Vulnerability-Lookup

CVE-2016-5842 (GCVE-0-2016-5842)

Vulnerability from cvelistv5 – Published: 2016-12-13 15:00 – Updated: 2024-08-06 01:15

Summary

MagickCore/property.c in ImageMagick before 7.0.2-1 allows remote attackers to obtain sensitive memory information via vectors involving the q variable, which triggers an out-of-bounds read.

Severity

7.5 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

CWE

Assigner

mitre mitre root

References

7 references

URL	Tags
https://github.com/ImageMagick/ImageMagick/commit…	x_refsource_CONFIRM
http://www.securityfocus.com/bid/91394	vdb-entryx_refsource_BID
http://www.oracle.com/technetwork/topics/security…	x_refsource_CONFIRM
https://security.gentoo.org/glsa/201611-21	vendor-advisoryx_refsource_GENTOO
http://www.openwall.com/lists/oss-security/2016/06/25/3	mailing-listx_refsource_MLIST
https://github.com/ImageMagick/ImageMagick/commit…	x_refsource_CONFIRM
http://www.openwall.com/lists/oss-security/2016/06/23/1	mailing-listx_refsource_MLIST

Date Public

2016-06-23 00:00

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-06T01:15:10.796Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://github.com/ImageMagick/ImageMagick/commits/7.0.2-1"
          },
          {
            "name": "91394",
            "tags": [
              "vdb-entry",
              "x_refsource_BID",
              "x_transferred"
            ],
            "url": "http://www.securityfocus.com/bid/91394"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "http://www.oracle.com/technetwork/topics/security/bulletinjul2016-3090568.html"
          },
          {
            "name": "GLSA-201611-21",
            "tags": [
              "vendor-advisory",
              "x_refsource_GENTOO",
              "x_transferred"
            ],
            "url": "https://security.gentoo.org/glsa/201611-21"
          },
          {
            "name": "[oss-security] 20160625 Re: Fwd: out-of-bounds read in MagickCore/property.c:1396 could lead to memory leak/ Integer overflow read to RCE",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "http://www.openwall.com/lists/oss-security/2016/06/25/3"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://github.com/ImageMagick/ImageMagick/commit/d8ab7f046587f2e9f734b687ba7e6e10147c294b"
          },
          {
            "name": "[oss-security] 20160623 Fwd: out-of-bounds read in MagickCore/property.c:1396 could lead to memory leak/ Integer overflow read to RCE",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "http://www.openwall.com/lists/oss-security/2016/06/23/1"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "datePublic": "2016-06-23T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "MagickCore/property.c in ImageMagick before 7.0.2-1 allows remote attackers to obtain sensitive memory information via vectors involving the q variable, which triggers an out-of-bounds read."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2017-06-30T16:57:01.000Z",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/ImageMagick/ImageMagick/commits/7.0.2-1"
        },
        {
          "name": "91394",
          "tags": [
            "vdb-entry",
            "x_refsource_BID"
          ],
          "url": "http://www.securityfocus.com/bid/91394"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "http://www.oracle.com/technetwork/topics/security/bulletinjul2016-3090568.html"
        },
        {
          "name": "GLSA-201611-21",
          "tags": [
            "vendor-advisory",
            "x_refsource_GENTOO"
          ],
          "url": "https://security.gentoo.org/glsa/201611-21"
        },
        {
          "name": "[oss-security] 20160625 Re: Fwd: out-of-bounds read in MagickCore/property.c:1396 could lead to memory leak/ Integer overflow read to RCE",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "http://www.openwall.com/lists/oss-security/2016/06/25/3"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/ImageMagick/ImageMagick/commit/d8ab7f046587f2e9f734b687ba7e6e10147c294b"
        },
        {
          "name": "[oss-security] 20160623 Fwd: out-of-bounds read in MagickCore/property.c:1396 could lead to memory leak/ Integer overflow read to RCE",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "http://www.openwall.com/lists/oss-security/2016/06/23/1"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "cve@mitre.org",
          "ID": "CVE-2016-5842",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "n/a",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "n/a"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "MagickCore/property.c in ImageMagick before 7.0.2-1 allows remote attackers to obtain sensitive memory information via vectors involving the q variable, which triggers an out-of-bounds read."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "n/a"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://github.com/ImageMagick/ImageMagick/commits/7.0.2-1",
              "refsource": "CONFIRM",
              "url": "https://github.com/ImageMagick/ImageMagick/commits/7.0.2-1"
            },
            {
              "name": "91394",
              "refsource": "BID",
              "url": "http://www.securityfocus.com/bid/91394"
            },
            {
              "name": "http://www.oracle.com/technetwork/topics/security/bulletinjul2016-3090568.html",
              "refsource": "CONFIRM",
              "url": "http://www.oracle.com/technetwork/topics/security/bulletinjul2016-3090568.html"
            },
            {
              "name": "GLSA-201611-21",
              "refsource": "GENTOO",
              "url": "https://security.gentoo.org/glsa/201611-21"
            },
            {
              "name": "[oss-security] 20160625 Re: Fwd: out-of-bounds read in MagickCore/property.c:1396 could lead to memory leak/ Integer overflow read to RCE",
              "refsource": "MLIST",
              "url": "http://www.openwall.com/lists/oss-security/2016/06/25/3"
            },
            {
              "name": "https://github.com/ImageMagick/ImageMagick/commit/d8ab7f046587f2e9f734b687ba7e6e10147c294b",
              "refsource": "CONFIRM",
              "url": "https://github.com/ImageMagick/ImageMagick/commit/d8ab7f046587f2e9f734b687ba7e6e10147c294b"
            },
            {
              "name": "[oss-security] 20160623 Fwd: out-of-bounds read in MagickCore/property.c:1396 could lead to memory leak/ Integer overflow read to RCE",
              "refsource": "MLIST",
              "url": "http://www.openwall.com/lists/oss-security/2016/06/23/1"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2016-5842",
    "datePublished": "2016-12-13T15:00:00.000Z",
    "dateReserved": "2016-06-23T00:00:00.000Z",
    "dateUpdated": "2024-08-06T01:15:10.796Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2016-5842",
      "date": "2026-09-29",
      "epss": "0.06463",
      "percentile": "0.9351"
    },
    "fkie_nvd": {
      "configurations": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:a:imagemagick:imagemagick:*:*:*:*:*:*:*:*",
                  "matchCriteriaId": "A8A98172-FAA7-4CED-8DA1-B8E1A92F9EEF",
                  "versionEndExcluding": "6.9.4-10",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:imagemagick:imagemagick:*:*:*:*:*:*:*:*",
                  "matchCriteriaId": "3CD031CA-53C3-455E-AF92-C0846DDE254A",
                  "versionEndExcluding": "7.0.2-1",
                  "versionStartIncluding": "7.0.0-0",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        },
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:oracle:solaris:10:*:*:*:*:*:*:*",
                  "matchCriteriaId": "964B57CD-CB8A-4520-B358-1C93EC5EF2DC",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:oracle:solaris:11.3:*:*:*:*:*:*:*",
                  "matchCriteriaId": "79A602C5-61FE-47BA-9786-F045B6C6DBA8",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "MagickCore/property.c in ImageMagick before 7.0.2-1 allows remote attackers to obtain sensitive memory information via vectors involving the q variable, which triggers an out-of-bounds read."
        },
        {
          "lang": "es",
          "value": "MagickCore/property.c en ImageMagick en versiones anteriores a 7.0.2-1 permite a atacantes remotos obtener informaci\u00f3n de memoria sensible a trav\u00e9s de vectores que implican a la variable q, lo que desencadena una lectura fuera de l\u00edmites."
        }
      ],
      "id": "CVE-2016-5842",
      "lastModified": "2024-11-21T02:55:07.043",
      "metrics": {
        "cvssMetricV2": [
          {
            "acInsufInfo": true,
            "baseSeverity": "MEDIUM",
            "cvssData": {
              "accessComplexity": "LOW",
              "accessVector": "NETWORK",
              "authentication": "NONE",
              "availabilityImpact": "NONE",
              "baseScore": 5.0,
              "confidentialityImpact": "PARTIAL",
              "integrityImpact": "NONE",
              "vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:N",
              "version": "2.0"
            },
            "exploitabilityScore": 10.0,
            "impactScore": 2.9,
            "obtainAllPrivilege": false,
            "obtainOtherPrivilege": false,
            "obtainUserPrivilege": false,
            "source": "nvd@nist.gov",
            "type": "Primary",
            "userInteractionRequired": false
          }
        ],
        "cvssMetricV31": [
          {
            "cvssData": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "NONE",
              "baseScore": 7.5,
              "baseSeverity": "HIGH",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "NONE",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
              "version": "3.1"
            },
            "exploitabilityScore": 3.9,
            "impactScore": 3.6,
            "source": "nvd@nist.gov",
            "type": "Primary"
          }
        ]
      },
      "published": "2016-12-13T15:59:07.997",
      "references": [
        {
          "source": "cve@mitre.org",
          "tags": [
            "Mailing List",
            "Patch",
            "Third Party Advisory"
          ],
          "url": "http://www.openwall.com/lists/oss-security/2016/06/23/1"
        },
        {
          "source": "cve@mitre.org",
          "tags": [
            "Exploit",
            "Mailing List",
            "Third Party Advisory"
          ],
          "url": "http://www.openwall.com/lists/oss-security/2016/06/25/3"
        },
        {
          "source": "cve@mitre.org",
          "tags": [
            "Third Party Advisory"
          ],
          "url": "http://www.oracle.com/technetwork/topics/security/bulletinjul2016-3090568.html"
        },
        {
          "source": "cve@mitre.org",
          "tags": [
            "Exploit",
            "Third Party Advisory",
            "VDB Entry"
          ],
          "url": "http://www.securityfocus.com/bid/91394"
        },
        {
          "source": "cve@mitre.org",
          "tags": [
            "Patch",
            "Third Party Advisory"
          ],
          "url": "https://github.com/ImageMagick/ImageMagick/commit/d8ab7f046587f2e9f734b687ba7e6e10147c294b"
        },
        {
          "source": "cve@mitre.org",
          "tags": [
            "Patch",
            "Third Party Advisory"
          ],
          "url": "https://github.com/ImageMagick/ImageMagick/commits/7.0.2-1"
        },
        {
          "source": "cve@mitre.org",
          "tags": [
            "Third Party Advisory"
          ],
          "url": "https://security.gentoo.org/glsa/201611-21"
        },
        {
          "source": "af854a3a-2127-422b-91ae-364da2661108",
          "tags": [
            "Mailing List",
            "Patch",
            "Third Party Advisory"
          ],
          "url": "http://www.openwall.com/lists/oss-security/2016/06/23/1"
        },
        {
          "source": "af854a3a-2127-422b-91ae-364da2661108",
          "tags": [
            "Exploit",
            "Mailing List",
            "Third Party Advisory"
          ],
          "url": "http://www.openwall.com/lists/oss-security/2016/06/25/3"
        },
        {
          "source": "af854a3a-2127-422b-91ae-364da2661108",
          "tags": [
            "Third Party Advisory"
          ],
          "url": "http://www.oracle.com/technetwork/topics/security/bulletinjul2016-3090568.html"
        },
        {
          "source": "af854a3a-2127-422b-91ae-364da2661108",
          "tags": [
            "Exploit",
            "Third Party Advisory",
            "VDB Entry"
          ],
          "url": "http://www.securityfocus.com/bid/91394"
        },
        {
          "source": "af854a3a-2127-422b-91ae-364da2661108",
          "tags": [
            "Patch",
            "Third Party Advisory"
          ],
          "url": "https://github.com/ImageMagick/ImageMagick/commit/d8ab7f046587f2e9f734b687ba7e6e10147c294b"
        },
        {
          "source": "af854a3a-2127-422b-91ae-364da2661108",
          "tags": [
            "Patch",
            "Third Party Advisory"
          ],
          "url": "https://github.com/ImageMagick/ImageMagick/commits/7.0.2-1"
        },
        {
          "source": "af854a3a-2127-422b-91ae-364da2661108",
          "tags": [
            "Third Party Advisory"
          ],
          "url": "https://security.gentoo.org/glsa/201611-21"
        }
      ],
      "sourceIdentifier": "cve@mitre.org",
      "vulnStatus": "Modified",
      "weaknesses": [
        {
          "description": [
            {
              "lang": "en",
              "value": "CWE-125"
            }
          ],
          "source": "nvd@nist.gov",
          "type": "Primary"
        }
      ]
    },
    "nvd": {
      "cve": {
        "configurations": [
          {
            "nodes": [
              {
                "cpeMatch": [
                  {
                    "criteria": "cpe:2.3:a:imagemagick:imagemagick:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "A8A98172-FAA7-4CED-8DA1-B8E1A92F9EEF",
                    "versionEndExcluding": "6.9.4-10",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:imagemagick:imagemagick:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "3CD031CA-53C3-455E-AF92-C0846DDE254A",
                    "versionEndExcluding": "7.0.2-1",
                    "versionStartIncluding": "7.0.0-0",
                    "vulnerable": true
                  }
                ],
                "negate": false,
                "operator": "OR"
              }
            ]
          },
          {
            "nodes": [
              {
                "cpeMatch": [
                  {
                    "criteria": "cpe:2.3:o:oracle:solaris:10:*:*:*:*:*:*:*",
                    "matchCriteriaId": "964B57CD-CB8A-4520-B358-1C93EC5EF2DC",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:oracle:solaris:11.3:*:*:*:*:*:*:*",
                    "matchCriteriaId": "79A602C5-61FE-47BA-9786-F045B6C6DBA8",
                    "vulnerable": true
                  }
                ],
                "negate": false,
                "operator": "OR"
              }
            ]
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "MagickCore/property.c in ImageMagick before 7.0.2-1 allows remote attackers to obtain sensitive memory information via vectors involving the q variable, which triggers an out-of-bounds read."
          },
          {
            "lang": "es",
            "value": "MagickCore/property.c en ImageMagick en versiones anteriores a 7.0.2-1 permite a atacantes remotos obtener informaci\u00f3n de memoria sensible a trav\u00e9s de vectores que implican a la variable q, lo que desencadena una lectura fuera de l\u00edmites."
          }
        ],
        "id": "CVE-2016-5842",
        "lastModified": "2026-05-06T22:30:45.220",
        "metrics": {
          "cvssMetricV2": [
            {
              "acInsufInfo": true,
              "baseSeverity": "MEDIUM",
              "cvssData": {
                "accessComplexity": "LOW",
                "accessVector": "NETWORK",
                "authentication": "NONE",
                "availabilityImpact": "NONE",
                "baseScore": 5.0,
                "confidentialityImpact": "PARTIAL",
                "integrityImpact": "NONE",
                "vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:N",
                "version": "2.0"
              },
              "exploitabilityScore": 10.0,
              "impactScore": 2.9,
              "obtainAllPrivilege": false,
              "obtainOtherPrivilege": false,
              "obtainUserPrivilege": false,
              "source": "nvd@nist.gov",
              "type": "Primary",
              "userInteractionRequired": false
            }
          ],
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "NETWORK",
                "availabilityImpact": "NONE",
                "baseScore": 7.5,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "NONE",
                "privilegesRequired": "NONE",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
                "version": "3.1"
              },
              "exploitabilityScore": 3.9,
              "impactScore": 3.6,
              "source": "nvd@nist.gov",
              "type": "Primary"
            }
          ]
        },
        "published": "2016-12-13T15:59:07.997",
        "references": [
          {
            "source": "cve@mitre.org",
            "tags": [
              "Mailing List",
              "Patch",
              "Third Party Advisory"
            ],
            "url": "http://www.openwall.com/lists/oss-security/2016/06/23/1"
          },
          {
            "source": "cve@mitre.org",
            "tags": [
              "Exploit",
              "Mailing List",
              "Third Party Advisory"
            ],
            "url": "http://www.openwall.com/lists/oss-security/2016/06/25/3"
          },
          {
            "source": "cve@mitre.org",
            "tags": [
              "Third Party Advisory"
            ],
            "url": "http://www.oracle.com/technetwork/topics/security/bulletinjul2016-3090568.html"
          },
          {
            "source": "cve@mitre.org",
            "tags": [
              "Exploit",
              "Third Party Advisory",
              "VDB Entry"
            ],
            "url": "http://www.securityfocus.com/bid/91394"
          },
          {
            "source": "cve@mitre.org",
            "tags": [
              "Patch",
              "Third Party Advisory"
            ],
            "url": "https://github.com/ImageMagick/ImageMagick/commit/d8ab7f046587f2e9f734b687ba7e6e10147c294b"
          },
          {
            "source": "cve@mitre.org",
            "tags": [
              "Patch",
              "Third Party Advisory"
            ],
            "url": "https://github.com/ImageMagick/ImageMagick/commits/7.0.2-1"
          },
          {
            "source": "cve@mitre.org",
            "tags": [
              "Third Party Advisory"
            ],
            "url": "https://security.gentoo.org/glsa/201611-21"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "tags": [
              "Mailing List",
              "Patch",
              "Third Party Advisory"
            ],
            "url": "http://www.openwall.com/lists/oss-security/2016/06/23/1"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "tags": [
              "Exploit",
              "Mailing List",
              "Third Party Advisory"
            ],
            "url": "http://www.openwall.com/lists/oss-security/2016/06/25/3"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "tags": [
              "Third Party Advisory"
            ],
            "url": "http://www.oracle.com/technetwork/topics/security/bulletinjul2016-3090568.html"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "tags": [
              "Exploit",
              "Third Party Advisory",
              "VDB Entry"
            ],
            "url": "http://www.securityfocus.com/bid/91394"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "tags": [
              "Patch",
              "Third Party Advisory"
            ],
            "url": "https://github.com/ImageMagick/ImageMagick/commit/d8ab7f046587f2e9f734b687ba7e6e10147c294b"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "tags": [
              "Patch",
              "Third Party Advisory"
            ],
            "url": "https://github.com/ImageMagick/ImageMagick/commits/7.0.2-1"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "tags": [
              "Third Party Advisory"
            ],
            "url": "https://security.gentoo.org/glsa/201611-21"
          }
        ],
        "sourceIdentifier": "cve@mitre.org",
        "vulnStatus": "Modified",
        "weaknesses": [
          {
            "description": [
              {
                "lang": "en",
                "value": "CWE-125"
              }
            ],
            "source": "nvd@nist.gov",
            "type": "Primary"
          }
        ]
      }
    },
    "redhat_vex": {
      "aggregate_severity": "Low",
      "current_release_date": "2025-11-21T11:57:09+00:00",
      "cve": "CVE-2016-5842",
      "id": "CVE-2016-5842",
      "initial_release_date": "2016-06-22T00:00:00+00:00",
      "product_status:known_not_affected": "16",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "ImageMagick: Information leak in MagickCore/property.c",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2016/cve-2016-5842.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-07-26T00:57:47Z",
      "cve": "CVE-2016-5842",
      "id": "CVE-2016-5842",
      "initial_release_date": "2023-02-15T05:00:01Z",
      "product_status:known_affected": "95",
      "product_status:known_not_affected": "14",
      "product_status:recommended": "202",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2016-5842",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2016-5842.json",
      "version": "15"
    }
  }
}

CNVD-2016-04385

Vulnerability from cnvd - Published: 2016-06-30

Title

ImageMagick任意进程数据读取漏洞

Description

ImageMagick是美国ImageMagick Studio公司的一套开源的图象处理软件。该软件可读取、转换、写入多种格式的图片。 ImageMagick中存在安全漏洞。攻击者可借助特制的‘q’参数利用该漏洞读取任意进程数据。

Severity

中

Patch Name

ImageMagick任意进程数据读取漏洞的补丁

Patch Description

ImageMagick是美国ImageMagick Studio公司的一套开源的图象处理软件。该软件可读取、转换、写入多种格式的图片。 ImageMagick中存在安全漏洞。攻击者可借助特制的‘q’参数利用该漏洞读取任意进程数据。目前，供应商发布了安全公告及相关补丁信息，修复了此漏洞。

Formal description

目前厂商已经发布了升级补丁以修复此安全问题，详情请关注厂商主页： http://www.imagemagick.org/

Reference

http://www.openwall.com/lists/oss-security/2016/06/25/3

Impacted products

Name
ImageMagick Studio LLC ImageMagick

Show details on source website

JSON

To clipboard

{
  "cves": {
    "cve": {
      "cveNumber": "CVE-2016-5842"
    }
  },
  "description": "ImageMagick\u662f\u7f8e\u56fdImageMagick Studio\u516c\u53f8\u7684\u4e00\u5957\u5f00\u6e90\u7684\u56fe\u8c61\u5904\u7406\u8f6f\u4ef6\u3002\u8be5\u8f6f\u4ef6\u53ef\u8bfb\u53d6\u3001\u8f6c\u6362\u3001\u5199\u5165\u591a\u79cd\u683c\u5f0f\u7684\u56fe\u7247\u3002\r\n\r\nImageMagick\u4e2d\u5b58\u5728\u5b89\u5168\u6f0f\u6d1e\u3002\u653b\u51fb\u8005\u53ef\u501f\u52a9\u7279\u5236\u7684\u2018q\u2019\u53c2\u6570\u5229\u7528\u8be5\u6f0f\u6d1e\u8bfb\u53d6\u4efb\u610f\u8fdb\u7a0b\u6570\u636e\u3002",
  "discovererName": "unknown",
  "formalWay": "\u76ee\u524d\u5382\u5546\u5df2\u7ecf\u53d1\u5e03\u4e86\u5347\u7ea7\u8865\u4e01\u4ee5\u4fee\u590d\u6b64\u5b89\u5168\u95ee\u9898\uff0c\u8be6\u60c5\u8bf7\u5173\u6ce8\u5382\u5546\u4e3b\u9875\uff1a\r\nhttp://www.imagemagick.org/",
  "isEvent": "\u901a\u7528\u8f6f\u786c\u4ef6\u6f0f\u6d1e",
  "number": "CNVD-2016-04385",
  "openTime": "2016-06-30",
  "patchDescription": "ImageMagick\u662f\u7f8e\u56fdImageMagick Studio\u516c\u53f8\u7684\u4e00\u5957\u5f00\u6e90\u7684\u56fe\u8c61\u5904\u7406\u8f6f\u4ef6\u3002\u8be5\u8f6f\u4ef6\u53ef\u8bfb\u53d6\u3001\u8f6c\u6362\u3001\u5199\u5165\u591a\u79cd\u683c\u5f0f\u7684\u56fe\u7247\u3002\r\n\r\nImageMagick\u4e2d\u5b58\u5728\u5b89\u5168\u6f0f\u6d1e\u3002\u653b\u51fb\u8005\u53ef\u501f\u52a9\u7279\u5236\u7684\u2018q\u2019\u53c2\u6570\u5229\u7528\u8be5\u6f0f\u6d1e\u8bfb\u53d6\u4efb\u610f\u8fdb\u7a0b\u6570\u636e\u3002\u76ee\u524d\uff0c\u4f9b\u5e94\u5546\u53d1\u5e03\u4e86\u5b89\u5168\u516c\u544a\u53ca\u76f8\u5173\u8865\u4e01\u4fe1\u606f\uff0c\u4fee\u590d\u4e86\u6b64\u6f0f\u6d1e\u3002",
  "patchName": "ImageMagick\u4efb\u610f\u8fdb\u7a0b\u6570\u636e\u8bfb\u53d6\u6f0f\u6d1e\u7684\u8865\u4e01",
  "products": {
    "product": "ImageMagick Studio LLC ImageMagick"
  },
  "referenceLink": "http://www.openwall.com/lists/oss-security/2016/06/25/3",
  "serverity": "\u4e2d",
  "submitTime": "2016-06-28",
  "title": "ImageMagick\u4efb\u610f\u8fdb\u7a0b\u6570\u636e\u8bfb\u53d6\u6f0f\u6d1e"
}

FKIE_CVE-2016-5842

Vulnerability from fkie_nvd - Published: 2016-12-13 15:59 - Updated: 2026-06-17 00:50

Severity

7.5 (High) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Summary

MagickCore/property.c in ImageMagick before 7.0.2-1 allows remote attackers to obtain sensitive memory information via vectors involving the q variable, which triggers an out-of-bounds read.

References

URL	Tags
cve@mitre.org	http://www.openwall.com/lists/oss-security/2016/06/23/1	Mailing List, Patch, Third Party Advisory
cve@mitre.org	http://www.openwall.com/lists/oss-security/2016/06/25/3	Exploit, Mailing List, Third Party Advisory
cve@mitre.org	http://www.oracle.com/technetwork/topics/security/bulletinjul2016-3090568.html	Third Party Advisory
cve@mitre.org	http://www.securityfocus.com/bid/91394	Exploit, Third Party Advisory, VDB Entry
cve@mitre.org	https://github.com/ImageMagick/ImageMagick/commit/d8ab7f046587f2e9f734b687ba7e6e10147c294b	Patch, Third Party Advisory
cve@mitre.org	https://github.com/ImageMagick/ImageMagick/commits/7.0.2-1	Patch, Third Party Advisory
cve@mitre.org	https://security.gentoo.org/glsa/201611-21	Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108	http://www.openwall.com/lists/oss-security/2016/06/23/1	Mailing List, Patch, Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108	http://www.openwall.com/lists/oss-security/2016/06/25/3	Exploit, Mailing List, Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108	http://www.oracle.com/technetwork/topics/security/bulletinjul2016-3090568.html	Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108	http://www.securityfocus.com/bid/91394	Exploit, Third Party Advisory, VDB Entry
af854a3a-2127-422b-91ae-364da2661108	https://github.com/ImageMagick/ImageMagick/commit/d8ab7f046587f2e9f734b687ba7e6e10147c294b	Patch, Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108	https://github.com/ImageMagick/ImageMagick/commits/7.0.2-1	Patch, Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108	https://security.gentoo.org/glsa/201611-21	Third Party Advisory

Impacted products

Vendor	Product	Version
imagemagick	imagemagick	*
imagemagick	imagemagick	*
oracle	solaris	10
oracle	solaris	11.3

JSON

To clipboard

{
  "affected": [
    {
      "affectedData": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "source": "cve@mitre.org"
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:imagemagick:imagemagick:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "A8A98172-FAA7-4CED-8DA1-B8E1A92F9EEF",
              "versionEndExcluding": "6.9.4-10",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:imagemagick:imagemagick:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "3CD031CA-53C3-455E-AF92-C0846DDE254A",
              "versionEndExcluding": "7.0.2-1",
              "versionStartIncluding": "7.0.0-0",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    },
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:oracle:solaris:10:*:*:*:*:*:*:*",
              "matchCriteriaId": "964B57CD-CB8A-4520-B358-1C93EC5EF2DC",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:oracle:solaris:11.3:*:*:*:*:*:*:*",
              "matchCriteriaId": "79A602C5-61FE-47BA-9786-F045B6C6DBA8",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "MagickCore/property.c in ImageMagick before 7.0.2-1 allows remote attackers to obtain sensitive memory information via vectors involving the q variable, which triggers an out-of-bounds read."
    },
    {
      "lang": "es",
      "value": "MagickCore/property.c en ImageMagick en versiones anteriores a 7.0.2-1 permite a atacantes remotos obtener informaci\u00f3n de memoria sensible a trav\u00e9s de vectores que implican a la variable q, lo que desencadena una lectura fuera de l\u00edmites."
    }
  ],
  "id": "CVE-2016-5842",
  "lastModified": "2026-06-17T00:50:07.790",
  "metrics": {
    "cvssMetricV2": [
      {
        "acInsufInfo": true,
        "baseSeverity": "MEDIUM",
        "cvssData": {
          "accessComplexity": "LOW",
          "accessVector": "NETWORK",
          "authentication": "NONE",
          "availabilityImpact": "NONE",
          "baseScore": 5.0,
          "confidentialityImpact": "PARTIAL",
          "integrityImpact": "NONE",
          "vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:N",
          "version": "2.0"
        },
        "exploitabilityScore": 10.0,
        "impactScore": 2.9,
        "obtainAllPrivilege": false,
        "obtainOtherPrivilege": false,
        "obtainUserPrivilege": false,
        "source": "nvd@nist.gov",
        "type": "Primary",
        "userInteractionRequired": false
      }
    ],
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "NONE",
          "baseScore": 7.5,
          "baseSeverity": "HIGH",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "NONE",
          "privilegesRequired": "NONE",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
          "version": "3.1"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 3.6,
        "source": "nvd@nist.gov",
        "type": "Primary"
      }
    ]
  },
  "published": "2016-12-13T15:59:07.997",
  "references": [
    {
      "source": "cve@mitre.org",
      "tags": [
        "Mailing List",
        "Patch",
        "Third Party Advisory"
      ],
      "url": "http://www.openwall.com/lists/oss-security/2016/06/23/1"
    },
    {
      "source": "cve@mitre.org",
      "tags": [
        "Exploit",
        "Mailing List",
        "Third Party Advisory"
      ],
      "url": "http://www.openwall.com/lists/oss-security/2016/06/25/3"
    },
    {
      "source": "cve@mitre.org",
      "tags": [
        "Third Party Advisory"
      ],
      "url": "http://www.oracle.com/technetwork/topics/security/bulletinjul2016-3090568.html"
    },
    {
      "source": "cve@mitre.org",
      "tags": [
        "Exploit",
        "Third Party Advisory",
        "VDB Entry"
      ],
      "url": "http://www.securityfocus.com/bid/91394"
    },
    {
      "source": "cve@mitre.org",
      "tags": [
        "Patch",
        "Third Party Advisory"
      ],
      "url": "https://github.com/ImageMagick/ImageMagick/commit/d8ab7f046587f2e9f734b687ba7e6e10147c294b"
    },
    {
      "source": "cve@mitre.org",
      "tags": [
        "Patch",
        "Third Party Advisory"
      ],
      "url": "https://github.com/ImageMagick/ImageMagick/commits/7.0.2-1"
    },
    {
      "source": "cve@mitre.org",
      "tags": [
        "Third Party Advisory"
      ],
      "url": "https://security.gentoo.org/glsa/201611-21"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Mailing List",
        "Patch",
        "Third Party Advisory"
      ],
      "url": "http://www.openwall.com/lists/oss-security/2016/06/23/1"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Exploit",
        "Mailing List",
        "Third Party Advisory"
      ],
      "url": "http://www.openwall.com/lists/oss-security/2016/06/25/3"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Third Party Advisory"
      ],
      "url": "http://www.oracle.com/technetwork/topics/security/bulletinjul2016-3090568.html"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Exploit",
        "Third Party Advisory",
        "VDB Entry"
      ],
      "url": "http://www.securityfocus.com/bid/91394"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Patch",
        "Third Party Advisory"
      ],
      "url": "https://github.com/ImageMagick/ImageMagick/commit/d8ab7f046587f2e9f734b687ba7e6e10147c294b"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Patch",
        "Third Party Advisory"
      ],
      "url": "https://github.com/ImageMagick/ImageMagick/commits/7.0.2-1"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Third Party Advisory"
      ],
      "url": "https://security.gentoo.org/glsa/201611-21"
    }
  ],
  "sourceIdentifier": "cve@mitre.org",
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-125"
        }
      ],
      "source": "nvd@nist.gov",
      "type": "Primary"
    }
  ]
}

GHSA-VPCG-R56G-2QV7

Vulnerability from github – Published: 2022-05-13 01:10 – Updated: 2022-05-13 01:10

Details

MagickCore/property.c in ImageMagick before 7.0.2-1 allows remote attackers to obtain sensitive memory information via vectors involving the q variable, which triggers an out-of-bounds read.

Severity

7.5 (High)


                  
                    CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Show details on source website

JSON

To clipboard

{
  "affected": [],
  "aliases": [
    "CVE-2016-5842"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-125"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2016-12-13T15:59:00Z",
    "severity": "HIGH"
  },
  "details": "MagickCore/property.c in ImageMagick before 7.0.2-1 allows remote attackers to obtain sensitive memory information via vectors involving the q variable, which triggers an out-of-bounds read.",
  "id": "GHSA-vpcg-r56g-2qv7",
  "modified": "2022-05-13T01:10:29Z",
  "published": "2022-05-13T01:10:29Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2016-5842"
    },
    {
      "type": "WEB",
      "url": "https://github.com/ImageMagick/ImageMagick/commit/d8ab7f046587f2e9f734b687ba7e6e10147c294b"
    },
    {
      "type": "WEB",
      "url": "https://github.com/ImageMagick/ImageMagick/commits/7.0.2-1"
    },
    {
      "type": "WEB",
      "url": "https://security.gentoo.org/glsa/201611-21"
    },
    {
      "type": "WEB",
      "url": "http://www.openwall.com/lists/oss-security/2016/06/23/1"
    },
    {
      "type": "WEB",
      "url": "http://www.openwall.com/lists/oss-security/2016/06/25/3"
    },
    {
      "type": "WEB",
      "url": "http://www.oracle.com/technetwork/topics/security/bulletinjul2016-3090568.html"
    },
    {
      "type": "WEB",
      "url": "http://www.securityfocus.com/bid/91394"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
      "type": "CVSS_V3"
    }
  ]
}

GSD-2016-5842

Vulnerability from gsd - Updated: 2023-12-13 01:21

Details

MagickCore/property.c in ImageMagick before 7.0.2-1 allows remote attackers to obtain sensitive memory information via vectors involving the q variable, which triggers an out-of-bounds read.

Aliases

CVE-2016-5842

Aliases

CVE-2016-5842

JSON

To clipboard

{
  "GSD": {
    "alias": "CVE-2016-5842",
    "description": "MagickCore/property.c in ImageMagick before 7.0.2-1 allows remote attackers to obtain sensitive memory information via vectors involving the q variable, which triggers an out-of-bounds read.",
    "id": "GSD-2016-5842",
    "references": [
      "https://www.suse.com/security/cve/CVE-2016-5842.html",
      "https://www.debian.org/security/2016/dsa-3652",
      "https://ubuntu.com/security/CVE-2016-5842",
      "https://advisories.mageia.org/CVE-2016-5842.html"
    ]
  },
  "gsd": {
    "metadata": {
      "exploitCode": "unknown",
      "remediation": "unknown",
      "reportConfidence": "confirmed",
      "type": "vulnerability"
    },
    "osvSchema": {
      "aliases": [
        "CVE-2016-5842"
      ],
      "details": "MagickCore/property.c in ImageMagick before 7.0.2-1 allows remote attackers to obtain sensitive memory information via vectors involving the q variable, which triggers an out-of-bounds read.",
      "id": "GSD-2016-5842",
      "modified": "2023-12-13T01:21:25.784646Z",
      "schema_version": "1.4.0"
    }
  },
  "namespaces": {
    "cve.org": {
      "CVE_data_meta": {
        "ASSIGNER": "cve@mitre.org",
        "ID": "CVE-2016-5842",
        "STATE": "PUBLIC"
      },
      "affects": {
        "vendor": {
          "vendor_data": [
            {
              "product": {
                "product_data": [
                  {
                    "product_name": "n/a",
                    "version": {
                      "version_data": [
                        {
                          "version_value": "n/a"
                        }
                      ]
                    }
                  }
                ]
              },
              "vendor_name": "n/a"
            }
          ]
        }
      },
      "data_format": "MITRE",
      "data_type": "CVE",
      "data_version": "4.0",
      "description": {
        "description_data": [
          {
            "lang": "eng",
            "value": "MagickCore/property.c in ImageMagick before 7.0.2-1 allows remote attackers to obtain sensitive memory information via vectors involving the q variable, which triggers an out-of-bounds read."
          }
        ]
      },
      "problemtype": {
        "problemtype_data": [
          {
            "description": [
              {
                "lang": "eng",
                "value": "n/a"
              }
            ]
          }
        ]
      },
      "references": {
        "reference_data": [
          {
            "name": "https://github.com/ImageMagick/ImageMagick/commits/7.0.2-1",
            "refsource": "CONFIRM",
            "url": "https://github.com/ImageMagick/ImageMagick/commits/7.0.2-1"
          },
          {
            "name": "91394",
            "refsource": "BID",
            "url": "http://www.securityfocus.com/bid/91394"
          },
          {
            "name": "http://www.oracle.com/technetwork/topics/security/bulletinjul2016-3090568.html",
            "refsource": "CONFIRM",
            "url": "http://www.oracle.com/technetwork/topics/security/bulletinjul2016-3090568.html"
          },
          {
            "name": "GLSA-201611-21",
            "refsource": "GENTOO",
            "url": "https://security.gentoo.org/glsa/201611-21"
          },
          {
            "name": "[oss-security] 20160625 Re: Fwd: out-of-bounds read in MagickCore/property.c:1396 could lead to memory leak/ Integer overflow read to RCE",
            "refsource": "MLIST",
            "url": "http://www.openwall.com/lists/oss-security/2016/06/25/3"
          },
          {
            "name": "https://github.com/ImageMagick/ImageMagick/commit/d8ab7f046587f2e9f734b687ba7e6e10147c294b",
            "refsource": "CONFIRM",
            "url": "https://github.com/ImageMagick/ImageMagick/commit/d8ab7f046587f2e9f734b687ba7e6e10147c294b"
          },
          {
            "name": "[oss-security] 20160623 Fwd: out-of-bounds read in MagickCore/property.c:1396 could lead to memory leak/ Integer overflow read to RCE",
            "refsource": "MLIST",
            "url": "http://www.openwall.com/lists/oss-security/2016/06/23/1"
          }
        ]
      }
    },
    "nvd.nist.gov": {
      "configurations": {
        "CVE_data_version": "4.0",
        "nodes": [
          {
            "children": [],
            "cpe_match": [
              {
                "cpe23Uri": "cpe:2.3:a:imagemagick:imagemagick:*:*:*:*:*:*:*:*",
                "cpe_name": [],
                "versionEndExcluding": "6.9.4-10",
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:imagemagick:imagemagick:*:*:*:*:*:*:*:*",
                "cpe_name": [],
                "versionEndExcluding": "7.0.2-1",
                "versionStartIncluding": "7.0.0-0",
                "vulnerable": true
              }
            ],
            "operator": "OR"
          },
          {
            "children": [],
            "cpe_match": [
              {
                "cpe23Uri": "cpe:2.3:o:oracle:solaris:10:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:o:oracle:solaris:11.3:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              }
            ],
            "operator": "OR"
          }
        ]
      },
      "cve": {
        "CVE_data_meta": {
          "ASSIGNER": "cve@mitre.org",
          "ID": "CVE-2016-5842"
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "en",
              "value": "MagickCore/property.c in ImageMagick before 7.0.2-1 allows remote attackers to obtain sensitive memory information via vectors involving the q variable, which triggers an out-of-bounds read."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "en",
                  "value": "CWE-125"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "91394",
              "refsource": "BID",
              "tags": [
                "Exploit",
                "Third Party Advisory",
                "VDB Entry"
              ],
              "url": "http://www.securityfocus.com/bid/91394"
            },
            {
              "name": "https://github.com/ImageMagick/ImageMagick/commits/7.0.2-1",
              "refsource": "CONFIRM",
              "tags": [
                "Patch",
                "Third Party Advisory"
              ],
              "url": "https://github.com/ImageMagick/ImageMagick/commits/7.0.2-1"
            },
            {
              "name": "[oss-security] 20160623 Fwd: out-of-bounds read in MagickCore/property.c:1396 could lead to memory leak/ Integer overflow read to RCE",
              "refsource": "MLIST",
              "tags": [
                "Mailing List",
                "Patch",
                "Third Party Advisory"
              ],
              "url": "http://www.openwall.com/lists/oss-security/2016/06/23/1"
            },
            {
              "name": "[oss-security] 20160625 Re: Fwd: out-of-bounds read in MagickCore/property.c:1396 could lead to memory leak/ Integer overflow read to RCE",
              "refsource": "MLIST",
              "tags": [
                "Exploit",
                "Mailing List",
                "Third Party Advisory"
              ],
              "url": "http://www.openwall.com/lists/oss-security/2016/06/25/3"
            },
            {
              "name": "https://github.com/ImageMagick/ImageMagick/commit/d8ab7f046587f2e9f734b687ba7e6e10147c294b",
              "refsource": "CONFIRM",
              "tags": [
                "Patch",
                "Third Party Advisory"
              ],
              "url": "https://github.com/ImageMagick/ImageMagick/commit/d8ab7f046587f2e9f734b687ba7e6e10147c294b"
            },
            {
              "name": "http://www.oracle.com/technetwork/topics/security/bulletinjul2016-3090568.html",
              "refsource": "CONFIRM",
              "tags": [
                "Third Party Advisory"
              ],
              "url": "http://www.oracle.com/technetwork/topics/security/bulletinjul2016-3090568.html"
            },
            {
              "name": "GLSA-201611-21",
              "refsource": "GENTOO",
              "tags": [
                "Third Party Advisory"
              ],
              "url": "https://security.gentoo.org/glsa/201611-21"
            }
          ]
        }
      },
      "impact": {
        "baseMetricV2": {
          "acInsufInfo": true,
          "cvssV2": {
            "accessComplexity": "LOW",
            "accessVector": "NETWORK",
            "authentication": "NONE",
            "availabilityImpact": "NONE",
            "baseScore": 5.0,
            "confidentialityImpact": "PARTIAL",
            "integrityImpact": "NONE",
            "vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:N",
            "version": "2.0"
          },
          "exploitabilityScore": 10.0,
          "impactScore": 2.9,
          "obtainAllPrivilege": false,
          "obtainOtherPrivilege": false,
          "obtainUserPrivilege": false,
          "severity": "MEDIUM",
          "userInteractionRequired": false
        },
        "baseMetricV3": {
          "cvssV3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
            "version": "3.1"
          },
          "exploitabilityScore": 3.9,
          "impactScore": 3.6
        }
      },
      "lastModifiedDate": "2021-04-28T16:33Z",
      "publishedDate": "2016-12-13T15:59Z"
    }
  }
}

SUSE-SU-2016:1782-1

Vulnerability from csaf_suse - Published: 2016-07-11 10:12 - Updated: 2026-09-20 12:15

Summary

Security update for ImageMagick

Severity

Important

Scope

57 vulnerabilities in this advisory, including CVE-2016-5842.

CVE-2016-5842

7.5 (High)


                
                  CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Recommended: 132 products

Open the full advisory

SUSE-SU-2016:1784-1

Vulnerability from csaf_suse - Published: 2016-07-11 10:11 - Updated: 2026-09-20 12:15

Summary

Security update for ImageMagick

Severity

Important

Scope

68 vulnerabilities in this advisory, including CVE-2016-5842.

CVE-2016-5842

7.5 (High)


                
                  CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Recommended: 59 products

Open the full advisory

UBUNTU-CVE-2016-5842 (CVE-2016-5842)

Vulnerability from osv_ubuntu – Published: 2016-06-27 00:00 – Updated: 2026-04-22 07:38 – Source website

Details

MagickCore/property.c in ImageMagick before 7.0.2-1 allows remote attackers to obtain sensitive memory information via vectors involving the q variable, which triggers an out-of-bounds read.

Severity

7.5 (High)


                    
                      CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

7.5 (High)


                    
                      CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

N/A (UNKNOWN)


                    
                      medium

References

URL

Type

	https://ubuntu.com/security/CVE-2016-5842	REPORT
	http://www.openwall.com/lists/oss-security/2016/06/23/1	REPORT
	https://ubuntu.com/security/notices/USN-3131-1	ADVISORY
	https://www.cve.org/CVERecord?id=CVE-2016-5842	REPORT

JSON

To clipboard

{
  "affected": [
    {
      "ecosystem_specific": {
        "availability": "No subscription required",
        "binaries": [
          {
            "binary_name": "imagemagick",
            "binary_version": "8:6.7.7.10-6ubuntu3.2"
          },
          {
            "binary_name": "imagemagick-common",
            "binary_version": "8:6.7.7.10-6ubuntu3.2"
          },
          {
            "binary_name": "libmagick++5",
            "binary_version": "8:6.7.7.10-6ubuntu3.2"
          },
          {
            "binary_name": "libmagickcore5",
            "binary_version": "8:6.7.7.10-6ubuntu3.2"
          },
          {
            "binary_name": "libmagickcore5-extra",
            "binary_version": "8:6.7.7.10-6ubuntu3.2"
          },
          {
            "binary_name": "libmagickwand5",
            "binary_version": "8:6.7.7.10-6ubuntu3.2"
          },
          {
            "binary_name": "perlmagick",
            "binary_version": "8:6.7.7.10-6ubuntu3.2"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:14.04:LTS",
        "name": "imagemagick",
        "purl": "pkg:deb/ubuntu/imagemagick@8:6.7.7.10-6ubuntu3.2?arch=source\u0026distro=trusty"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "8:6.7.7.10-6ubuntu3.2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "8:6.7.7.10-5ubuntu3",
        "8:6.7.7.10-5ubuntu4",
        "8:6.7.7.10-6ubuntu1",
        "8:6.7.7.10-6ubuntu2",
        "8:6.7.7.10-6ubuntu3",
        "8:6.7.7.10-6ubuntu3.1"
      ]
    },
    {
      "ecosystem_specific": {
        "availability": "No subscription required",
        "binaries": [
          {
            "binary_name": "imagemagick",
            "binary_version": "8:6.8.9.9-7ubuntu5.2"
          },
          {
            "binary_name": "imagemagick-6.q16",
            "binary_version": "8:6.8.9.9-7ubuntu5.2"
          },
          {
            "binary_name": "imagemagick-common",
            "binary_version": "8:6.8.9.9-7ubuntu5.2"
          },
          {
            "binary_name": "libimage-magick-perl",
            "binary_version": "8:6.8.9.9-7ubuntu5.2"
          },
          {
            "binary_name": "libimage-magick-q16-perl",
            "binary_version": "8:6.8.9.9-7ubuntu5.2"
          },
          {
            "binary_name": "libmagick++-6-headers",
            "binary_version": "8:6.8.9.9-7ubuntu5.2"
          },
          {
            "binary_name": "libmagick++-6.q16-5v5",
            "binary_version": "8:6.8.9.9-7ubuntu5.2"
          },
          {
            "binary_name": "libmagickcore-6-arch-config",
            "binary_version": "8:6.8.9.9-7ubuntu5.2"
          },
          {
            "binary_name": "libmagickcore-6-headers",
            "binary_version": "8:6.8.9.9-7ubuntu5.2"
          },
          {
            "binary_name": "libmagickcore-6.q16-2",
            "binary_version": "8:6.8.9.9-7ubuntu5.2"
          },
          {
            "binary_name": "libmagickcore-6.q16-2-extra",
            "binary_version": "8:6.8.9.9-7ubuntu5.2"
          },
          {
            "binary_name": "libmagickwand-6-headers",
            "binary_version": "8:6.8.9.9-7ubuntu5.2"
          },
          {
            "binary_name": "libmagickwand-6.q16-2",
            "binary_version": "8:6.8.9.9-7ubuntu5.2"
          },
          {
            "binary_name": "perlmagick",
            "binary_version": "8:6.8.9.9-7ubuntu5.2"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:16.04:LTS",
        "name": "imagemagick",
        "purl": "pkg:deb/ubuntu/imagemagick@8:6.8.9.9-7ubuntu5.2?arch=source\u0026distro=xenial"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "8:6.8.9.9-7ubuntu5.2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "8:6.8.9.9-5ubuntu2",
        "8:6.8.9.9-6",
        "8:6.8.9.9-6build1",
        "8:6.8.9.9-7",
        "8:6.8.9.9-7ubuntu1",
        "8:6.8.9.9-7ubuntu2",
        "8:6.8.9.9-7ubuntu3",
        "8:6.8.9.9-7ubuntu4",
        "8:6.8.9.9-7ubuntu5",
        "8:6.8.9.9-7ubuntu5.1"
      ]
    }
  ],
  "aliases": [],
  "details": "MagickCore/property.c in ImageMagick before 7.0.2-1 allows remote attackers to obtain sensitive memory information via vectors involving the q variable, which triggers an out-of-bounds read.",
  "id": "UBUNTU-CVE-2016-5842",
  "modified": "2026-04-22T07:38:00Z",
  "published": "2016-06-27T00:00:00Z",
  "references": [
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2016-5842"
    },
    {
      "type": "REPORT",
      "url": "http://www.openwall.com/lists/oss-security/2016/06/23/1"
    },
    {
      "type": "ADVISORY",
      "url": "https://ubuntu.com/security/notices/USN-3131-1"
    },
    {
      "type": "REPORT",
      "url": "https://www.cve.org/CVERecord?id=CVE-2016-5842"
    }
  ],
  "related": [
    "USN-3131-1"
  ],
  "schema_version": "1.7.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
      "type": "CVSS_V3"
    },
    {
      "score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
      "type": "CVSS_V3"
    },
    {
      "score": "medium",
      "type": "Ubuntu"
    }
  ],
  "upstream": [
    "CVE-2016-5842"
  ]
}

WID-SEC-W-2024-0666

Vulnerability from csaf_certbund - Published: 2016-08-25 22:00 - Updated: 2024-03-19 23:00

Summary

ImageMagick: Mehrere Schwachstellen

Severity

Mittel

Scope

8 vulnerabilities in this advisory, including CVE-2016-5842.

CVE-2016-5842

In ImageMagick existieren mehrere Schwachstellen. Ein anonymer, entfernter Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Programmcode mit den Rechten des Dienstes auszuführen oder einen Denial of Service Zustand herbeizuführen. Zur erfolgreichen Ausnutzung dieser Schwachstellen muss der Angreifer den Benutzer dazu bringen eine modifizierte TIFF, WPG, RLE, RAW, PSD, Sun, PICT, VIFF, HDR, Meta, Quantum, PDB, DDS, DCM, EXIF, RGF oder BMP zu öffnen.

Known affected: 4 products

Open the full advisory

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

CVE-2016-5842 (GCVE-0-2016-5842)

CNVD-2016-04385

FKIE_CVE-2016-5842

GHSA-VPCG-R56G-2QV7

GSD-2016-5842

SUSE-SU-2016:1782-1

SUSE-SU-2016:1784-1

UBUNTU-CVE-2016-5842 (CVE-2016-5842)

WID-SEC-W-2024-0666

Tags

Sightings

Nomenclature

Related by attack behaviour