Nikolay Ermishkin

**Name of the Vulnerable Software and Affected Versions** ImageMagick versions prior to 6.9.3-10 ImageMagick versions 7.x prior to 7.0.1-1 **Description** The issue exists due to insufficient input validation in the EPHEMERAL, HTTPS, MVG, MSL, TEXT, SHOW, WIN, and PLT coders of the ImageMagick console graphics editor. This allows a remote attacker to execute arbitrary code using metacharacters in a specially crafted image. **Recommendations** For ImageMagick versions prior to 6.9.3-10, update to version 6.9.3-10 or later. For ImageMagick versions 7.x prior to 7.0.1-1, update to version 7.0.1-1 or later. As a temporary workaround, consider disabling the vulnerable coders until a patch is available. Restrict access to the `EPHEMERAL`, `HTTPS`, `MVG`, `MSL`, `TEXT`, `SHOW`, `WIN`, and `PLT` coders to minimize the risk of exploitation. Avoid using shell metacharacters in crafted images until the issue is resolved.

**Name of the Vulnerable Software and Affected Versions** ImageMagick versions prior to 6.9.3-10 ImageMagick versions 7.x prior to 7.0.1-1 **Description** The issue is related to insufficient access control in the EPHEMERAL coder of the ImageMagick console graphic editor. It allows a remote attacker to delete arbitrary files using a specially crafted image. **Recommendations** For ImageMagick versions prior to 6.9.3-10, update to version 6.9.3-10 or later. For ImageMagick versions 7.x prior to 7.0.1-1, update to version 7.0.1-1 or later. As a temporary workaround, consider restricting access to the EPHEMERAL coder until a patch is available.

**Name of the Vulnerable Software and Affected Versions** ImageMagick versions prior to 6.9.3-10 ImageMagick versions 7.x prior to 7.0.1-1 **Description** The issue allows remote attackers to move arbitrary files via a crafted image. **Recommendations** For versions prior to 6.9.3-10, update to version 6.9.3-10 or later. For versions 7.x prior to 7.0.1-1, update to version 7.0.1-1 or later.

**Name of the Vulnerable Software and Affected Versions** ImageMagick versions 6.9.3-10 and earlier ImageMagick versions 7.x prior to 7.0.1-1 **Description** The issue is related to the implementation of the HTTP and FTP protocols in ImageMagick, which allows remote attackers to conduct server-side request forgery (SSRF) attacks via a crafted image. This is due to insufficient authentication of executed requests. The estimated number of potentially affected devices worldwide is not specified. There is no information provided about real-world incidents where this issue was exploited. **Recommendations** For ImageMagick versions 6.9.3-10 and earlier, update to version 6.9.3-10 or later. For ImageMagick versions 7.x prior to 7.0.1-1, update to version 7.0.1-1 or later. As a temporary workaround, consider restricting access to the HTTP and FTP coders until a patch is available.