NetSight
IP …
medium5.5Known exploitedPublic exploit code

CVE-2016-3715

ImageMagick Arbitrary File Deletion Vulnerability

Exploited in the wild

This vulnerability is on a Known Exploited Vulnerabilities catalogue, added 2021-11-03. Federal due date: 2022-05-03.

Apply updates per vendor instructions.

Public exploit code

Working exploit or proof of concept code has been published for this vulnerability. Treat unpatched systems as at risk.

Impact

The EPHEMERAL coder in ImageMagick before 6.9.3-10 and 7.x before 7.0.1-1 allows remote attackers to delete arbitrary files via a crafted image.

Affected products

VendorProductAffected versions
RedhatEnterprise Linux Desktop
Versions 6.0, 7.0
RedhatEnterprise Linux Eus
Versions 6.7, 7.2, 7.3, 7.4, 7.5, 7.6
RedhatEnterprise Linux For Ibm Z Systems
Versions 6.0_s390x, 7.0_s390x
RedhatEnterprise Linux For Ibm Z Systems Eus
Versions 6.7_s390x, 7.2_s390x, 7.3_s390x, 7.4_s390x, 7.5_s390x, 7.6_s390x
RedhatEnterprise Linux For Power Big Endian
Versions 6.0_ppc64, 7.0_ppc64
RedhatEnterprise Linux For Power Big Endian Eus
Versions 6.7_ppc64, 7.2_ppc64, 7.3_ppc64, 7.4_ppc64, 7.5_ppc64, 7.6_ppc64
RedhatEnterprise Linux For Power Little Endian
Version 7.0_ppc64le
RedhatEnterprise Linux For Power Little Endian Eus
Versions 7.2_ppc64le, 7.3_ppc64le, 7.4_ppc64le, 7.5_ppc64le, 7.6_ppc64le, 7.7_ppc64le
RedhatEnterprise Linux Hpc Node
Versions 6.0, 7.0
RedhatEnterprise Linux Hpc Node Eus
Version 7.2
RedhatEnterprise Linux Server
Versions 6.0, 7.0
RedhatEnterprise Linux Server Aus
Versions 7.2, 7.3, 7.4, 7.6, 7.7

Weakness classification

CWE-552

References