Bob Friesenhahn from the GraphicsMagick project discovered a command injection vulnerability in ImageMagick, a program suite for image manipulation. An attacker with control on input image or the input filename can execute arbitrary commands with the privileges of the user running the application.

This update removes the possibility of using pipe (|) in filenames to interact with imagemagick.

It is important that you upgrade the libmagickcore5 and not just the imagemagick package. Applications using libmagickcore5 might also be affected and need to be restarted after the upgrade.

For Debian 7 'Wheezy', these problems have been fixed in version 8:6.7.7.10-5+deb7u6.

We recommend that you upgrade your imagemagick packages.

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

An update for ImageMagick is now available for Red Hat Enterprise Linux 6 and Red Hat Enterprise Linux 7.

Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

[Updated 18 July 2016] This advisory has been updated to push packages into the Red Hat Enterprise Linux 6 Desktop channels. The packages included in this revised update have not been changed in any way from the packages included in the original advisory.

ImageMagick is an image display and manipulation tool for the X Window System that can read and write multiple image formats.

Security Fix(es) :

* It was discovered that ImageMagick did not properly sanitize certain input before using it to invoke processes. A remote attacker could create a specially crafted image that, when processed by an application using ImageMagick or an unsuspecting user using the ImageMagick utilities, would lead to arbitrary execution of shell commands with the privileges of the user running the application.
(CVE-2016-5118)

* It was discovered that ImageMagick did not properly sanitize certain input before passing it to the gnuplot delegate functionality. A remote attacker could create a specially crafted image that, when processed by an application using ImageMagick or an unsuspecting user using the ImageMagick utilities, would lead to arbitrary execution of shell commands with the privileges of the user running the application. (CVE-2016-5239)

* Multiple flaws have been discovered in ImageMagick. A remote attacker could, for example, create specially crafted images that, when processed by an application using ImageMagick or an unsuspecting user using the ImageMagick utilities, would result in a memory corruption and, potentially, execution of arbitrary code, a denial of service, or an application crash. (CVE-2015-8896, CVE-2015-8895, CVE-2016-5240, CVE-2015-8897, CVE-2015-8898)

Bob Friesenhahn discovered a command injection vulnerability in Graphicsmagick, a program suite for image manipulation. An attacker with control on input image or the input filename can execute arbitrary commands with the privileges of the user running the application.

This update removes the possibility of using pipe (|) in filenames to interact with graphicsmagick.

For Debian 7 'Wheezy', these problems have been fixed in version 1.3.16-1.1+deb7u2.

We recommend that you upgrade your graphicsmagick packages.

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for ImageMagick fixes the following issues :

  - security update :

  - CVE-2016-5118 [boo#982178]

  + ImageMagick-CVE-2016-5118.patch

This update for ImageMagick fixes the following issues :

  - CVE-2016-5118: popen() shell vulnerability via filenames     (bsc#982178)

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
91444	Debian DLA-500-1 : imagemagick security update	Nessus	Debian Local Security Checks	2016/6/3	2021/1/11	critical
91636	CentOS 6 / 7 : ImageMagick (CESA-2016:1237)	Nessus	CentOS Local Security Checks	2016/6/17	2021/1/4	critical
91446	Debian DLA-502-1 : graphicsmagick security update	Nessus	Debian Local Security Checks	2016/6/3	2021/1/11	critical
91555	openSUSE Security Update : ImageMagick (openSUSE-2016-700)	Nessus	SuSE Local Security Checks	2016/6/10	2021/1/19	critical
93155	SUSE SLES11 Security Update : ImageMagick (SUSE-SU-2016:1610-1)	Nessus	SuSE Local Security Checks	2016/8/29	2026/1/28	critical

检测

插件搜索

critical

critical

critical

critical

critical