{"id":"CVE-2016-3717","aliases":["DEBIAN-CVE-2016-3717","DLA-1401-1","DLA-484-1","DLA-486-1","DSA-3580-1","EUVD-2016-4738","GHSA-cc28-64rq-q7jg","MGASA-2016-0188","RHSA-2016:0726","SUSE-SU-2016:1260-1","SUSE-SU-2016:1275-1","SUSE-SU-2016:1276-1","UBUNTU-CVE-2016-3717","USN-2990-1","openSUSE-SU-2024:10040-1","openSUSE-SU-2024:10505-1"],"status":"published","title":"The LABEL coder in ImageMagick before 6.9.3-10 and 7.x before 7.0.1-1 allows remote attackers to...","description":"The LABEL coder in ImageMagick before 6.9.3-10 and 7.x before 7.0.1-1 allows remote attackers to read arbitrary files via a crafted image.","severity":{"version":"3.0","score":5.5,"vector":"CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-07","score":0.2044,"percentile":0.97509,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":true,"fix_available":true},"cwes":["CWE-200"],"published":"2016-05-05T00:00:00Z","modified":"2026-10-24T10:30:23Z","exploits":[{"source":"exploitdb","id":"EDB-39767","title":"ImageMagick 7.0.1-0 / 6.9.3-9 - 'ImageTragick ' Multiple Vulnerabilities","type":"dos","platform":"multiple","date":"2016-05-04","url":"https://www.exploit-db.com/exploits/39767"}],"fixes":[{"ecosystem":"Debian:12","package":"graphicsmagick","fixed_in":["1.3.24-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"graphicsmagick","fixed_in":["1.3.24-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"graphicsmagick","fixed_in":["1.3.24-1"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"imagemagick","fixed_in":["8:6.9.6.2+dfsg-2"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"imagemagick","fixed_in":["8:6.9.6.2+dfsg-2"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"imagemagick","fixed_in":["8:6.9.6.2+dfsg-2"],"sources":["osv"]},{"ecosystem":"Ubuntu:14.04:LTS","package":"graphicsmagick","fixed_in":["1.3.18-1ubuntu3.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:14.04:LTS","package":"imagemagick","fixed_in":["8:6.7.7.10-6ubuntu3.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:16.04:LTS","package":"graphicsmagick","fixed_in":["1.3.23-1ubuntu0.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:16.04:LTS","package":"imagemagick","fixed_in":["8:6.8.9.9-7ubuntu5.1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Debian:12","package":"graphicsmagick","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.24-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"graphicsmagick","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.24-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"graphicsmagick","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.24-1"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"imagemagick","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8:6.9.6.2+dfsg-2"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"imagemagick","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8:6.9.6.2+dfsg-2"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"imagemagick","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8:6.9.6.2+dfsg-2"}]}]},{"source":"osv","ecosystem":"Debian:8","package":"graphicsmagick","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.20-3+deb8u3"}]}],"versions":["1.3.20-3+deb8u1","1.3.20-3+deb8u2"],"bundled":27},{"source":"osv","ecosystem":"Debian:7","package":"graphicsmagick","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.16-1.1+deb7u1"}]}],"versions":["1.3.16-1.1"],"bundled":9},{"source":"osv","ecosystem":"Debian:7","package":"imagemagick","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8:6.7.7.10-5+deb7u5"}]}],"versions":["8:6.7.7.10-5","8:6.7.7.10-5+deb7u2","8:6.7.7.10-5+deb7u3","8:6.7.7.10-5+deb7u4"],"bundled":6},{"source":"osv","ecosystem":"Debian:8","package":"imagemagick","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8:6.8.9.9-5+deb8u2"}]}],"versions":["8:6.8.9.9-5","8:6.8.9.9-5+deb8u1"],"bundled":6},{"source":"osv","ecosystem":"Mageia:5","package":"imagemagick","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.9.4.2-0.1.mga5"}]}],"bundled":5},{"source":"osv","ecosystem":"Mageia:5","package":"ruby-rmagick","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.13.2-21.1.mga5"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::client","package":"ImageMagick","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.7.2.7-4.el6_7"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::client","package":"ImageMagick-c++","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.7.2.7-4.el6_7"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::client","package":"ImageMagick-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.7.2.7-4.el6_7"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::client","package":"ImageMagick-c++-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.7.2.7-4.el6_7"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::client","package":"ImageMagick-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.7.2.7-4.el6_7"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::client","package":"ImageMagick-doc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.7.2.7-4.el6_7"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::client","package":"ImageMagick-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.7.2.7-4.el6_7"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::computenode","package":"ImageMagick","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.7.2.7-4.el6_7"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::computenode","package":"ImageMagick-c++","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.7.2.7-4.el6_7"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::computenode","package":"ImageMagick-c++-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.7.2.7-4.el6_7"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::computenode","package":"ImageMagick-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.7.2.7-4.el6_7"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::computenode","package":"ImageMagick-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.7.2.7-4.el6_7"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::computenode","package":"ImageMagick-doc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.7.2.7-4.el6_7"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::computenode","package":"ImageMagick-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.7.2.7-4.el6_7"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::server","package":"ImageMagick","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.7.2.7-4.el6_7"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::server","package":"ImageMagick-c++","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.7.2.7-4.el6_7"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::server","package":"ImageMagick-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.7.2.7-4.el6_7"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::server","package":"ImageMagick-c++-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.7.2.7-4.el6_7"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::server","package":"ImageMagick-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.7.2.7-4.el6_7"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::server","package":"ImageMagick-doc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.7.2.7-4.el6_7"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::server","package":"ImageMagick-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.7.2.7-4.el6_7"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::workstation","package":"ImageMagick","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.7.2.7-4.el6_7"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::workstation","package":"ImageMagick-c++","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.7.2.7-4.el6_7"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::workstation","package":"ImageMagick-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.7.2.7-4.el6_7"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::workstation","package":"ImageMagick-c++-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.7.2.7-4.el6_7"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::workstation","package":"ImageMagick-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.7.2.7-4.el6_7"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::workstation","package":"ImageMagick-doc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.7.2.7-4.el6_7"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::workstation","package":"ImageMagick-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.7.2.7-4.el6_7"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"ImageMagick","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.7.8.9-13.el7_2"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"ImageMagick-c++","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.7.8.9-13.el7_2"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"ImageMagick-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.7.8.9-13.el7_2"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"ImageMagick-c++-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.7.8.9-13.el7_2"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"ImageMagick-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.7.8.9-13.el7_2"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"ImageMagick-doc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.7.8.9-13.el7_2"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"ImageMagick-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.7.8.9-13.el7_2"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"ImageMagick","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.7.8.9-13.el7_2"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"ImageMagick-c++","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.7.8.9-13.el7_2"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"ImageMagick-c++-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.7.8.9-13.el7_2"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"ImageMagick-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.7.8.9-13.el7_2"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"ImageMagick-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.7.8.9-13.el7_2"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"ImageMagick-doc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.7.8.9-13.el7_2"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"ImageMagick-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.7.8.9-13.el7_2"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"ImageMagick","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.7.8.9-13.el7_2"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"ImageMagick-c++","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.7.8.9-13.el7_2"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"ImageMagick-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.7.8.9-13.el7_2"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"ImageMagick-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.7.8.9-13.el7_2"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"ImageMagick-c++-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.7.8.9-13.el7_2"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"ImageMagick-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.7.8.9-13.el7_2"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"ImageMagick-doc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.7.8.9-13.el7_2"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"ImageMagick","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.7.8.9-13.el7_2"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"ImageMagick-c++","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.7.8.9-13.el7_2"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"ImageMagick-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.7.8.9-13.el7_2"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"ImageMagick-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.7.8.9-13.el7_2"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"ImageMagick-c++-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.7.8.9-13.el7_2"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"ImageMagick-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.7.8.9-13.el7_2"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"ImageMagick-doc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.7.8.9-13.el7_2"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Desktop 12","package":"ImageMagick","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.8.8.1-19.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Desktop 12 SP1","package":"ImageMagick","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.8.8.1-19.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Software Development Kit 12","package":"ImageMagick","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.8.8.1-19.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Software Development Kit 12 SP1","package":"ImageMagick","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.8.8.1-19.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12","package":"ImageMagick","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.8.8.1-19.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12","package":"ImageMagick","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.8.8.1-19.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP1","package":"ImageMagick","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.8.8.1-19.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP1","package":"ImageMagick","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.8.8.1-19.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Workstation Extension 12","package":"ImageMagick","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.8.8.1-19.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Workstation Extension 12 SP1","package":"ImageMagick","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.8.8.1-19.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Software Development Kit 11 SP4","package":"ImageMagick","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.3.6-7.34.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 5","package":"ImageMagick","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.3.6-7.34.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Manager 2.1","package":"ImageMagick","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.3.6-7.34.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Manager Proxy 2.1","package":"ImageMagick","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.3.6-7.34.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 11 SP2-LTSS","package":"ImageMagick","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.3.6-7.34.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 11 SP3-LTSS","package":"ImageMagick","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.3.6-7.34.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 11 SP3-TERADATA","package":"ImageMagick","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.3.6-7.34.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 11 SP4","package":"ImageMagick","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.3.6-7.34.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 11 SP4","package":"ImageMagick","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.3.6-7.34.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Software Development Kit 11 SP4","package":"GraphicsMagick","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.5-4.35.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Studio Onsite 1.3","package":"GraphicsMagick","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.5-4.35.1"}]}],"bundled":4},{"source":"osv","ecosystem":"Ubuntu:14.04:LTS","package":"graphicsmagick","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.18-1ubuntu3.1"}]}],"versions":["1.3.16-1.1ubuntu2","1.3.16-1.1ubuntu3","1.3.18-1ubuntu3"]},{"source":"osv","ecosystem":"Ubuntu:14.04:LTS","package":"imagemagick","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8:6.7.7.10-6ubuntu3.1"}]}],"versions":["8:6.7.7.10-5ubuntu3","8:6.7.7.10-5ubuntu4","8:6.7.7.10-6ubuntu1","8:6.7.7.10-6ubuntu2","8:6.7.7.10-6ubuntu3"]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"graphicsmagick","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.23-1ubuntu0.1"}]}],"versions":["1.3.21-3","1.3.23-1","1.3.23-1build1"]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"imagemagick","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8:6.8.9.9-7ubuntu5.1"}]}],"versions":["8:6.8.9.9-5ubuntu2","8:6.8.9.9-6","8:6.8.9.9-6build1","8:6.8.9.9-7","8:6.8.9.9-7ubuntu1","8:6.8.9.9-7ubuntu2","8:6.8.9.9-7ubuntu3","8:6.8.9.9-7ubuntu4","8:6.8.9.9-7ubuntu5"]},{"source":"osv","ecosystem":"Ubuntu:14.04:LTS","package":"imagemagick","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8:6.7.7.10-6ubuntu3.1"}]}],"versions":["8:6.7.7.10-5ubuntu3","8:6.7.7.10-5ubuntu4","8:6.7.7.10-6ubuntu1","8:6.7.7.10-6ubuntu2","8:6.7.7.10-6ubuntu3"],"bundled":6},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"imagemagick","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8:6.8.9.9-7ubuntu5.1"}]}],"versions":["8:6.8.9.9-5ubuntu2","8:6.8.9.9-6","8:6.8.9.9-6build1","8:6.8.9.9-7","8:6.8.9.9-7ubuntu1","8:6.8.9.9-7ubuntu2","8:6.8.9.9-7ubuntu3","8:6.8.9.9-7ubuntu4","8:6.8.9.9-7ubuntu5"],"bundled":6},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"ImageMagick","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.9.6.6-1.1"}]}],"bundled":10},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"GraphicsMagick","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.25-1.1"}]}],"bundled":9}],"products":[{"vendor":"canonical","product":"ubuntu_linux"},{"vendor":"imagemagick","product":"imagemagick"},{"vendor":"redhat","product":"enterprise_linux_desktop"},{"vendor":"redhat","product":"enterprise_linux_hpc_node"},{"vendor":"redhat","product":"enterprise_linux_hpc_node_eus"},{"vendor":"redhat","product":"enterprise_linux_server"},{"vendor":"redhat","product":"enterprise_linux_server_aus"},{"vendor":"redhat","product":"enterprise_linux_server_eus"},{"vendor":"redhat","product":"enterprise_linux_server_supplementary_eus"},{"vendor":"redhat","product":"enterprise_linux_workstation"}],"references":[{"url":"http://git.imagemagick.org/repos/ImageMagick/blob/a01518e08c840577cabd7d3ff291a9ba735f7276/ChangeLog","tags":["x_refsource_CONFIRM","x_transferred","Patch","fix"]},{"url":"http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00028.html","tags":["vendor-advisory","x_refsource_SUSE","x_transferred","web"]},{"url":"http://www.oracle.com/technetwork/topics/security/linuxbulletinapr2016-2952096.html","tags":["x_refsource_CONFIRM","x_transferred","web"]},{"url":"https://www.imagemagick.org/discourse-server/viewtopic.php?f=4\u0026t=29588","tags":["x_refsource_CONFIRM","x_transferred","Vendor Advisory","advisory"]},{"url":"http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00051.html","tags":["vendor-advisory","x_refsource_SUSE","x_transferred","web"]},{"url":"http://www.ubuntu.com/usn/USN-2990-1","tags":["vendor-advisory","x_refsource_UBUNTU","x_transferred","Third Party Advisory","advisory"]},{"url":"http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00025.html","tags":["vendor-advisory","x_refsource_SUSE","x_transferred","web"]},{"url":"http://www.securityfocus.com/archive/1/538378/100/0/threaded","tags":["mailing-list","x_refsource_BUGTRAQ","x_transferred","web"]},{"url":"https://www.exploit-db.com/exploits/39767/","tags":["exploit","x_refsource_EXPLOIT-DB","x_transferred","web"]},{"url":"http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00024.html","tags":["vendor-advisory","x_refsource_SUSE","x_transferred","web"]},{"url":"https://lists.debian.org/debian-lts-announce/2018/06/msg00009.html","tags":["mailing-list","x_refsource_MLIST","x_transferred","web"]},{"url":"http://www.oracle.com/technetwork/topics/security/bulletinjul2016-3090568.html","tags":["x_refsource_CONFIRM","x_transferred","web"]},{"url":"http://www.openwall.com/lists/oss-security/2016/05/03/18","tags":["mailing-list","x_refsource_MLIST","x_transferred","Mailing List","Third Party Advisory","advisory","report"]},{"url":"https://security.gentoo.org/glsa/201611-21","tags":["vendor-advisory","x_refsource_GENTOO","x_transferred","advisory"]},{"url":"http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00032.html","tags":["vendor-advisory","x_refsource_SUSE","x_transferred","web"]},{"url":"http://www.slackware.com/security/viewer.php?l=slackware-security\u0026y=2016\u0026m=slackware-security.440568","tags":["vendor-advisory","x_refsource_SLACKWARE","x_transferred","web"]},{"url":"https://www.imagemagick.org/script/changelog.php","tags":["x_refsource_CONFIRM","x_transferred","web"]},{"url":"http://www.debian.org/security/2016/dsa-3580","tags":["vendor-advisory","x_refsource_DEBIAN","x_transferred","advisory"]},{"url":"http://rhn.redhat.com/errata/RHSA-2016-0726.html","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred","Third Party Advisory","advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2016-3717","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2016:0726","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2016-3717","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1332505","tags":["report"]},{"url":"https://www.exploit-db.com/exploits/39767"},{"url":"https://github.com/advisories/GHSA-cc28-64rq-q7jg"},{"url":"https://security-tracker.debian.org/tracker/CVE-2016-3717","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2016-0188.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=18347","tags":["report"]},{"url":"http://git.imagemagick.org/repos/ImageMagick/blob/dce8f08c7bf7a92c451f45a684ca96434684a69e/ChangeLog","tags":["web"]},{"url":"https://rhn.redhat.com/errata/RHSA-2016-0726.html","tags":["web"]},{"url":"https://access.redhat.com/security/updates/classification/#important","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1332492","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1332500","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1332504","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1332802","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2016/rhsa-2016_0726.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2016-3714","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2016-3714","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2016-3714","tags":["advisory"]},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2016-3715","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2016-3715","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2016-3715","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2016-3716","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2016-3716","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2016-3716","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2016-3717","tags":["advisory","report"]},{"url":"https://access.redhat.com/security/cve/CVE-2016-3718","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2016-3718","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2016-3718","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2016/suse-su-20161260-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/978061","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2016-3714","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-3715","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-3716","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-3717","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-3718","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2016/suse-su-20161275-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2016/suse-su-20161276-1/","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2016-3717","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-2990-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2016-3714","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2016-3715","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2016-3716","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2016-3718","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2016-5118","tags":["report"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2012-0247","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2012-0248","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2012-1185","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2012-1186","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-5118","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2009-1882","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2009-3736","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2012-3438","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-2317","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2016-3717","description":"The LABEL coder in ImageMagick before 6.9.3-10 and 7.x before 7.0.1-1 allows remote attackers to read arbitrary files via a crafted image.","status":"published","published":"2016-05-05T18:00:00Z","modified":"2024-08-06T00:03:34.448Z","updated_at":"2026-11-02T14:33:34.094161Z"}],"euvd":[{"id":"EUVD-2016-4738","description":"The LABEL coder in ImageMagick before 6.9.3-10 and 7.x before 7.0.1-1 allows remote attackers to read arbitrary files via a crafted image.","status":"published","published":"2016-05-05T18:00:00Z","modified":"2024-08-06T00:03:34Z","updated_at":"2026-11-03T02:22:49.642053Z"}],"ghsa":[{"id":"GHSA-cc28-64rq-q7jg","title":"The LABEL coder in ImageMagick before 6.9.3-10 and 7.x before 7.0.1-1 allows remote attackers to...","description":"The LABEL coder in ImageMagick before 6.9.3-10 and 7.x before 7.0.1-1 allows remote attackers to read arbitrary files via a crafted image.","status":"published","published":"2022-05-14T02:46:19Z","modified":"2025-04-12T13:00:32Z","cvss":[{"version":"3.0","score":5.5,"vector":"CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"cwes":["CWE-200"],"updated_at":"2026-11-02T15:01:27.480327Z"}],"nvd":[{"id":"CVE-2016-3717","description":"The LABEL coder in ImageMagick before 6.9.3-10 and 7.x before 7.0.1-1 allows remote attackers to read arbitrary files via a crafted image.","status":"published","published":"2016-05-05T18:59:07.663Z","modified":"2026-06-17T00:46:14.95Z","cvss":[{"version":"3.0","score":5.5,"vector":"CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium","assessor":"primary"},{"version":"2.0","score":7.1,"vector":"AV:N/AC:M/Au:N/C:C/I:N/A:N","level":"high","assessor":"primary"}],"cwes":["CWE-200"],"updated_at":"2026-11-02T14:03:25.366449Z"}],"osv":[{"id":"CVE-2016-3717","description":"The LABEL coder in ImageMagick before 6.9.3-10 and 7.x before 7.0.1-1 allows remote attackers to read arbitrary files via a crafted image.","status":"published","published":"2016-05-05T18:59:07.663Z","modified":"2026-10-24T10:30:23.864803452Z","cvss":[{"version":"3.0","score":5.5,"vector":"CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T15:44:02.454775Z"},{"id":"DEBIAN-CVE-2016-3717","description":"The LABEL coder in ImageMagick before 6.9.3-10 and 7.x before 7.0.1-1 allows remote attackers to read arbitrary files via a crafted image.","status":"published","published":"2016-05-05T18:59:07.663Z","modified":"2026-09-22T07:01:58.555483164Z","cvss":[{"version":"3.0","score":5.5,"vector":"CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T15:45:27.627285Z"},{"id":"RHSA-2016:0726","title":"Red Hat Security Advisory: ImageMagick security update","status":"published","published":"2024-09-15T23:25:52Z","modified":"2026-06-26T12:21:00.525885541Z","cvss":[{"version":"3.0","score":8.4,"vector":"CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:03.734507Z"},{"id":"UBUNTU-CVE-2016-3717","description":"The LABEL coder in ImageMagick before 6.9.3-10 and 7.x before 7.0.1-1 allows remote attackers to read arbitrary files via a crafted image.","status":"published","published":"2016-05-05T00:00:00Z","modified":"2026-04-22T10:41:42.104554Z","cvss":[{"version":"3.0","score":5.5,"vector":"CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T15:54:11.872222Z"},{"id":"DLA-1401-1","title":"graphicsmagick - security update","status":"published","published":"2018-06-27T00:00:00Z","modified":"2026-03-09T01:01:07.175701Z","updated_at":"2026-11-02T15:46:09.336894Z"},{"id":"DLA-484-1","title":"graphicsmagick - security update","status":"published","published":"2016-05-21T00:00:00Z","modified":"2026-03-09T02:11:32.071534Z","updated_at":"2026-11-02T15:46:13.207219Z"},{"id":"DLA-486-1","title":"imagemagick - security update","status":"published","published":"2016-05-23T00:00:00Z","modified":"2026-03-09T02:09:08.652651Z","updated_at":"2026-11-02T15:46:13.207219Z"},{"id":"DSA-3580-1","title":"imagemagick - security update","status":"published","published":"2016-05-16T00:00:00Z","modified":"2026-03-09T01:17:55.619208Z","updated_at":"2026-11-02T15:46:16.199525Z"},{"id":"MGASA-2016-0188","title":"Updated imagemagick/ruby-rmagic packages fix security vulnerability","description":"It was discovered that ImageMagick did not properly sanitize certain input\nbefore passing it to the delegate functionality. A remote attacker could\ncreate a specially crafted image that, when processed by an application\nusing ImageMagick or an unsuspecting user using the ImageMagick utilities,\nwould lead to arbitrary execution of shell commands with the privileges of\nthe user running the application (CVE-2016-3714).\n\nIt was discovered that certain ImageMagick coders and pseudo-protocols did\nnot properly prevent security sensitive operations when processing\nspecially crafted images. A remote attacker could create a specially\ncrafted image that, when processed by an application using ImageMagick or\nan unsuspecting user using the ImageMagick utilities, would allow the\nattacker to delete, move, or disclose the contents of arbitrary files\n(CVE-2016-3715, CVE-2016-3716, CVE-2016-3717).\n\nA server-side request forgery flaw was discovered in the way ImageMagick\nprocessed certain images. A remote attacker could exploit this flaw to\nmislead an application using ImageMagick or an unsuspecting user using the\nImageMagick utilities into, for example, performing HTTP(S) requests or\nopening FTP sessions via specially crafted images (CVE-2016-3718).\n\nThe imagemagick package has been updated to version 6.9.4-2 to fix these\nissues and several other bugs.\n","status":"published","published":"2016-05-20T11:38:30Z","modified":"2026-04-16T06:23:56.943097627Z","updated_at":"2026-11-02T15:49:39.792687Z"},{"id":"openSUSE-SU-2024:10040-1","title":"ImageMagick-6.9.6.6-1.1 on GA media","description":"These are all security issues fixed in the ImageMagick-6.9.6.6-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T02:50:46.002899Z","updated_at":"2026-11-02T16:58:33.135986Z"},{"id":"openSUSE-SU-2024:10505-1","title":"GraphicsMagick-1.3.25-1.1 on GA media","description":"These are all security issues fixed in the GraphicsMagick-1.3.25-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T03:01:12.679808Z","updated_at":"2026-11-02T16:58:34.487567Z"},{"id":"SUSE-SU-2016:1260-1","title":"Security update for ImageMagick","description":"\nThis update for ImageMagick fixes the following issues:\n\nSecurity issues fixed:\n- Several coders were vulnerable to remote code execution attacks, \n  these coders have now been disabled by default but can be \n  re-enabled by editing '/etc/ImageMagick-*/policy.xml' (bsc#978061)\n- CVE-2016-3714: Insufficient shell characters filtering leads to\n  (potentially remote) code execution\n- CVE-2016-3715: Possible file deletion by using ImageMagick's\n  'ephemeral' pseudo protocol which deletes files after reading.\n- CVE-2016-3716: Possible file moving by using ImageMagick's 'msl'\n  pseudo protocol with any extension in any folder.\n- CVE-2016-3717: Possible local file read by using ImageMagick's \n  'label' pseudo protocol to get content of the files from the server.\n- CVE-2016-3718: Possible Server Side Request Forgery (SSRF) to make\n  HTTP GET or FTP request.\n\nBugs fixed:\n- Use external svg loader (rsvg)\n","status":"published","published":"2016-05-07T07:45:12Z","modified":"2026-02-04T02:46:41.294474Z","updated_at":"2026-11-02T15:53:43.438985Z"},{"id":"SUSE-SU-2016:1275-1","title":"Security update for ImageMagick","description":"\nThis update for ImageMagick fixes the following issues:\n\nSecurity issues fixed:\n- Several coders were vulnerable to remote code execution attacks,\n  these coders have now been disabled. They can be re-enabled by\n  exporting the following environment variable\n  MAGICK_CODER_MODULE_PATH=/usr/lib64/ImageMagick-6.4.3/modules-Q16/coders/vulnerable/\n  (bsc#978061)\n- CVE-2016-3714: Insufficient shell characters filtering leads to\n  (potentially remote) code execution\n- CVE-2016-3715: Possible file deletion by using ImageMagick's\n  'ephemeral' pseudo protocol which deletes files after reading.\n- CVE-2016-3716: Possible file moving by using ImageMagick's 'msl'\n  pseudo protocol with any extension in any folder.\n- CVE-2016-3717: Possible local file read by using ImageMagick's \n  'label' pseudo protocol to get content of the files from the server.\n- CVE-2016-3718: Possible Server Side Request Forgery (SSRF) to make\n  HTTP GET or FTP request.\n\nBugs fixed:\n- Use external svg loader (rsvg)","status":"published","published":"2016-05-11T11:51:45Z","modified":"2026-02-04T03:47:23.341784Z","updated_at":"2026-11-02T15:53:43.438985Z"},{"id":"SUSE-SU-2016:1276-1","title":"Security update for GraphicsMagick","description":"\nThis update for GraphicsMagick fixes the following issues:\n\n- Security update Remote Code Execution / Local File read [bsc#978061]\n  CVE-2016-3714, CVE-2016-3715, CVE-2016-3717, CVE-2016-3718\n- CVE-2016-3714: Insufficient shell characters filtering leads to\n  (potentially remote) code execution\n- CVE-2016-3715: Possible file deletion by using GraphicsMagick's\n  'tmp:' file specification syntax.\n- CVE-2016-3717: Possible local file read by using GraphicsMagick's \n  'txt:' file specification syntax.\n- CVE-2016-3718: Possible Server Side Request Forgery (SSRF) to make\n  HTTP GET or FTP request.\n","status":"published","published":"2016-05-11T11:49:10Z","modified":"2026-02-04T02:40:14.587207Z","updated_at":"2026-11-02T15:53:43.438985Z"},{"id":"USN-2990-1","title":"imagemagick vulnerabilities","description":"Nikolay Ermishkin and Stewie discovered that ImageMagick incorrectly\nsanitized untrusted input. A remote attacker could use these issues to\nexecute arbitrary code. These issues are known as \"ImageTragick\". This\nupdate disables problematic coders via the /etc/ImageMagick-6/policy.xml\nconfiguration file. In certain environments the coders may need to be\nmanually re-enabled after making sure that ImageMagick does not process\nuntrusted input. (CVE-2016-3714, CVE-2016-3715, CVE-2016-3716,\nCVE-2016-3717, CVE-2016-3718)\n\nBob Friesenhahn discovered that ImageMagick allowed injecting commands via\nan image file or filename. A remote attacker could use this issue to\nexecute arbitrary code. (CVE-2016-5118)\n","status":"published","published":"2016-06-02T13:13:20Z","modified":"2026-04-22T09:25:12.124427Z","updated_at":"2026-11-02T16:58:10.303275Z"}]}}