CVE-2016-3718: ImageMagick Server-Side Request Forgery (SSRF), actively exploited

Description

The (1) HTTP and (2) FTP coders in ImageMagick before 6.9.3-10 and 7.x before 7.0.1-1 allow remote attackers to conduct server-side request forgery (SSRF) attacks via a crafted image.

CVSS 3.1 breakdown

Attack vectorLocal

Attack complexityLow

Privileges requiredNone

User interactionRequired

ScopeUnchanged

ConfidentialityNone

IntegrityHigh

AvailabilityNone

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N

Affected products

Imagemagick< 6.9.3-10 · 7.0.0-0 · 7.0.1-0

Suse Linux Enterprise Debuginfo11

Suse Manager2.1

Suse Manager Proxy2.1

Suse Openstack Cloud5

Canonical Ubuntu Linux12.04 · 14.04 · 15.10 · 16.04

Opensuse Leap42.1

Opensuse13.2

Oracle Linux6 · 7

Oracle Solaris10 · 11.3

Redhat Enterprise Linux Desktop6.0 · 7.0

Redhat Enterprise Linux Eus6.7 · 7.2 · 7.3 · 7.4

Redhat Enterprise Linux For Ibm Z Systems6.0_s390x · 7.0_s390x

Redhat Enterprise Linux For Ibm Z Systems Eus6.7_s390x · 7.2_s390x · 7.3_s390x · 7.4_s390x

Redhat Enterprise Linux For Power Big Endian6.0_ppc64 · 7.0_ppc64

Redhat Enterprise Linux For Power Big Endian Eus6.7_ppc64 · 7.2_ppc64 · 7.3_ppc64 · 7.4_ppc64

Redhat Enterprise Linux For Power Little Endian7.0_ppc64le

Redhat Enterprise Linux For Power Little Endian Eus7.2_ppc64le · 7.3_ppc64le · 7.4_ppc64le · 7.5_ppc64le

Redhat Enterprise Linux Hpc Node6.0 · 7.0

Redhat Enterprise Linux Hpc Node Eus7.2

Redhat Enterprise Linux Server6.0 · 7.0

Redhat Enterprise Linux Server Aus7.2 · 7.3 · 7.4 · 7.6

Redhat Enterprise Linux Server From Rhui6.0 · 7.0

Redhat Enterprise Linux Server Supplementary Eus6.7z

Remediation

Fixed in

Imagemagick≥ 6.9.3-10

Patch & vendor advisories

References

http://git.imagemagick.org/repos/ImageMagick/blob/a01518e08c840577cabd7d3ff291a9ba735f7276/ChangeLogPatchVendor Advisory
http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00024.htmlThird Party Advisory
http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00025.htmlThird Party Advisory
http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00028.htmlThird Party Advisory
http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00032.htmlThird Party Advisory
http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00051.htmlThird Party Advisory
http://rhn.redhat.com/errata/RHSA-2016-0726.htmlThird Party Advisory
https://lists.debian.org/debian-lts-announce/2018/06/msg00009.htmlMailing ListThird Party Advisory
https://security.gentoo.org/glsa/201611-21Third Party Advisory
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2016-3718US Government Resource

and 10 more references

Related CVEs

Recent high-severity vulnerabilities sharing a weakness type.

Frequently asked

Is CVE-2016-3718 being actively exploited?

Yes. CVE-2016-3718 is listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, added 3 Nov 2021.

How severe is CVE-2016-3718?

CVE-2016-3718 has a CVSS 3.1 base score of 5.5, rated medium. EPSS estimates a 76.7% probability of exploitation.

Which products are affected by CVE-2016-3718?

Affected products include Imagemagick, Suse Linux Enterprise Debuginfo, Suse Manager, Suse Manager Proxy, Suse Openstack Cloud, and 19 more.

How do I fix CVE-2016-3718?

Upgrade affected software to a fixed version, for example Imagemagick 6.9.3-10 or later, then confirm no affected versions remain in your inventory.

How Secuno handles this

Secuno correlates vulnerabilities like CVE-2016-3718 against the real software inventory on every managed device, every day. Rather than a static severity, each match is scored in context: exploit availability, EPSS, the asset's exposure, and business criticality decide where it lands in the queue. Because it is on the CISA KEV list, Secuno flags any affected asset as top-priority automatically. If an affected version is present anywhere across your portfolio, it surfaces automatically with a prioritised remediation path.

See how prioritisation works Book a demo