CVE-2016-3714:

CVE-2016-3714 (ImageTragick) — ImageMagick remote code execution via crafted images containing shell metacharacters; affects 6.9.3-9 and 7.0.0-0, fixed in 6.9.3-10 and 7.0.1-1.

Score
A numerical rating that indicates how dangerous this vulnerability is.

8.4High

Published Date:May 5, 2016
CISA KEV Date:Sep 9, 2024
Industries Affected:20

Armis Early Warning:

3049 Days

Threat Predictions

EPSS Score:93.8
EPSS Percentile:100%

Exploitability

Score:2.5
Attack Vector:LOCAL
Attack Complexity:LOW
Privileges Required:NONE
User Interaction:NONE
Scope:UNCHANGED

Impact

Score:5.9
Confidentiality Impact:HIGH
Integrity Impact:HIGH
Availability Impact:HIGH

Description Preview

CVE-2016-3714 (ImageTragick) — ImageMagick remote code execution via crafted images containing shell metacharacters; affects 6.9.3-9 and 7.0.0-0, fixed in 6.9.3-10 and 7.0.1-1.

Overview

ImageMagick contains a remote code execution vulnerability (ImageTragick) due to certain coders (EPHEMERAL, HTTPS, MVG, MSL, TEXT, SHOW, WIN, PLT) processing shell metacharacters in crafted images. When such an image is handled by vulnerable versions, an attacker can run arbitrary commands on the affected system. The flaw affects 6.9.3-9 and 7.0.0 through 7.0.1-0, with fixes released in 6.9.3-10 and 7.0.1-1. This vulnerability prompted multiple vendor advisories and security discussions, emphasizing the need to upgrade to patched releases and apply mitigations.

Remediation

Upgrade ImageMagick to the patched releases: 6.9.3-10 or newer for the 6.x line, and 7.0.1-1 or newer for the 7.x line. Apply these upgrades across all affected systems (Red Hat, Debian, Ubuntu, SUSE, etc.).
If upgrading is not immediately possible:
Apply vendor advisories and security patches from your OS vendor (e.g., Red Hat, Debian, Ubuntu, SUSE) and follow their containment guidance.
Run ImageMagick with the least-privilege user account and, where feasible, in isolated containers or sandboxes to limit impact.
Use policy restrictions to limit or disable dangerous features and coders in ImageMagick’s policy.xml, and restrict processing of untrusted images where possible.
Validate and sanitize all image inputs in applications, and monitor for indicators of exploitation (unusual processes, logs, or spikes in resource usage).
After applying fixes or mitigations, test in a staging environment to confirm normal image processing behavior and verify that the vulnerability is no longer exploitable.