-SU-2016:1301-1) (ImageTragick)	Nessus	SuSE Local Security Checks	2016/5/17	2024/9/9	high
99784	EulerOS 2.0 SP1 : ImageMagick (EulerOS-SA-2016-1021)	Nessus	Huawei Local Security Checks	2017/5/1	2025/12/22	high
219582	Linux Distros Unpatched Vulnerability : CVE-2016-3714	Nessus	Misc.	2025/3/4	2026/7/24	high
289248	MiracleLinux 7 : ImageMagick-6.7.8.9-13.el7 (AXSA:2016-233:02)	Nessus	Miracle Linux Local Security Checks	2026/1/16	2026/1/17	high
289437	MiracleLinux 4 : ImageMagick-6.7.2.7-4.AXS4 (AXSA:2016-450:01)	Nessus	Miracle Linux Local Security Checks	2026/1/16	2026/1/17	high

检测

插件搜索

high

high

high

high

high

high