CVE-2016-3714
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
Patch now. It under exploitation confirmed by CISA and has a working public exploit.
Official vendor statements in CSAF/VEX format: whether their product is affected, already fixed, or ruled out — and why. These are the vendor's assertions, not Vexday's judgment.
Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
ImageMagick, an image processing tool, fails to properly validate image file names and formats, allowing attackers to inject shell commands that execute as the user running the application. This is dangerous because an attacker can trick someone into processing a specially crafted image to gain control of the system.
Multiple ImageMagick coders (EPHEMERAL, HTTPS, MVG, MSL, TEXT, SHOW, WIN, PLT) improperly sanitize image filenames and delegate command parameters, allowing shell metacharacter injection via crafted images. An attacker can exploit this through remote image processing requests to achieve arbitrary code execution with the privileges of the ImageMagick process.
The full analysis of this CVE is available in Portuguese →