According to the versions of the ImageMagick packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - It was discovered that ImageMagick did not properly     sanitize certain input before using it to invoke     processes. A remote attacker could create a specially     crafted image that, when processed by an application     using ImageMagick or an unsuspecting user using the     ImageMagick utilities, would lead to arbitrary     execution of shell commands with the privileges of the     user running the application.(CVE-2016-5118)

  - It was discovered that ImageMagick did not properly     sanitize certain input before passing it to the gnuplot     delegate functionality. A remote attacker could create     a specially crafted image that, when processed by an     application using ImageMagick or an unsuspecting user     using the ImageMagick utilities, would lead to     arbitrary execution of shell commands with the     privileges of the user running the application.
    (CVE-2016-5239)

  - Multiple flaws have been discovered in ImageMagick. A     remote attacker could, for example, create specially     crafted images that, when processed by an application     using ImageMagick or an unsuspecting user using the     ImageMagick utilities, would result in a memory     corruption and, potentially, execution of arbitrary     code, a denial of service, or an application crash.
    (CVE-2015-8896, CVE-2015-8895, CVE-2016-5240,     CVE-2015-8897, CVE-2015-8898)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Ubuntu 14.04 LTS / 16.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-3131-1 advisory.

    It was discovered that ImageMagick incorrectly handled certain malformed image files. If a user or     automated system using ImageMagick were tricked into opening a specially crafted image, an attacker could     exploit this to cause a denial of service or possibly execute code with the privileges of the user     invoking the program.

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote MiracleLinux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2016-519:03 advisory.

    ImageMagick is an image display and manipulation tool for the X     Window System. ImageMagick can read and write JPEG, TIFF, PNM, GIF,     and Photo CD image formats. It can resize, rotate, sharpen, color     reduce, or add special effects to an image, and when finished you can     either save the completed work in the original format or a different     one. ImageMagick also includes command line programs for creating     animated or transparent .gifs, creating composite images, creating     thumbnail images, and more.
    ImageMagick is one of your choices if you need a program to manipulate     and display images. If you want to develop your own applications     which use ImageMagick code or APIs, you need to install     ImageMagick-devel as well.
    Security issues fixed with this release:
    CVE-2015-8895
    ** RESERVED **     This candidate has been reserved by an organization or individual that     will use it when announcing a new security problem.  When the     candidate has been publicized, the details for this candidate will be     provided.
    CVE-2015-8896
    ** RESERVED **     This candidate has been reserved by an organization or individual that     will use it when announcing a new security problem.  When the     candidate has been publicized, the details for this candidate will be     provided.
    CVE-2015-8897
    ** RESERVED **     This candidate has been reserved by an organization or individual that     will use it when announcing a new security problem.  When the     candidate has been publicized, the details for this candidate will be     provided.
    CVE-2015-8898
    ** RESERVED **     This candidate has been reserved by an organization or individual that     will use it when announcing a new security problem.  When the     candidate has been publicized, the details for this candidate will be     provided.
    CVE-2016-5118     The OpenBlob function in blob.c in GraphicsMagick before 1.3.24 and     ImageMagick allows remote attackers to execute arbitrary code via a |     (pipe) character at the start of a filename.
    CVE-2016-5239
    ** RESERVED **     This candidate has been reserved by an organization or individual that     will use it when announcing a new security problem.  When the     candidate has been publicized, the details for this candidate will be     provided.
    CVE-2016-5240
    ** RESERVED **     This candidate has been reserved by an organization or individual that     will use it when announcing a new security problem.  When the     candidate has been publicized, the details for this candidate will be     provided.

Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Published	Updated	Severity
99792	EulerOS 2.0 SP1 : ImageMagick (EulerOS-SA-2016-1029)	Nessus	Huawei Local Security Checks	5/1/2017	12/22/2025	critical
95053	Ubuntu 14.04 LTS / 16.04 LTS : ImageMagick vulnerabilities (USN-3131-1)	Nessus	Ubuntu Local Security Checks	11/22/2016	8/27/2024	critical
289192	MiracleLinux 7 : ImageMagick-6.7.8.9-15.el7 (AXSA:2016-519:03)	Nessus	Miracle Linux Local Security Checks	1/16/2026	1/16/2026	critical

Detections

Analytics

Plugins Search

critical

critical

critical