CVE-2016-5118

EPSS 49.3%

The OpenBlob function in blob.c in GraphicsMagick before 1.3.24 and ImageMagick allows remote attackers to execute arbitrary code via a | (pipe) character at the start of a filename.

Productos afectados

n/a · n/a

¿Quieres saber si tu infraestructura está expuesta a esto?

Hablar con TrueHacking →

Referencias

http://git.imagemagick.org/repos/ImageMagick/commit/40639d173aa8c76b850d625c630b711fee4dcfb8 http://hg.code.sf.net/p/graphicsmagick/code/file/41876934e762/ChangeLog http://hg.code.sf.net/p/graphicsmagick/code/rev/ae3928faa858 http://lists.opensuse.org/opensuse-security-announce/2016-06/msg00008.html http://lists.opensuse.org/opensuse-security-announce/2016-06/msg00009.html http://lists.opensuse.org/opensuse-security-announce/2016-06/msg00011.html http://lists.opensuse.org/opensuse-security-announce/2016-06/msg00021.html http://lists.opensuse.org/opensuse-security-announce/2016-06/msg00030.html http://lists.opensuse.org/opensuse-security-announce/2016-06/msg00032.html http://lists.opensuse.org/opensuse-security-announce/2016-06/msg00047.html https://access.redhat.com/errata/RHSA-2016:1237 http://www.debian.org/security/2016/dsa-3591