CVE-2016-3715mediumunder attackCWE-552

CVE-2016-3715

Published · Updated

85Vexday Risk Score

Prioritize patching. It under exploitation confirmed by CISA and has a public proof of concept.

ssvc Actcvss 5.5epss 75%
from disclosure to weapon0 days
Published on NVDMay 5
1st PoCMay 4
CISA KEV+2008d
exploitation probability
75%top 1% of all CVEs
observed exploitation
yesCISA + VulnCheck
2 public exploit(s)
What the vendors declare (VEX)

Official vendor statements in CSAF/VEX format: whether their product is affected, already fixed, or ruled out — and why. These are the vendor's assertions, not Vexday's judgment.

Red HatVEX document ↗
Affected
1 product
Red Hat OpenShift Enterprise 2
workaround: Details can be found under the resolve tab at https://access.redhat.com/security/vulnerabilities/2296071 Red Hat Enterprise Linux 6 and 7 ================================ As a workaround the /etc/ImageMagick/policy.xml file can be edited to…
Fixed
14 products (581 components)
Red Hat Enterprise Linux Client (v. 7) · Red Hat Enterprise Linux Client Optional (v. 7) · Red Hat Enterprise Linux ComputeNode Optional (v. 7) · Red Hat Enterprise Linux Server (v. 7) · Red Hat Enterprise Linux Server Optional (v. 7) · and others 9
fix ↗
Not affected
1 product — because the vulnerable code is not present in the product
Red Hat Enterprise Linux 5
Action required by CISAfederal deadline: 2022-05-03

Apply updates per vendor instructions.

In short

ImageMagick's EPHEMERAL coder had a flaw that allowed attackers to delete files on a system by uploading a specially crafted image. This is dangerous because it could lead to loss of important data or system instability.

Technical detail

The EPHEMERAL coder in ImageMagick before 6.9.3-10 and 7.x before 7.0.1-1 is vulnerable to arbitrary file deletion via malicious image input. An attacker can craft a specially formatted image file that, when processed by the vulnerable coder, results in deletion of arbitrary files with the privileges of the ImageMagick process. This requires the application to process untrusted image files without proper validation.

Summary generated and translated by AI from the official description.

The full analysis of this CVE is available in Portuguese →

The EPHEMERAL coder in ImageMagick before 6.9.3-10 and 7.x before 7.0.1-1 allows remote attackers to delete arbitrary files via a crafted image.
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N
Affected products
n/a · n/a
public PoCs found — 2
exploitdbwww.exploit-db.com/exploits/39767unverifiedcve_referencewww.exploit-db.com/exploits/39767/unverified
⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.
References
http://git.imagemagick.org/repos/ImageMagick/blob/a01518e08c840577cabd7d3ff291a9ba735f7276/ChangeLoghttp://lists.opensuse.org/opensuse-security-announce/2016-05/msg00024.htmlhttp://lists.opensuse.org/opensuse-security-announce/2016-05/msg00025.htmlhttp://lists.opensuse.org/opensuse-security-announce/2016-05/msg00028.htmlhttp://lists.opensuse.org/opensuse-security-announce/2016-05/msg00032.htmlhttp://lists.opensuse.org/opensuse-security-announce/2016-05/msg00051.htmlhttp://rhn.redhat.com/errata/RHSA-2016-0726.htmlhttps://security.gentoo.org/glsa/201611-21https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2016-3715https://www.exploit-db.com/exploits/39767/https://www.imagemagick.org/discourse-server/viewtopic.php?f=4&t=29588https://www.imagemagick.org/script/changelog.php