Overly broad permissions can turn one compromised account into a much larger security problem. Learn how to reduce unnecessary access, review privileges, and apply least privilege across modern Linux systems. Review Linux Privileges×

Alerts This Week
Warning Icon 1 461
Alerts This Week
Warning Icon 1 461

openSUSE Leap 15.3: 2021:1523-1 Critical: ImageMagick Command Injection

opensuse
Calendar Grey May 7, 2016
Scroller Opensuse
The latest update for ImageMagick addresses vulnerabilities related to remote code execution and file handling in openSUSE. Detailed instructions for installation are provided.
An update that fixes 5 vulnerabilities is now available

Description

This update for ImageMagick fixes the following issues:

Security issues fixed:

- Several coders were vulnerable to remote code execution attacks, these

coders have now been disabled by default but can be re-enabled by

editing "/etc/ImageMagick-*/policy.xml" (bsc#978061)

- CVE-2016-3714: Insufficient shell characters filtering leads to

(potentially remote) code execution

- CVE-2016-3715: Possible file deletion by using ImageMagick's 'ephemeral'

pseudo protocol which deletes files after reading.

- CVE-2016-3716: Possible file moving by using ImageMagick's 'msl' pseudo

protocol with any extension in any folder.

- CVE-2016-3717: Possible local file read by using ImageMagick's 'label'

pseudo protocol to get content of the files from the server.

- CVE-2016-3718: Possible Server Side Request Forgery (SSRF) to make HTTP

GET or FTP request.

Bugs fixed:

- Use external svg loader (rsvg)

This update was imported from the...

Read the Full Advisory

Topics%20covered

Topics Covered

security advisory critical remote execution patch ImageMagick execution issue openSUSE

Patch

Patch Instructions:

To install this openSUSE Security Update use YaST online_update.

Alternatively you can run the command listed for your product:

- openSUSE Leap 42.1:

zypper in -t patch openSUSE-2016-574=1

To bring your system up-to-date, use "zypper patch".

Package List

- openSUSE Leap 42.1 (i586 x86_64):

ImageMagick-6.8.8.1-9.1

ImageMagick-debuginfo-6.8.8.1-9.1

ImageMagick-debugsource-6.8.8.1-9.1

ImageMagick-devel-6.8.8.1-9.1

ImageMagick-extra-6.8.8.1-9.1

ImageMagick-extra-debuginfo-6.8.8.1-9.1

libMagick++-6_Q16-3-6.8.8.1-9.1

libMagick++-6_Q16-3-debuginfo-6.8.8.1-9.1

libMagick++-devel-6.8.8.1-9.1

libMagickCore-6_Q16-1-6.8.8.1-9.1

libMagickCore-6_Q16-1-debuginfo-6.8.8.1-9.1

libMagickWand-6_Q16-1-6.8.8.1-9.1

libMagickWand-6_Q16-1-debuginfo-6.8.8.1-9.1

perl-PerlMagick-6.8.8.1-9.1

perl-PerlMagick-debuginfo-6.8.8.1-9.1

- openSUSE Leap 42.1 (noarch):

ImageMagick-doc-6.8.8.1-9.1

- openSUSE Leap 42.1 (x86_64):

ImageMagick-devel-32bit-6.8.8.1-9.1

libMagick++-6_Q16-3-32bit-6.8.8.1-9.1

libMagick++-6_Q16-3-debuginfo-32bit-6.8.8.1-9.1

libMagick++-devel-32bit-6.8.8.1-9.1

libMagickCore-6_Q16-1-32bit-6.8.8.1-9.1

libMagickCore-6_Q16-1-debuginfo-32bit-6.8.8.1-9.1

libMagickWand-6_Q16-1-32bit-6.8.8.1-9.1

libMagickWand-6_Q16-1-debuginfo-32bit-6.8.8.1-9.1

References

https://www.suse.com/security/cve/CVE-2016-3714.html

https://www.suse.com/security/cve/CVE-2016-3715.html

https://www.suse.com/security/cve/CVE-2016-3716.html

https://www.suse.com/security/cve/CVE-2016-3717.html

https://www.suse.com/security/cve/CVE-2016-3718.html

https://bugzilla.suse.com/show_bug.cgi?id=978061

Severity
critical
Lowest
Low
Medium
High
Critical

Announcement ID: openSUSE-SU-2016:1266-1
Rating: important
Affected Products: openSUSE Leap 42.1 .

Topics%20covered

Topics Covered

security advisory critical remote execution patch ImageMagick execution issue openSUSE

Get the latest News and Insights

Get the latest Linux and open source security news straight to your inbox.