Log in Start free

Actively exploited · Published May 5, 2016 · Assigned by redhat

CVE-2016-3715

Medium 5.5 Exploited

In plain English

A medium-severity security flaw in ImageMagick from ImageMagick. Attackers are actively exploiting it in the wild (listed by CISA on November 3, 2021). The chance it is exploited in the next 30 days is estimated at 75.3% (higher than 99.5% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)5.5Medium
Exploit odds (30 days)75.3%top 0.5% of all CVEs
Exploited in the wildYesCISA KEV since Nov 3, 2021
Attack toolingNoneno public tooling known

CISA guidance

Apply updates per vendor instructions.

Federal agencies must remediate by May 3, 2022.

Official description

The EPHEMERAL coder in ImageMagick before 6.9.3-10 and 7.x before 7.0.1-1 allows remote attackers to delete arbitrary files via a crafted image.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Debian:12graphicsmagick1.3.24-1DEBIAN-CVE-2016-3715
Debian:13graphicsmagick1.3.24-1DEBIAN-CVE-2016-3715
Debian:14graphicsmagick1.3.24-1DEBIAN-CVE-2016-3715
Debian:12imagemagick8:6.9.6.2+dfsg-2DEBIAN-CVE-2016-3715
Debian:13imagemagick8:6.9.6.2+dfsg-2DEBIAN-CVE-2016-3715
Debian:14imagemagick8:6.9.6.2+dfsg-2DEBIAN-CVE-2016-3715

Affected products (as reported)

VendorProductVersions
n/a n/a n/a

Weakness: CWE-552 · Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N

References