ImageMagick · ImageMagick
CVE-2016-3718
ImageMagick Server-Side Request Forgery (SSRF) Vulnerability
Exploited in attacks
Medium 5.5 Attack chance: 76%
What it is
The (1) HTTP and (2) FTP coders in ImageMagick before 6.9.3-10 and 7.x before 7.0.1-1 allow remote attackers to conduct server-side request forgery (SSRF) attacks via a crafted image.
CISA: ImageMagick contains an unspecified vulnerability that allows attackers to perform server-side request forgery (SSRF) via a crafted image.
What to do
Apply updates per vendor instructions.
Deadline for US federal agencies: May 3, 2022
- Added to the CISA list
- November 3, 2021
- Published
- May 5, 2016
- Severity
- Medium 5.5 CVSS 3.1
- Chance of attacks in the next 30 days (EPSS)
- 76% in the top 0.5% of all known vulnerabilities
- Weakness
- CWE-20
- More details
- NVD · CVE.org · CISA
All references (19)
- http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00028.html
- http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00051.html
- http://www.ubuntu.com/usn/USN-2990-1
- http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00025.html
- http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00024.html
- https://security.gentoo.org/glsa/201611-21
- http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00032.html
- http://www.slackware.com/security/viewer.php?l=slackware-security&y=2016&m=slackware-security.440568
- http://www.debian.org/security/2016/dsa-3580
- http://rhn.redhat.com/errata/RHSA-2016-0726.html
- http://git.imagemagick.org/repos/ImageMagick/blob/a01518e08c840577cabd7d3ff291a9ba735f7276/ChangeLog
- http://www.oracle.com/technetwork/topics/security/linuxbulletinapr2016-2952096.html
- https://www.imagemagick.org/discourse-server/viewtopic.php?f=4&t=29588
- http://www.securityfocus.com/archive/1/538378/100/0/threaded
- https://www.exploit-db.com/exploits/39767/
- https://lists.debian.org/debian-lts-announce/2018/06/msg00009.html
- http://www.oracle.com/technetwork/topics/security/bulletinjul2016-3090568.html
- http://www.openwall.com/lists/oss-security/2016/05/03/18
- https://www.imagemagick.org/script/changelog.php
More exploited flaws from ImageMagick
| Added | Vulnerability | Product | Severity | Attack chance |
|---|---|---|---|---|
| Sep 9, 2024 | Improper Input Validation | ImageMagick | High 8.4 | 97% |
| Nov 3, 2021 | Arbitrary File Deletion | ImageMagick | Medium 5.5 | 75% |
Sources: Known Exploited Vulnerabilities (CISA, public domain), CVE records (cve.org) and EPSS (FIRST). The chance of attacks is the EPSS estimate that someone will try to exploit the flaw in the next 30 days.