جزئیات آسیب‌پذیری

خلاصه‌ی فارسی برای این آسیب‌پذیری هنوز تهیه نشده است.

The (1) EPHEMERAL, (2) HTTPS, (3) MVG, (4) MSL, (5) TEXT, (6) SHOW, (7) WIN, and (8) PLT coders in ImageMagick before 6.9.3-10 and 7.x before 7.0.1-1 allow remote attackers to execute arbitrary code via shell metacharacters in a crafted image, aka "ImageTragick."

• https://imagetragick.com/ x_refsource_MISC
• https://access.redhat.com/security/vulnerabilities/2296071 x_refsource_CONFIRM
• http://git.imagemagick.org/repos/ImageMagick/blob/a01518e08c840577cabd7d3ff291a9ba735f7276/ChangeLog x_refsource_CONFIRM
• http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00028.html vendor-advisoryx_refsource_SUSE
• http://www.securitytracker.com/id/1035742 vdb-entryx_refsource_SECTRACK
• http://www.oracle.com/technetwork/topics/security/linuxbulletinapr2016-2952096.html x_refsource_CONFIRM
• https://www.imagemagick.org/discourse-server/viewtopic.php?f=4&t=29588 x_refsource_CONFIRM
• http://www.openwall.com/lists/oss-security/2016/05/03/13 mailing-listx_refsource_MLIST
• http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00041.html vendor-advisoryx_refsource_SUSE
• http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00051.html vendor-advisoryx_refsource_SUSE
• http://www.ubuntu.com/usn/USN-2990-1 vendor-advisoryx_refsource_UBUNTU
• http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00025.html vendor-advisoryx_refsource_SUSE
• http://www.securityfocus.com/archive/1/538378/100/0/threaded mailing-listx_refsource_BUGTRAQ
• https://www.exploit-db.com/exploits/39767/ exploitx_refsource_EXPLOIT-DB
• http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00024.html vendor-advisoryx_refsource_SUSE
• http://www.rapid7.com/db/modules/exploit/unix/fileformat/imagemagick_delegate x_refsource_MISC
• http://www.oracle.com/technetwork/topics/security/bulletinjul2016-3090568.html x_refsource_CONFIRM
• http://www.openwall.com/lists/oss-security/2016/05/03/18 mailing-listx_refsource_MLIST
• http://www.debian.org/security/2016/dsa-3746 vendor-advisoryx_refsource_DEBIAN
• https://security.gentoo.org/glsa/201611-21 vendor-advisoryx_refsource_GENTOO
• http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00032.html vendor-advisoryx_refsource_SUSE
• http://www.slackware.com/security/viewer.php?l=slackware-security&y=2016&m=slackware-security.440568 vendor-advisoryx_refsource_SLACKWARE
• https://www.imagemagick.org/script/changelog.php x_refsource_CONFIRM
• https://www.exploit-db.com/exploits/39791/ exploitx_refsource_EXPLOIT-DB
• http://www.debian.org/security/2016/dsa-3580 vendor-advisoryx_refsource_DEBIAN
• http://www.securityfocus.com/bid/89848 vdb-entryx_refsource_BID
• http://rhn.redhat.com/errata/RHSA-2016-0726.html vendor-advisoryx_refsource_REDHAT
• https://bugzilla.redhat.com/show_bug.cgi?id=1332492 x_refsource_CONFIRM
• https://www.kb.cert.org/vuls/id/250519 third-party-advisoryx_refsource_CERT-VN
• http://packetstormsecurity.com/files/152364/ImageTragick-ImageMagick-Proof-Of-Concepts.html x_refsource_MISC
• https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2016-3714 government-resource