PT-2017-1559 · Imagemagick+2 · Imagemagick+2

Masaaki Chida · Published 2016-07-04 · Updated 2017-03-24 · CVE-2016-10048

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions ImageMagick versions 6.9.4-7

Description The issue is related to a directory traversal vulnerability in the magick/module.c component of ImageMagick, which can be exploited by remote attackers to load arbitrary modules via unspecified vectors. This vulnerability is associated with insufficient restrictions on directory path names.

Recommendations For ImageMagick versions 6.9.4-7, consider restricting access to the magick/module.c component to minimize the risk of exploitation until a patch is available. As a temporary workaround, avoid using the vulnerable module in sensitive operations. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

ALT-PU-2016-1708

BDU:2017-00704

CVE-2016-10048

DLA-731-1

DSA-3652-1

SUSE-SU-2017:0518-1

SUSE-SU-2017:0529-1

SUSE-SU-2017:0586-1

SUSE-SU-2017_0518-1

Affected Products

Alt Linux

Imagemagick

Suse

References · 168

• https://github.com/ImageMagick/ImageMagick/commit/fc6080f1321fd21e86ef916195cc110b05d9effb · Vendor Advisory
• https://bdu.fstec.ru/vul/2017-00704 · Security Note
• https://cve.org/CVERecord?id=CVE-2016-10048 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-7537 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-6823 · Security Note
• http://lists.opensuse.org/opensuse-updates/2017-02/msg00028.html · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2016-10048 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2016-10048 · Vendor Advisory
• https://errata.altlinux.org/ALT-PU-2016-1708 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-7532 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-7514 · Security Note
• https://osv.dev/vulnerability/DSA-3652-1 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-5842 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-7538 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-4563 · Security Note