Log in Start free

Actively exploited · Published May 5, 2016 · Assigned by redhat

CVE-2016-3714

High 8.4 Exploited

In plain English

A high-severity improper input validation in ImageMagick from ImageMagick. Attackers are actively exploiting it in the wild (listed by CISA on September 9, 2024). The chance it is exploited in the next 30 days is estimated at 97.5% (higher than 99.9% of all known vulnerabilities). Ready-made attack tooling exists: Metasploit, public proof-of-concept code. Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)8.4High
Exploit odds (30 days)97.5%top 0.1% of all CVEs
Exploited in the wildYesCISA KEV since Sep 9, 2024
Attack tooling2Metasploit, Public PoC

CISA guidance

Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

Federal agencies must remediate by Sep 30, 2024.

Official description

The (1) EPHEMERAL, (2) HTTPS, (3) MVG, (4) MSL, (5) TEXT, (6) SHOW, (7) WIN, and (8) PLT coders in ImageMagick before 6.9.3-10 and 7.x before 7.0.1-1 allow remote attackers to execute arbitrary code via shell metacharacters in a crafted image, aka "ImageTragick."

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Debian:12graphicsmagick1.3.24-1DEBIAN-CVE-2016-3714
Debian:13graphicsmagick1.3.24-1DEBIAN-CVE-2016-3714
Debian:14graphicsmagick1.3.24-1DEBIAN-CVE-2016-3714
Debian:12imagemagick8:6.9.6.2+dfsg-2DEBIAN-CVE-2016-3714
Debian:13imagemagick8:6.9.6.2+dfsg-2DEBIAN-CVE-2016-3714
Debian:14imagemagick8:6.9.6.2+dfsg-2DEBIAN-CVE-2016-3714

Affected products (as reported)

VendorProductVersions
n/a n/a n/a

Weakness: CWE-20 · Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

References