Vulnerability Intelligence Report
CVE-2016-5118
The OpenBlob function in blob.c in GraphicsMagick before 1.3.24 and ImageMagick allows remote attackers to execute arbitrary code via a | (pipe) character at the start of a filename.
No Active Exploit Signals
CVSS Base Score
9.8
CRITICAL
EPSS Probability:49.33%
Executive Threat Verdict
Evaluating...
Evaluating Threat Landscape...
Assessing known weaponization, exploitation telemetry, and federal advisories.
Attack Surface
—
Authentication
—
Weaponization
—
SSVC Action
—
Affected Products & Versions
| Vendor | Product | Affected Versions |
|---|---|---|
| graphicsmagick | graphicsmagick | all |
| suse | linux_enterprise_debuginfo | 11 |
| suse | studio_onsite | 1.3 |
| suse | linux_enterprise_software_development_kit | 11, 12, 12.0 |
| oracle | solaris | 10, 11.3 |
| oracle | linux | 6, 7 |
| opensuse | leap | 42.1 |
| opensuse | opensuse | 13.2 |
| canonical | ubuntu_linux | 12.04, 14.04, 15.10, 16.04 |
| debian | debian_linux | 8.0 |
| suse | linux_enterprise_desktop | 12, 12.0 |
| suse | linux_enterprise_server | 12, 12.0 |
| suse | linux_enterprise_workstation_extension | 12 |
| imagemagick | imagemagick | all |
References & Technical Advisories
No reference links found.
Threat Intelligence Signals
EPSS Score
49.329%
GitHub Advisory
Identity & Timeline
| Status | PUBLISHED |
| Assigning Authority | MITRE Corporation · N/A · USA |
| Reserved | 2016-05-29T00:00:00 |
| Published | 2016-06-10T15:00:00 |
| Patch Date | 2016-05-29 |
| Last Updated | 2024-08-06T00:53:47 |
Community Chatter & Buzz