git.imagemagick.orgConfirmation
http://git.imagemagick.org/repos/ImageMagick/blob/a01518e08c840577cabd7d3ff291a9ba735f7276/ChangeLog CVE-2016-3717
MEDIUM
ImageMagick 7.0.1-0 / 6.9.3-9 - 'ImageTragick ' Multiple Vulnerabilities
Record summary
CVE-2016-3717 has a selected CVSS score of 5.5 (medium); EIP currently links 1 catalogued exploit.
Description
The LABEL coder in ImageMagick before 6.9.3-10 and 7.x before 7.0.1-1 allows remote attackers to read arbitrary files via a crafted image.
Description source: CVE List
Exploitation context
Available material
- Catalogued exploits
- 1
Proofs of concept
1Catalogued exploits
ExploitDBImageMagick 7.0.1-0 / 6.9.3-9 - 'ImageTragick ' Multiple VulnerabilitiesExploitDB exploitby Nikolay ErmishkinNot analyzed1 file
References
Showing 12 of 23SUSE-SU-2016:1260Vendor advisory
http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00024.html openSUSE-SU-2016:1261Vendor advisory
http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00025.html openSUSE-SU-2016:1266Vendor advisory
http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00028.html SUSE-SU-2016:1275Vendor advisory
http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00032.html openSUSE-SU-2016:1326Vendor advisory
http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00051.html RHSA-2016:0726Vendor advisory
http://rhn.redhat.com/errata/RHSA-2016-0726.html DSA-3580Vendor advisory
http://www.debian.org/security/2016/dsa-3580 [oss-security] 20160504 Re: ImageMagick Is On Fire -- CVE-2016-3714mailing list
http://www.openwall.com/lists/oss-security/2016/05/03/18 oracle.comConfirmation
http://www.oracle.com/technetwork/topics/security/bulletinjul2016-3090568.html oracle.comConfirmation
http://www.oracle.com/technetwork/topics/security/linuxbulletinapr2016-2952096.html 20160513 May 2016 - HipChat Server - Critical Security Advisorymailing list
http://www.securityfocus.com/archive/1/538378/100/0/threaded