{"id":"CVE-2016-7906","aliases":["ALPINE-CVE-2016-7906","DEBIAN-CVE-2016-7906","DSA-3726-1","EUVD-2016-8755","GHSA-5r8w-6xfr-q973","MGASA-2018-0229","UBUNTU-CVE-2016-7906","USN-3142-1"],"status":"published","title":"magick/attribute.c in ImageMagick 7.0.3-2 allows remote attackers to cause a denial of service ...","description":"magick/attribute.c in ImageMagick 7.0.3-2 allows remote attackers to cause a denial of service (use-after-free) via a crafted file.","severity":{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-08","score":0.01716,"percentile":0.77577,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-416"],"published":"2016-10-04T00:00:00Z","modified":"2026-10-24T14:12:26Z","fixes":[{"ecosystem":"Alpine:v3.2","package":"imagemagick","fixed_in":["6.9.6.8-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.3","package":"imagemagick","fixed_in":["6.9.6.8-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.4","package":"imagemagick","fixed_in":["6.9.5.9-r1"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"imagemagick","fixed_in":["8:6.9.6.2+dfsg-2"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"imagemagick","fixed_in":["8:6.9.6.2+dfsg-2"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"imagemagick","fixed_in":["8:6.9.6.2+dfsg-2"],"sources":["osv"]},{"ecosystem":"Ubuntu:16.04:LTS","package":"imagemagick","fixed_in":["8:6.8.9.9-7ubuntu5.3"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Alpine:v3.2","package":"imagemagick","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.9.6.8-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.3","package":"imagemagick","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.9.6.8-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.4","package":"imagemagick","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.9.5.9-r1"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"imagemagick","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8:6.9.6.2+dfsg-2"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"imagemagick","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8:6.9.6.2+dfsg-2"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"imagemagick","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8:6.9.6.2+dfsg-2"}]}]},{"source":"osv","ecosystem":"Debian:8","package":"imagemagick","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8:6.8.9.9-5+deb8u6"}]}],"versions":["8:6.8.9.9-5","8:6.8.9.9-5+deb8u1","8:6.8.9.9-5+deb8u2","8:6.8.9.9-5+deb8u3","8:6.8.9.9-5+deb8u4","8:6.8.9.9-5+deb8u5"],"bundled":17},{"source":"osv","ecosystem":"Mageia:6","package":"converseen","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.9.6.2-1.3.mga6"}]}],"bundled":104},{"source":"osv","ecosystem":"Mageia:6","package":"cuneiform-linux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.1.0-9.2.mga6"}]}],"bundled":104},{"source":"osv","ecosystem":"Mageia:6","package":"dvdauthor","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.7.2-2.2.mga6"}]}],"bundled":104},{"source":"osv","ecosystem":"Mageia:6","package":"emacs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"24.5-8.3.mga6"}]}],"bundled":104},{"source":"osv","ecosystem":"Mageia:6","package":"imagemagick","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.9.9.41-1.mga6"}]}],"bundled":104},{"source":"osv","ecosystem":"Mageia:6","package":"inkscape","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.92.1-2.2.mga6"}]}],"bundled":104},{"source":"osv","ecosystem":"Mageia:6","package":"k3d","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.8.0.5-5.2.mga6"}]}],"bundled":104},{"source":"osv","ecosystem":"Mageia:6","package":"kxstitch","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.0-2.2.mga6"}]}],"bundled":104},{"source":"osv","ecosystem":"Mageia:6","package":"libopenshot","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.1.8-1.2.mga6"}]}],"bundled":104},{"source":"osv","ecosystem":"Mageia:6","package":"ocaml-glmlite","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.03.51-17.2.mga6"}]}],"bundled":104},{"source":"osv","ecosystem":"Mageia:6","package":"perl-Image-SubImageFind","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.30.0-6.2.mga6"}]}],"bundled":104},{"source":"osv","ecosystem":"Mageia:6","package":"pfstools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.6-3.2.mga6"}]}],"bundled":104},{"source":"osv","ecosystem":"Mageia:6","package":"php-imagick","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.4.1-6.2.mga6"}]}],"bundled":104},{"source":"osv","ecosystem":"Mageia:6","package":"php-magickwand","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.9.2-10.2.mga6"}]}],"bundled":104},{"source":"osv","ecosystem":"Mageia:6","package":"psiconv","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.9.8-26.2.mga6"}]}],"bundled":104},{"source":"osv","ecosystem":"Mageia:6","package":"pythonmagick","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.9.12-7.2.mga6"}]}],"bundled":104},{"source":"osv","ecosystem":"Mageia:6","package":"ruby-rmagick","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.15.4-12.2.mga6"}]}],"bundled":104},{"source":"osv","ecosystem":"Mageia:6","package":"synfig","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.1-2.2.mga6"}]}],"bundled":104},{"source":"osv","ecosystem":"Mageia:6","package":"vdr-plugin-skinelchi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.2.8-8.2.mga6"}]}],"bundled":104},{"source":"osv","ecosystem":"Mageia:6","package":"vdr-plugin-skinenigmang","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.1.2-10.2.mga6"}]}],"bundled":104},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"imagemagick","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8:6.8.9.9-7ubuntu5.3"}]}],"versions":["8:6.8.9.9-5ubuntu2","8:6.8.9.9-6","8:6.8.9.9-6build1","8:6.8.9.9-7","8:6.8.9.9-7ubuntu1","8:6.8.9.9-7ubuntu2","8:6.8.9.9-7ubuntu3","8:6.8.9.9-7ubuntu4","8:6.8.9.9-7ubuntu5","8:6.8.9.9-7ubuntu5.1","8:6.8.9.9-7ubuntu5.2"]},{"source":"osv","ecosystem":"Ubuntu:14.04:LTS","package":"imagemagick","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8:6.7.7.10-6ubuntu3.3"}]}],"versions":["8:6.7.7.10-5ubuntu3","8:6.7.7.10-5ubuntu4","8:6.7.7.10-6ubuntu1","8:6.7.7.10-6ubuntu2","8:6.7.7.10-6ubuntu3","8:6.7.7.10-6ubuntu3.1","8:6.7.7.10-6ubuntu3.2"],"bundled":5},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"imagemagick","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8:6.8.9.9-7ubuntu5.3"}]}],"versions":["8:6.8.9.9-5ubuntu2","8:6.8.9.9-6","8:6.8.9.9-6build1","8:6.8.9.9-7","8:6.8.9.9-7ubuntu1","8:6.8.9.9-7ubuntu2","8:6.8.9.9-7ubuntu3","8:6.8.9.9-7ubuntu4","8:6.8.9.9-7ubuntu5","8:6.8.9.9-7ubuntu5.1","8:6.8.9.9-7ubuntu5.2"],"bundled":5}],"products":[{"vendor":"debian","product":"debian_linux"},{"vendor":"imagemagick","product":"imagemagick"}],"references":[{"url":"http://www.securityfocus.com/bid/93271","tags":["vdb-entry","x_refsource_BID","x_transferred","Third Party Advisory","VDB Entry","advisory"]},{"url":"http://www.openwall.com/lists/oss-security/2016/10/02/3","tags":["mailing-list","x_refsource_MLIST","x_transferred","Mailing List","Patch","Third Party Advisory","fix"]},{"url":"http://www.openwall.com/lists/oss-security/2016/10/02/1","tags":["mailing-list","x_refsource_MLIST","x_transferred","Mailing List","Patch","Third Party Advisory","fix"]},{"url":"https://security.gentoo.org/glsa/201611-21","tags":["vendor-advisory","x_refsource_GENTOO","x_transferred","Third Party Advisory","advisory"]},{"url":"https://github.com/ImageMagick/ImageMagick/issues/281","tags":["x_refsource_CONFIRM","x_transferred","Issue Tracking","Patch","Third Party Advisory","fix"]},{"url":"http://www.debian.org/security/2016/dsa-3726","tags":["vendor-advisory","x_refsource_DEBIAN","x_transferred","Third Party Advisory","advisory"]},{"url":"https://github.com/ImageMagick/ImageMagick/commit/90406972f108c4da71f998601b06abdc2ac6f06e","tags":["x_refsource_CONFIRM","x_transferred","Patch","Vendor Advisory","fix"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2016-7906"},{"url":"https://github.com/advisories/GHSA-5r8w-6xfr-q973"},{"url":"https://security.alpinelinux.org/vuln/CVE-2016-7906","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2016-7906","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2018-0229.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=19078","tags":["report"]},{"url":"http://git.imagemagick.org/repos/ImageMagick/blob/ImageMagick-6/ChangeLog","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2016-7906","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-3142-1","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2016-7906","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2016-7799","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2016-8677","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2016-8862","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2016-9556","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2016-7906","description":"magick/attribute.c in ImageMagick 7.0.3-2 allows remote attackers to cause a denial of service (use-after-free) via a crafted file.","status":"published","published":"2017-01-18T17:00:00Z","modified":"2024-08-06T02:13:20.915Z","updated_at":"2026-11-02T14:33:36.175943Z"}],"euvd":[{"id":"EUVD-2016-8755","description":"magick/attribute.c in ImageMagick 7.0.3-2 allows remote attackers to cause a denial of service (use-after-free) via a crafted file.","status":"published","published":"2017-01-18T17:00:00Z","modified":"2024-08-06T02:13:20Z","updated_at":"2026-11-03T02:22:31.485682Z"}],"ghsa":[{"id":"GHSA-5r8w-6xfr-q973","title":"magick/attribute.c in ImageMagick 7.0.3-2 allows remote attackers to cause a denial of service ...","description":"magick/attribute.c in ImageMagick 7.0.3-2 allows remote attackers to cause a denial of service (use-after-free) via a crafted file.","status":"published","published":"2022-05-13T01:14:44Z","modified":"2023-02-01T05:04:30Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium"}],"cwes":["CWE-416"],"updated_at":"2026-11-02T14:50:09.415947Z"}],"nvd":[{"id":"CVE-2016-7906","description":"magick/attribute.c in ImageMagick 7.0.3-2 allows remote attackers to cause a denial of service (use-after-free) via a crafted file.","status":"published","published":"2017-01-18T17:59:00.777Z","modified":"2026-06-17T00:53:43.877Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium","assessor":"primary"},{"version":"2.0","score":4.3,"vector":"AV:N/AC:M/Au:N/C:N/I:N/A:P","level":"medium","assessor":"primary"}],"cwes":["CWE-416"],"updated_at":"2026-11-02T14:03:33.686843Z"}],"osv":[{"id":"ALPINE-CVE-2016-7906","description":"magick/attribute.c in ImageMagick 7.0.3-2 allows remote attackers to cause a denial of service (use-after-free) via a crafted file.","status":"published","published":"2017-01-18T17:59:00.777Z","modified":"2026-09-22T06:30:35.376583165Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:27:46.318571Z"},{"id":"CVE-2016-7906","description":"magick/attribute.c in ImageMagick 7.0.3-2 allows remote attackers to cause a denial of service (use-after-free) via a crafted file.","status":"published","published":"2017-01-18T17:59:00.777Z","modified":"2026-10-24T14:12:26.267752336Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:44:03.171316Z"},{"id":"DEBIAN-CVE-2016-7906","description":"magick/attribute.c in ImageMagick 7.0.3-2 allows remote attackers to cause a denial of service (use-after-free) via a crafted file.","status":"published","published":"2017-01-18T17:59:00.777Z","modified":"2026-09-22T07:00:59.106240928Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:45:27.910042Z"},{"id":"UBUNTU-CVE-2016-7906","description":"magick/attribute.c in ImageMagick 7.0.3-2 allows remote attackers to cause a denial of service (use-after-free) via a crafted file.","status":"published","published":"2016-10-04T00:00:00Z","modified":"2026-04-22T10:59:32.372335Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium"},{"version":"3.0","score":5.5,"vector":"CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:54:12.994319Z"},{"id":"DSA-3726-1","title":"imagemagick - security update","status":"published","published":"2016-11-26T00:00:00Z","modified":"2026-03-09T01:19:11.290537Z","updated_at":"2026-11-02T15:46:16.523846Z"},{"id":"MGASA-2018-0229","title":"Updated imagemagick packages fix security vulnerabilities","description":"The imagemagick package has been updated to version 6.9.9.41 which\nfixes several unspecified security vulnerabilities.\nThis update fixes several vulnerabilities in imagemagick, including:\nVarious memory handling problems and cases of missing or incomplete\ninput sanitising may result in denial of service, memory disclosure\nor the execution of arbitrary code if malformed GIF, TTF, SVG, TIFF,\nPCX, JPG or SFW files are processed.\n\nSeveral packages have been rebuilt for the updated ImageMagick.\n","status":"published","published":"2018-05-12T06:28:12Z","modified":"2026-04-16T06:25:36.607120995Z","updated_at":"2026-11-02T15:49:40.442238Z"},{"id":"USN-3142-1","title":"imagemagick vulnerabilities","description":"It was discovered that ImageMagick incorrectly handled certain malformed\nimage files. If a user or automated system using ImageMagick were tricked\ninto opening a specially crafted image, an attacker could exploit this to\ncause a denial of service or possibly execute code with the privileges of\nthe user invoking the program.\n","status":"published","published":"2016-11-30T17:44:56Z","modified":"2026-04-22T09:30:22.175411Z","updated_at":"2026-11-02T16:58:10.303275Z"}]}}