ImageMagick before 6.9.11-40 and 7.x before 7.0.10-40 mishandles the -authenticate option, which allows setting a password for password-protected PDF files. The user-controlled password was not properly escaped/sanitized and it was therefore possible to inject additional shell commands via coders/pdf.c.
CVSS Details
- CVSS 3.1 Base Score: 7.8
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | — | Upgrade imagemagick6Upgrade imagemagick | Aug 22, 2024 | Dec 7, 2020 |
| Amazon Linux Ami 2 | — | Upgrade ImageMagickUpgrade ImageMagick-perlUpgrade ImageMagick-debuginfoUpgrade ImageMagick-develUpgrade ImageMagick-c++Upgrade ImageMagick-docUpgrade ImageMagick-c++-devel | Feb 22, 2021 | Dec 7, 2020 |
| Amazon_linux | — | Upgrade ImageMagick | Feb 18, 2021 | Dec 7, 2020 |
| Centos_linux | — | Upgrade ImageMagick-develUpgrade ImageMagick-debuginfoUpgrade ImageMagick-c++Upgrade ImageMagick-docUpgrade ImageMagickUpgrade ImageMagick-c++-develUpgrade ImageMagick-perl | Jan 7, 2021 | Dec 7, 2020 |
| Debian | — | Upgrade imagemagick | Jan 14, 2021 | Dec 7, 2020 |
| Freebsd | — | Upgrade ImageMagick6-nox11Upgrade ImageMagick6Upgrade ImageMagick7-nox11Upgrade ImageMagick7 | Nov 4, 2022 | May 13, 2021 |
| Gentoo Linux | — | Upgrade media-gfx/imagemagick. | Jan 29, 2021 | Dec 7, 2020 |
| Huawei Euleros 2_0_sp2 | — | — | Feb 22, 2021 | Dec 7, 2020 |
| Huawei Euleros 2_0_sp3 | — | — | Jan 20, 2021 | Dec 7, 2020 |
| Huawei Euleros 2_0_sp5 | — | — | Mar 24, 2021 | Dec 7, 2020 |
| Huawei Euleros 2_0_sp8 | — | — | Feb 2, 2021 | Dec 7, 2020 |
| Oracle_linux | — | Upgrade ImageMagick-develUpgrade ImageMagickUpgrade ImageMagick-perlUpgrade ImageMagick-c++Upgrade ImageMagick-docUpgrade ImageMagick-c++-devel | Jan 6, 2021 | Dec 7, 2020 |
| Redhat_linux | — | Upgrade ImageMagick-c++-develUpgrade ImageMagick-develUpgrade ImageMagick-debuginfoUpgrade ImageMagick-docNo solution existsUpgrade ImageMagickUpgrade ImageMagick-perlUpgrade ImageMagick-c++ | Jan 7, 2021 | Dec 7, 2020 |
| Suse | — | Upgrade libMagick++-7_Q16HDRI4Upgrade imagemagick-config-7-upstreamUpgrade libmagickcore-7_q16hdri6-32bitUpgrade libMagickCore-7_Q16HDRI6Upgrade libMagick++-develUpgrade ImageMagickUpgrade perl-PerlMagickUpgrade libmagick-7_q16hdri4-32bitUpgrade ImageMagick-develUpgrade ImageMagick-config-7-SUSEUpgrade libMagickWand-7_Q16HDRI6Upgrade ImageMagick-docUpgrade ImageMagick-extraUpgrade libmagickwand-7_q16hdri6-32bitUpgrade imagemagick-devel-32bitUpgrade libmagick-devel-32bit | Jan 19, 2021 | Dec 7, 2020 |
| Ubuntu | — | Upgrade libmagickwand-6.q16-devUpgrade perlmagickUpgrade libmagickcore-6.q16-devUpgrade libmagickcore-6.q16-2 (Ubuntu Pro)Upgrade libimage-magick-perl (Ubuntu Pro)Upgrade imagemagick-commonUpgrade libmagickcore-6.q16-6 (Ubuntu Pro)Upgrade libmagick++-6.q16hdri-8 (Ubuntu Pro)Upgrade libmagickwand-dev (Ubuntu Pro)Upgrade libmagick++-6.q16-dev (Ubuntu Pro)Upgrade libmagick++-6.q16hdri-8Upgrade libimage-magick-perlUpgrade libmagickwand-devUpgrade imagemagick-6-common (Ubuntu Pro)Upgrade libmagickwand-6.q16-2 (Ubuntu Pro)Upgrade libmagickwand-6.q16-3 (Ubuntu Pro)Upgrade libmagick++-6.q16hdri-7 (Ubuntu Pro)Upgrade libmagickcore-6.q16-6Upgrade libmagickcore-6.q16hdri-6Upgrade libmagickcore-6.q16hdri-6 (Ubuntu Pro)Upgrade libmagick++-6.q16hdri-devUpgrade imagemagick-6.q16Upgrade libimage-magick-q16-perlUpgrade libmagickcore-6-headersUpgrade libmagickcore-devUpgrade libmagick++-6.q16hdri-dev (Ubuntu Pro)Upgrade libmagickwand-6.q16-6 (Ubuntu Pro)Upgrade imagemagick-6.q16hdriUpgrade imagemagick-6.q16 (Ubuntu Pro)Upgrade imagemagick (Ubuntu Pro)Upgrade libmagick++-devUpgrade imagemagick-common (Ubuntu Pro)Upgrade libmagickwand-6.q16-6Upgrade libmagickcore-6.q16hdri-3 (Ubuntu Pro)Upgrade libmagickcore-6.q16-dev (Ubuntu Pro)Upgrade libmagick++-6.q16-5v5 (Ubuntu Pro)Upgrade libmagick++-6.q16-8 (Ubuntu Pro)Upgrade perlmagick (Ubuntu Pro)Upgrade libmagick++-dev (Ubuntu Pro)Upgrade libmagick++-6.q16-devUpgrade libimage-magick-q16-perl (Ubuntu Pro)Upgrade libmagick++-6.q16-7 (Ubuntu Pro)Upgrade libmagickcore-dev (Ubuntu Pro)Upgrade imagemagickUpgrade libmagickcore-6.q16-3 (Ubuntu Pro)Upgrade imagemagick-6.q16hdri (Ubuntu Pro)Upgrade imagemagick-6-commonUpgrade libmagickwand-6.q16-dev (Ubuntu Pro)Upgrade libmagick++-6.q16-8Upgrade libmagickcore-6-headers (Ubuntu Pro) | Jul 5, 2023 | Dec 7, 2020 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub