CVE-2016-3718

תיאור (מקור, אנגלית)

The (1) HTTP and (2) FTP coders in ImageMagick before 6.9.3-10 and 7.x before 7.0.1-1 allow remote attackers to conduct server-side request forgery (SSRF) attacks via a crafted image.

מדדים

CVSS 3.1

5.5 (MEDIUM) מקור הציון: NVD CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N

EPSS — סבירות ניצול

77% (אחוזון 100) נכון ל-24/7/2026

CWE

CWE-918

מוצרים מושפעים

redhat: enterprise linux desktop; redhat: enterprise linux eus; redhat: enterprise linux for ibm z systems; redhat: enterprise linux for ibm z systems eus; redhat: enterprise linux for power big endian; redhat: enterprise linux for power big endian eus; redhat: enterprise linux for power little endian; redhat: enterprise linux for power little endian eus; redhat: enterprise linux hpc node; redhat: enterprise linux hpc node eus; redhat: enterprise linux server; redhat: enterprise linux server aus; redhat: enterprise linux server from rhui; redhat: enterprise linux server supplementary eus; redhat: enterprise linux server tus

קישורים

• http://git.imagemagick.org/repos/ImageMagick/blob/a01518e08c840577cabd7d3ff291‮… PatchVendor Advisory
• https://www.imagemagick.org/discourse-server/viewtopic.php?f=4&t=29588 Vendor Advisory
• http://git.imagemagick.org/repos/ImageMagick/blob/a01518e08c840577cabd7d3ff291‮… PatchVendor Advisory
• https://www.imagemagick.org/discourse-server/viewtopic.php?f=4&t=29588 Vendor Advisory
• http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00024.html Third Party Advisory
• http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00025.html Third Party Advisory
• http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00028.html Third Party Advisory
• http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00032.html Third Party Advisory
• http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00051.html Third Party Advisory
• http://rhn.redhat.com/errata/RHSA-2016-0726.html Third Party Advisory