CVE-2016-5118 Command injection in n/a
Remote attackers can execute arbitrary code by providing a filename starting with a pipe character to the image processing library.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2016-5118?
CVE-2016-5118 is a critical command injection vulnerability in Canonical Ubuntu Linux, published on 10 Jun 2016. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
The OpenBlob function in blob.c in GraphicsMagick before 1.3.24 and ImageMagick allows remote attackers to execute arbitrary code via a | (pipe) character at the start of a filename.
Which versions are affected by CVE-2016-5118?
It affects 14 products.
Linux distribution packages (19)
ImageMagick SUSE:Linux Enterprise Desktop 12 | All versions | 6.8.8.1-25.1 |
ImageMagick SUSE:Linux Enterprise Desktop 12 SP1 | All versions | 6.8.8.1-25.1 |
ImageMagick SUSE:Linux Enterprise Server 11 SP2-LTSS | All versions | 6.4.3.6-7.40.1 |
ImageMagick SUSE:Linux Enterprise Server 11 SP3-LTSS | All versions | 6.4.3.6-7.40.1 |
ImageMagick SUSE:Linux Enterprise Server 11 SP3-TERADATA | All versions | 6.4.3.6-7.40.1 |
ImageMagick SUSE:Linux Enterprise Server 11 SP4 | All versions | 6.4.3.6-7.40.1 |
ImageMagick SUSE:Linux Enterprise Server 12 | All versions | 6.8.8.1-25.1 |
ImageMagick SUSE:Linux Enterprise Server 12 SP1 | All versions | 6.8.8.1-25.1 |
ImageMagick SUSE:Linux Enterprise Server for SAP Applications 11 SP4 | All versions | 6.4.3.6-7.40.1 |
ImageMagick SUSE:Linux Enterprise Server for SAP Applications 12 | All versions | 6.8.8.1-25.1 |
ImageMagick SUSE:Linux Enterprise Server for SAP Applications 12 SP1 | All versions | 6.8.8.1-25.1 |
ImageMagick SUSE:Linux Enterprise Software Development Kit 11 SP4 | All versions | 6.4.3.6-7.40.1 |
ImageMagick SUSE:Linux Enterprise Software Development Kit 12 | All versions | 6.8.8.1-25.1 |
ImageMagick SUSE:Linux Enterprise Software Development Kit 12 SP1 | All versions | 6.8.8.1-25.1 |
ImageMagick SUSE:Linux Enterprise Workstation Extension 12 | All versions | 6.8.8.1-25.1 |
ImageMagick SUSE:Linux Enterprise Workstation Extension 12 SP1 | All versions | 6.8.8.1-25.1 |
ImageMagick SUSE:Manager 2.1 | All versions | 6.4.3.6-7.40.1 |
ImageMagick SUSE:Manager Proxy 2.1 | All versions | 6.4.3.6-7.40.1 |
ImageMagick SUSE:OpenStack Cloud 5 | All versions | 6.4.3.6-7.40.1 |
Products include Canonical Ubuntu Linux, Debian Debian Linux, Graphicsmagick Graphicsmagick, Imagemagick Imagemagick, Opensuse Leap, Opensuse Opensuse and 8 more.
How do I fix CVE-2016-5118?
Upgrade to a fixed version.
Upgrade, and pass arguments to programs as a list instead of through a shell. More about Command injection.
Is CVE-2016-5118 being exploited?
There is no known exploitation of CVE-2016-5118 in the wild and no public exploit code.
Other vulnerabilities in Canonical Ubuntu Linux
Sources
Also known as ALPINE-CVE-2016-5118, DEBIAN-CVE-2016-5118, DLA-500-1, DLA-502-1, DSA-3591-1, GHSA-6w95-mr48-gp8c and 3 more.