5.5Orta KEV

CVE-2016-3718ImageMagick Server-Side Request Forgery (SSRF) Vulnerability

redhat enterprise linux desktop; redhat enterprise linux eus; redhat enterprise linux for ibm z systems; redhat enterprise linux for ibm z systems eus Yayım: 2016-05-05 21:00 (10 yıl önce)

Aktif olarak istismar ediliyor — ImageMagick Server-Side Request Forgery (SSRF) Vulnerability

CISA bu açığın gerçek saldırılarda kullanıldığını 03.11.2021 tarihinde doğruladı. ABD federal kurumları için düzeltme son tarihi: 03.05.2022.

Gerekli işlem: Apply updates per vendor instructions. https://nvd.nist.gov/vuln/detail/CVE-2016-3718

Açıklama

The (1) HTTP and (2) FTP coders in ImageMagick before 6.9.3-10 and 7.x before 7.0.1-1 allow remote attackers to conduct server-side request forgery (SSRF) attacks via a crafted image.

Zayıflık türü (CWE): CWE-918

Veri: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Bilgiler kaynaktaki haliyle, İngilizce yayımlanır.

Etkilenen ürünler ve sürümler

Üretici	Ürün	Sürümler
canonical	ubuntu linux	12.04
imagemagick	imagemagick	< 6.9.3-10
opensuse	leap	42.1
opensuse	opensuse	13.2
oracle	linux	6
oracle	solaris	10
redhat	enterprise linux desktop	6.0
redhat	enterprise linux eus	6.7
redhat	enterprise linux for ibm z systems	6.0_s390x
redhat	enterprise linux for ibm z systems eus	6.7_s390x
redhat	enterprise linux for power big endian	6.0_ppc64
redhat	enterprise linux for power big endian eus	6.7_ppc64
redhat	enterprise linux for power little endian	7.0_ppc64le
redhat	enterprise linux for power little endian eus	7.2_ppc64le
redhat	enterprise linux hpc node	6.0
redhat	enterprise linux hpc node eus	7.2
redhat	enterprise linux server	6.0
redhat	enterprise linux server aus	7.2
redhat	enterprise linux server from rhui	6.0
redhat	enterprise linux server supplementary eus	6.7z
redhat	enterprise linux server tus	7.2
redhat	enterprise linux workstation	6.0
suse	linux enterprise debuginfo	11
suse	linux enterprise desktop	12
suse	linux enterprise server	11
suse	linux enterprise software development kit	11
suse	linux enterprise workstation extension	12
suse	manager	2.1
suse	manager proxy	2.1
suse	openstack cloud	5

Kaynaklar ve yamalar

http://git.imagemagick.org/repos/ImageMagick/blob/a01518e08c840577cabd7d3ff291a9ba735f7276/ChangeLog PatchVendor Advisory
openSUSE-SU-2016:1266 vendor-advisoryThird Party Advisory
http://www.oracle.com/technetwork/topics/security/linuxbulletinapr2016-2952096.html Third Party Advisory
https://www.imagemagick.org/discourse-server/viewtopic.php?f=4&t=29588 Vendor Advisory
openSUSE-SU-2016:1326 vendor-advisoryThird Party Advisory
USN-2990-1 vendor-advisoryThird Party Advisory
openSUSE-SU-2016:1261 vendor-advisoryThird Party Advisory
20160513 May 2016 - HipChat Server - Critical Security Advisory mailing-listBroken LinkThird Party AdvisoryVDB Entry
39767 exploitThird Party AdvisoryVDB Entry
SUSE-SU-2016:1260 vendor-advisoryThird Party Advisory
[debian-lts-announce] 20180627 [SECURITY] [DLA 1401-1] graphicsmagick security update mailing-listMailing ListThird Party Advisory
http://www.oracle.com/technetwork/topics/security/bulletinjul2016-3090568.html Third Party Advisory
[oss-security] 20160504 Re: ImageMagick Is On Fire -- CVE-2016-3714 mailing-listMailing ListThird Party Advisory
GLSA-201611-21 vendor-advisoryThird Party Advisory
SUSE-SU-2016:1275 vendor-advisoryThird Party Advisory
SSA:2016-132-01 vendor-advisoryThird Party Advisory
https://www.imagemagick.org/script/changelog.php Release Notes
DSA-3580 vendor-advisoryMailing ListThird Party Advisory
RHSA-2016:0726 vendor-advisoryThird Party Advisory
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2016-3718 US Government Resource

CPE eşleşmeleri (NVD) (60)

cpe:2.3:o:redhat:enterprise_linux_desktop:6.0:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_desktop:7.0:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_eus:6.7:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_eus:7.2:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_eus:7.3:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_eus:7.4:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_eus:7.5:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_eus:7.6:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_eus:7.7:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_for_ibm_z_systems:6.0_s390x:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_for_ibm_z_systems:7.0_s390x:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_for_ibm_z_systems_eus:6.7_s390x:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_for_ibm_z_systems_eus:7.2_s390x:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_for_ibm_z_systems_eus:7.3_s390x:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_for_ibm_z_systems_eus:7.4_s390x:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_for_ibm_z_systems_eus:7.5_s390x:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_for_ibm_z_systems_eus:7.6_s390x:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_for_ibm_z_systems_eus:7.7_s390x:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_for_power_big_endian:6.0_ppc64:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_for_power_big_endian:7.0_ppc64:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_for_power_big_endian_eus:6.7_ppc64:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_for_power_big_endian_eus:7.2_ppc64:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_for_power_big_endian_eus:7.3_ppc64:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_for_power_big_endian_eus:7.4_ppc64:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_for_power_big_endian_eus:7.5_ppc64:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_for_power_big_endian_eus:7.6_ppc64:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_for_power_big_endian_eus:7.7_ppc64:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_for_power_little_endian:7.0_ppc64le:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_for_power_little_endian_eus:7.2_ppc64le:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_for_power_little_endian_eus:7.3_ppc64le:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_for_power_little_endian_eus:7.4_ppc64le:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_for_power_little_endian_eus:7.5_ppc64le:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_for_power_little_endian_eus:7.6_ppc64le:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_for_power_little_endian_eus:7.7_ppc64le:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_hpc_node:6.0:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_hpc_node:7.0:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_hpc_node_eus:7.2:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_server:6.0:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_server:7.0:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_server_aus:7.2:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_server_aus:7.3:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_server_aus:7.4:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_server_aus:7.6:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_server_aus:7.7:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_server_from_rhui:6.0:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_server_from_rhui:7.0:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_server_supplementary_eus:6.7z:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_server_tus:7.2:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_server_tus:7.3:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_server_tus:7.6:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_server_tus:7.7:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_workstation:6.0:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_workstation:7.0:*:*:*:*:*:*:*
cpe:2.3:a:imagemagick:imagemagick:*:*:*:*:*:*:*:* < 6.9.3-10
cpe:2.3:a:imagemagick:imagemagick:7.0.0-0:*:*:*:*:*:*:*
cpe:2.3:a:imagemagick:imagemagick:7.0.1-0:*:*:*:*:*:*:*
cpe:2.3:o:canonical:ubuntu_linux:12.04:*:*:*:lts:*:*:*
cpe:2.3:o:canonical:ubuntu_linux:14.04:*:*:*:esm:*:*:*
cpe:2.3:o:canonical:ubuntu_linux:15.10:*:*:*:*:*:*:*
cpe:2.3:o:canonical:ubuntu_linux:16.04:*:*:*:esm:*:*:*

CVSS puanı

5.5Orta

Kaynak: CISA-ADP · CVSS 3.1

Saldırı yolu: Yerel
Karmaşıklık: Düşük
Gereken yetki: Yok
Kullanıcı etkileşimi: Gerekir
Kapsam: Değişmez
Gizlilik: Yok
Bütünlük: Yüksek
Erişilebilirlik: Yok

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N

Tüm puanlar (4)

CISA-ADP	CVSS 3.1	5.5Orta
nvd	CVSS 3.1	5.5Orta
134c704f-9b21-4f2e-91b3-4a467353bcc0	CVSS 3.1	5.5Orta
nvd	CVSS 2.0	4.3Orta

EPSS (30 günde istismar olasılığı)

75.65%

tüm CVE'lerin %100'inden yüksek

CISA değerlendirmesi (SSVC)

İstismar: active
Otomatikleştirilebilir: no
Teknik etki: partial

Zaman çizelgesi

Numara ayrıldı2016-03-30
Yayımlandı2016-05-05 21:00
IP-DB'ye ulaştı2026-10-24 23:35
KEV'e eklendi2021-11-03
Son güncelleme2026-06-17 03:46

Numarayı veren (CNA): redhat
NVD durumu: Analyzed

Kaynakta görüntüle: CVE.org · NVD

Bu ürünlerde yeni bir açık çıktığında haber alın

E-posta uyarılarını aç

Ücretsiz · üyelikle · istediğiniz an kapatılır

Aynı üründe son açıklar — Red Hat Enterprise Linux

6.5Orta

CVE-2026-121259 dün

Gst-plugins-bad: gst-plugins-bad: integer overflows and division by zero in jpeg 2000 decimator

Red Hat Red Hat Enterprise Linux 10; Red Hat Red Hat Enterprise Linux 7; Red Hat Red Hat Enterprise Linux 8; Red Hat Red Hat Enterprise Linux 9

A flaw was found in the GStreamer JPEG 2000 decimator in gst-plugins-bad. Crafted JPEG 2000 media can cause integer overflows or division by zero during tile processing. An application that processes the malicious media may crash, resulting in a denial of service.

6.5Orta

CVE-2026-119843 dün

Gst-plugins-good: assertion failures in FLV demuxer when parsing malformed enhanced audio/video tags

Red Hat Red Hat Enterprise Linux 10; Red Hat Red Hat Enterprise Linux 7; Red Hat Red Hat Enterprise Linux 8; Red Hat Red Hat Enterprise Linux 9

A flaw was found in GStreamer's gst-plugins-good package. The FLV media demuxer does not properly validate buffer sizes and data availability when processing enhanced audio and video tags in malformed or truncated FLV streams. A remote attacker could exploit …

6.5Orta

CVE-2026-120831 2 gün önce

Libslirp: libslirp: queue pointer corruption in if_output() leading to denial of service

Red Hat Red Hat Enterprise Linux 10; Red Hat Red Hat Enterprise Linux 8; Red Hat Red Hat Enterprise Linux 9; Red Hat Red Hat OpenShift Container Platform 4

A flaw was found in libslirp in if_output(). When moving a session from the fast queue to the batch queue, the code unlinked and reinserted an arbitrary packet via ifm->m_nextpkt instead of the session queue head, corrupting queue pointers. A guest generating…

7.4Yüksek

CVE-2026-120830 2 gün önce

Libslirp: libslirp: out-of-bounds heap read in icmp_forward_error() leading to information disclosure

Red Hat Red Hat Enterprise Linux 10; Red Hat Red Hat Enterprise Linux 8; Red Hat Red Hat Enterprise Linux 9; Red Hat Red Hat OpenShift Container Platform 4

A flaw was found in libslirp in icmp_forward_error(). When building an ICMP error response, the length of the quoted original IPv4 packet was taken from the IP header without clamping it to the actual buffer length. A truncated or malformed packet could cause…

2.0Düşük

CVE-2026-120740 2 gün önce

Hivex: hivex: denial of service via out-of-bounds read in big-data block processing

Red Hat Red Hat Enterprise Linux 10; Red Hat Red Hat Enterprise Linux 6; Red Hat Red Hat Enterprise Linux 7; Red Hat Red Hat Enterprise Linux 8

A flaw was found in hivex. By supplying a specially crafted Windows registry hive file, an attacker can trigger an out-of-bounds memory read when hivex parses registry values containing malformed large data block lists. This issue can cause the application pr…

7.5Yüksek

CVE-2026-120194 4 gün önce

Json-glib: json-glib: infinite loop in json_path_query() with negative jsonpath slice step

Red Hat Red Hat Enterprise Linux 10; Red Hat Red Hat Enterprise Linux 7; Red Hat Red Hat Enterprise Linux 8; Red Hat Red Hat Enterprise Linux 9

A flaw was found in json-glib. The JSONPath slice evaluator used by json_path_query() can enter an infinite loop when given a slice expression with a negative step. An application that evaluates attacker-controlled JSONPath expressions can be forced into a ha…