CVE-2016-5118

NameCVE-2016-5118
DescriptionThe OpenBlob function in blob.c in GraphicsMagick before 1.3.24 and ImageMagick allows remote attackers to execute arbitrary code via a | (pipe) character at the start of a filename.
SourceCVE (at NVD; CERT, LWN, oss-sec, fulldisc, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)
ReferencesDLA-500-1, DLA-502-1, DSA-3591-1, DSA-3746-1
Debian Bugs825799, 825800

Vulnerable and fixed packages

The table below lists information on source packages.

Source PackageReleaseVersionStatus
graphicsmagick (PTS)buster1.4+really1.3.35-1~deb10u2fixed
buster (security)1.4+really1.3.35-1~deb10u3fixed
bullseye (security), bullseye1.4+really1.3.36+hg16481-2+deb11u1fixed
bookworm1.4+really1.3.40-4fixed
trixie1.4+really1.3.42-1fixed
sid1.4+really1.3.43-1fixed
imagemagick (PTS)buster8:6.9.10.23+dfsg-2.1+deb10u1fixed
buster (security)8:6.9.10.23+dfsg-2.1+deb10u7fixed
bullseye8:6.9.11.60+dfsg-1.3+deb11u2fixed
bullseye (security)8:6.9.11.60+dfsg-1.3+deb11u3fixed
bookworm8:6.9.11.60+dfsg-1.6fixed
bookworm (security)8:6.9.11.60+dfsg-1.6+deb12u1fixed
trixie8:6.9.12.98+dfsg1-5fixed
sid8:6.9.12.98+dfsg1-5.2fixed

The information below is based on the following data on fixed versions.

PackageTypeReleaseFixed VersionUrgencyOriginDebian Bugs
graphicsmagicksourcewheezy1.3.16-1.1+deb7u2DLA-502-1
graphicsmagicksourcejessie1.3.20-3+deb8u2DSA-3746-1
graphicsmagicksource(unstable)1.3.24-1825800
imagemagicksourcewheezy8:6.7.7.10-5+deb7u6DLA-500-1
imagemagicksourcejessie8:6.8.9.9-5+deb8u3DSA-3591-1
imagemagicksource(unstable)8:6.8.9.9-7.1825799

Notes

fixed by http://hg.graphicsmagick.org/hg/GraphicsMagick/rev/ae3928faa858
patch available at https://www.openwall.com/lists/oss-security/2016/05/29/7

Search for package or bug name: Reporting problems