ImageMagick Improper Input Validation Vulnerability

高危 8.4EXPLOITED (CISA KEV)CVE-2016-3714 · Published 05/05/2016 · updated 17/06/2026

ImageMagick Improper Input Validation Vulnerability. Actively exploited: CISA added this vulnerability to its Known Exploited Vulnerabilities catalog on 09/09/2024. Patch affected systems as an emergency.

要点

CVE-2016-3714 是影响 imagemagick (imagemagick) 的高危 (CVSS 8.4)漏洞。
已被实际利用：CISA 于 09/09/2024 将其加入 KEV 目录。
未来 30 天内被利用的概率（EPSS）：97.5%，高于 99.9% 的漏洞。
暂无已修复版本：请关注参考资料中的厂商公告。

Package	Affected versions	Patched versions
imagemagick imagemagick	`= 7.0.0-0= 7.0.1-0≤ 6.9.3-9`	No fix yet

Description

The (1) EPHEMERAL, (2) HTTPS, (3) MVG, (4) MSL, (5) TEXT, (6) SHOW, (7) WIN, and (8) PLT coders in ImageMagick before 6.9.3-10 and 7.x before 7.0.1-1 allow remote attackers to execute arbitrary code via shell metacharacters in a crafted image, aka "ImageTragick."

References

git.imagemagick.org/repos/ImageMagick/blob/a01518e08c840577cabd7d3ff291a9ba735f7276/ChangeLog · Patch
lists.opensuse.org/opensuse-security-announce/2016-05/msg00024.html · Third Party Advisory
lists.opensuse.org/opensuse-security-announce/2016-05/msg00025.html · Third Party Advisory
lists.opensuse.org/opensuse-security-announce/2016-05/msg00028.html · Third Party Advisory
lists.opensuse.org/opensuse-security-announce/2016-05/msg00032.html · Third Party Advisory
lists.opensuse.org/opensuse-security-announce/2016-05/msg00041.html · Third Party Advisory
lists.opensuse.org/opensuse-security-announce/2016-05/msg00051.html · Third Party Advisory
packetstormsecurity.com/files/152364/ImageTragick-ImageMagick-Proof-Of-Concepts.html · Third Party Advisory
rhn.redhat.com/errata/RHSA-2016-0726.html

imagemagick 的其他漏洞

查看全部 →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free

Package

Affected versions

Patched versions

imagemagick

= 7.0.0-0= 7.0.1-0≤ 6.9.3-9

No fix yet

imagemagick 的其他漏洞

查看全部 →