PT-2017-1559 · Imagemagick+2 · Imagemagick+2
Masaaki Chida
·
Publicado
2016-07-04
·
Atualizado
2017-03-24
·
CVE-2016-10048
CVSS v3.1
7.5
Alta
| Vetor | AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N |
Name of the Vulnerable Software and Affected Versions
ImageMagick versions 6.9.4-7
Description
The issue is related to a directory traversal vulnerability in the magick/module.c component of ImageMagick, which can be exploited by remote attackers to load arbitrary modules via unspecified vectors. This vulnerability is associated with insufficient restrictions on directory path names.
Recommendations
For ImageMagick versions 6.9.4-7, consider restricting access to the magick/module.c component to minimize the risk of exploitation until a patch is available. As a temporary workaround, avoid using the vulnerable module in sensitive operations. At the moment, there is no information about a newer version that contains a fix for this vulnerability.
Path traversal
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Enumeração de Fraquezas
Identificadores relacionados
Produtos afetados
Alt Linux
Imagemagick
Suse