CVE-2016-3714 ImageMagick Improper Input Validation
Remote attackers can execute arbitrary code via shell metacharacters in crafted images processed by ImageMagick coders.
- Exploited in the wild
- Since 9 Sep 2024
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2016-3714?
CVE-2016-3714 is a high-severity command injection vulnerability in Canonical Ubuntu Linux, published on 5 May 2016. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
The (1) EPHEMERAL, (2) HTTPS, (3) MVG, (4) MSL, (5) TEXT, (6) SHOW, (7) WIN, and (8) PLT coders in ImageMagick before 6.9.3-10 and 7.x before 7.0.1-1 allow remote attackers to execute arbitrary code via shell metacharacters in a crafted image, aka "ImageTragick."
Weakness: CWE-20
Which versions are affected by CVE-2016-3714?
It affects 6 products.
Linux distribution packages (9)
ImageMagick SUSE:Linux Enterprise Server 11 SP2-LTSS | All versions | 6.4.3.6-7.37.1 |
ImageMagick SUSE:Linux Enterprise Server 11 SP3-LTSS | All versions | 6.4.3.6-7.37.1 |
ImageMagick SUSE:Linux Enterprise Server 11 SP3-TERADATA | All versions | 6.4.3.6-7.37.1 |
ImageMagick SUSE:Linux Enterprise Server 11 SP4 | All versions | 6.4.3.6-7.37.1 |
ImageMagick SUSE:Linux Enterprise Server for SAP Applications 11 SP4 | All versions | 6.4.3.6-7.37.1 |
ImageMagick SUSE:Linux Enterprise Software Development Kit 11 SP4 | All versions | 6.4.3.6-7.37.1 |
ImageMagick SUSE:Manager 2.1 | All versions | 6.4.3.6-7.37.1 |
ImageMagick SUSE:Manager Proxy 2.1 | All versions | 6.4.3.6-7.37.1 |
ImageMagick SUSE:OpenStack Cloud 5 | All versions | 6.4.3.6-7.37.1 |
Products include Canonical Ubuntu Linux, Debian Debian Linux, Imagemagick Imagemagick, Opensuse Leap, Opensuse Opensuse, Suse Suse Linux Enterprise Server.
How do I fix CVE-2016-3714?
Upgrade to a fixed version. US federal agencies must fix it by 30 Sep 2024.
Upgrade, and pass arguments to programs as a list instead of through a shell. More about Command injection.
Is CVE-2016-3714 being exploited?
Yes. Attackers have exploited CVE-2016-3714 in the wild since at least 9 Sep 2024.
Public exploit code: 1 Metasploit module, 2 Exploit-DB entries and 7 proofs of concept on GitHub.
Other vulnerabilities in Canonical Ubuntu Linux
Sources
Also known as DEBIAN-CVE-2016-3714, GHSA-24cp-26gx-3pp4, SUSE-SU-2016:1301-1, UBUNTU-CVE-2016-3714.