Red Hat Security AdvisoryRHSA-2016:0726
ImageMagick security update
Released 2016-05-09 · Red Hat rating Important · View on Red Hat →
Fixed in
- Red Hat Enterprise Linux Client (v. 7) ImageMagick-6.7.8.9-13.el7_2, ImageMagick-c++-6.7.8.9-13.el7_2
- Red Hat Enterprise Linux Client Optional (v. 7) ImageMagick-c++-devel-6.7.8.9-13.el7_2, ImageMagick-devel-6.7.8.9-13.el7_2, ImageMagick-doc-6.7.8.9-13.el7_2 +1
- Red Hat Enterprise Linux ComputeNode Optional (v. 7) ImageMagick-6.7.8.9-13.el7_2, ImageMagick-c++-6.7.8.9-13.el7_2, ImageMagick-c++-devel-6.7.8.9-13.el7_2 +3
- Red Hat Enterprise Linux Desktop (v. 6) ImageMagick-6.7.2.7-4.el6_7, ImageMagick-c++-6.7.2.7-4.el6_7
- Red Hat Enterprise Linux Desktop Optional (v. 6) ImageMagick-c++-6.7.2.7-4.el6_7, ImageMagick-c++-devel-6.7.2.7-4.el6_7, ImageMagick-devel-6.7.2.7-4.el6_7 +2
- Red Hat Enterprise Linux HPC Node Optional (v. 6) ImageMagick-6.7.2.7-4.el6_7, ImageMagick-c++-6.7.2.7-4.el6_7, ImageMagick-c++-devel-6.7.2.7-4.el6_7 +3
- Red Hat Enterprise Linux Server (v. 6) ImageMagick-6.7.2.7-4.el6_7, ImageMagick-6.7.2.7-4.el6_7.ppc, ImageMagick-c++-6.7.2.7-4.el6_7
- Red Hat Enterprise Linux Server (v. 7) ImageMagick-6.7.8.9-13.el7_2, ImageMagick-6.7.8.9-13.el7_2.ppc, ImageMagick-c++-6.7.8.9-13.el7_2 +1
- Red Hat Enterprise Linux Server Optional (v. 6) ImageMagick-c++-6.7.2.7-4.el6_7, ImageMagick-c++-6.7.2.7-4.el6_7.ppc, ImageMagick-c++-devel-6.7.2.7-4.el6_7 +5
- Red Hat Enterprise Linux Server Optional (v. 7) ImageMagick-c++-6.7.8.9-13.el7_2, ImageMagick-c++-6.7.8.9-13.el7_2.ppc, ImageMagick-c++-devel-6.7.8.9-13.el7_2 +4
- Red Hat Enterprise Linux Workstation (v. 6) ImageMagick-6.7.2.7-4.el6_7, ImageMagick-c++-6.7.2.7-4.el6_7
- Red Hat Enterprise Linux Workstation (v. 7) ImageMagick-6.7.8.9-13.el7_2, ImageMagick-c++-6.7.8.9-13.el7_2, ImageMagick-perl-6.7.8.9-13.el7_2
- Red Hat Enterprise Linux Workstation Optional (v. 6) ImageMagick-c++-6.7.2.7-4.el6_7, ImageMagick-c++-devel-6.7.2.7-4.el6_7, ImageMagick-devel-6.7.2.7-4.el6_7 +2
- Red Hat Enterprise Linux Workstation Optional (v. 7) ImageMagick-c++-devel-6.7.8.9-13.el7_2, ImageMagick-devel-6.7.8.9-13.el7_2, ImageMagick-doc-6.7.8.9-13.el7_2
Fixes 5 records
Priority CRITICAL 96KEV
The (1) EPHEMERAL, (2) HTTPS, (3) MVG, (4) MSL, (5) TEXT, (6) SHOW, (7) WIN, and (8) PLT coders in ImageMagick before 6.9.3-10 and 7.x before 7.0.1-1 allow remote attackers to execute arbitrary code via shell metacharact…
CVSS 3.1HIGH 8.4· Local · No auth · No interaction · EPSS 0.97485 · Published 2016-05-05 · Partial fix CWE-20
Priority HIGH 82KEV
The (1) HTTP and (2) FTP coders in ImageMagick before 6.9.3-10 and 7.x before 7.0.1-1 allow remote attackers to conduct server-side request forgery (SSRF) attacks via a crafted image.
CVSS 3.1MEDIUM 5.5· Local · No auth · User interaction · EPSS 0.7565 · Published 2016-05-05 · Partial fix CWE-918
Priority HIGH 82KEV
The EPHEMERAL coder in ImageMagick before 6.9.3-10 and 7.x before 7.0.1-1 allows remote attackers to delete arbitrary files via a crafted image.
CVSS 3.1MEDIUM 5.5· Local · No auth · User interaction · EPSS 0.75307 · Published 2016-05-05 · Partial fix CWE-552
Priority MEDIUM 44
The LABEL coder in ImageMagick before 6.9.3-10 and 7.x before 7.0.1-1 allows remote attackers to read arbitrary files via a crafted image.
CVSS 3.0MEDIUM 5.5· Local · Low privileges · No interaction · EPSS 0.2044 · Published 2016-05-05 · Partial fix CWE-200
Priority LOW 29
The MSL coder in ImageMagick before 6.9.3-10 and 7.x before 7.0.1-1 allows remote attackers to move arbitrary files via a crafted image.
CVSS 3.0LOW 3.3· Local · No auth · User interaction · EPSS 0.11338 · Published 2016-05-05 · Partial fix CWE-264
THREATIST.IORead the docs