FKIE_CVE-2005-4601

Vulnerability from fkie_nvd - Published: 2005-12-31 05:00 - Updated: 2026-06-16 22:19
Severity
Summary
The delegate code in ImageMagick 6.2.4.5-0.3 allows remote attackers to execute arbitrary commands via shell metacharacters in a filename that is processed by the display command.
References
cve@mitre.orgftp://patches.sgi.com/support/free/security/advisories/20060301-01.U.asc
cve@mitre.orghttp://bugs.debian.org/cgi-bin/bugreport.cgi?bug=345238Exploit
cve@mitre.orghttp://rhn.redhat.com/errata/RHSA-2006-0178.html
cve@mitre.orghttp://secunia.com/advisories/18261Vendor Advisory
cve@mitre.orghttp://secunia.com/advisories/18607
cve@mitre.orghttp://secunia.com/advisories/18631
cve@mitre.orghttp://secunia.com/advisories/18871
cve@mitre.orghttp://secunia.com/advisories/19183
cve@mitre.orghttp://secunia.com/advisories/19408
cve@mitre.orghttp://secunia.com/advisories/23090
cve@mitre.orghttp://secunia.com/advisories/28800
cve@mitre.orghttp://slackware.com/security/viewer.php?l=slackware-security&y=2006&m=slackware-security.341682
cve@mitre.orghttp://sunsolve.sun.com/search/document.do?assetkey=1-26-231321-1
cve@mitre.orghttp://www.debian.org/security/2006/dsa-957
cve@mitre.orghttp://www.mandriva.com/security/advisories?name=MDKSA-2006:024
cve@mitre.orghttp://www.novell.com/linux/security/advisories/2006_06_sr.html
cve@mitre.orghttp://www.osvdb.org/22121
cve@mitre.orghttp://www.securityfocus.com/archive/1/452718/100/100/threaded
cve@mitre.orghttp://www.securityfocus.com/bid/16093
cve@mitre.orghttp://www.ubuntu.com/usn/usn-246-1
cve@mitre.orghttp://www.vupen.com/english/advisories/2008/0412
cve@mitre.orghttps://exchange.xforce.ibmcloud.com/vulnerabilities/23927
cve@mitre.orghttps://issues.rpath.com/browse/RPL-389
cve@mitre.orghttps://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10353
af854a3a-2127-422b-91ae-364da2661108ftp://patches.sgi.com/support/free/security/advisories/20060301-01.U.asc
af854a3a-2127-422b-91ae-364da2661108http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=345238Exploit
af854a3a-2127-422b-91ae-364da2661108http://rhn.redhat.com/errata/RHSA-2006-0178.html
af854a3a-2127-422b-91ae-364da2661108http://secunia.com/advisories/18261Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108http://secunia.com/advisories/18607
af854a3a-2127-422b-91ae-364da2661108http://secunia.com/advisories/18631
af854a3a-2127-422b-91ae-364da2661108http://secunia.com/advisories/18871
af854a3a-2127-422b-91ae-364da2661108http://secunia.com/advisories/19183
af854a3a-2127-422b-91ae-364da2661108http://secunia.com/advisories/19408
af854a3a-2127-422b-91ae-364da2661108http://secunia.com/advisories/23090
af854a3a-2127-422b-91ae-364da2661108http://secunia.com/advisories/28800
af854a3a-2127-422b-91ae-364da2661108http://slackware.com/security/viewer.php?l=slackware-security&y=2006&m=slackware-security.341682
af854a3a-2127-422b-91ae-364da2661108http://sunsolve.sun.com/search/document.do?assetkey=1-26-231321-1
af854a3a-2127-422b-91ae-364da2661108http://www.debian.org/security/2006/dsa-957
af854a3a-2127-422b-91ae-364da2661108http://www.mandriva.com/security/advisories?name=MDKSA-2006:024
af854a3a-2127-422b-91ae-364da2661108http://www.novell.com/linux/security/advisories/2006_06_sr.html
af854a3a-2127-422b-91ae-364da2661108http://www.osvdb.org/22121
af854a3a-2127-422b-91ae-364da2661108http://www.securityfocus.com/archive/1/452718/100/100/threaded
af854a3a-2127-422b-91ae-364da2661108http://www.securityfocus.com/bid/16093
af854a3a-2127-422b-91ae-364da2661108http://www.ubuntu.com/usn/usn-246-1
af854a3a-2127-422b-91ae-364da2661108http://www.vupen.com/english/advisories/2008/0412
af854a3a-2127-422b-91ae-364da2661108https://exchange.xforce.ibmcloud.com/vulnerabilities/23927
af854a3a-2127-422b-91ae-364da2661108https://issues.rpath.com/browse/RPL-389
af854a3a-2127-422b-91ae-364da2661108https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10353
Impacted products
Vendor Product Version
imagemagick imagemagick 6.2.4.5
To clipboard 

{
  "affected": [
    {
      "affectedData": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "source": "cve@mitre.org"
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:imagemagick:imagemagick:6.2.4.5:*:*:*:*:*:*:*",
              "matchCriteriaId": "74068962-7689-4155-91D7-506CD30BAFB2",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "The delegate code in ImageMagick 6.2.4.5-0.3 allows remote attackers to execute arbitrary commands via shell metacharacters in a filename that is processed by the display command."
    }
  ],
  "id": "CVE-2005-4601",
  "lastModified": "2026-06-16T22:19:05.287",
  "metrics": {
    "cvssMetricV2": [
      {
        "acInsufInfo": false,
        "baseSeverity": "HIGH",
        "cvssData": {
          "accessComplexity": "LOW",
          "accessVector": "NETWORK",
          "authentication": "NONE",
          "availabilityImpact": "PARTIAL",
          "baseScore": 7.5,
          "confidentialityImpact": "PARTIAL",
          "integrityImpact": "PARTIAL",
          "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
          "version": "2.0"
        },
        "exploitabilityScore": 10.0,
        "impactScore": 6.4,
        "obtainAllPrivilege": false,
        "obtainOtherPrivilege": false,
        "obtainUserPrivilege": true,
        "source": "nvd@nist.gov",
        "type": "Primary",
        "userInteractionRequired": false
      }
    ]
  },
  "published": "2005-12-31T05:00:00.000",
  "references": [
    {
      "source": "cve@mitre.org",
      "url": "ftp://patches.sgi.com/support/free/security/advisories/20060301-01.U.asc"
    },
    {
      "source": "cve@mitre.org",
      "tags": [
        "Exploit"
      ],
      "url": "http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=345238"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://rhn.redhat.com/errata/RHSA-2006-0178.html"
    },
    {
      "source": "cve@mitre.org",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "http://secunia.com/advisories/18261"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://secunia.com/advisories/18607"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://secunia.com/advisories/18631"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://secunia.com/advisories/18871"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://secunia.com/advisories/19183"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://secunia.com/advisories/19408"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://secunia.com/advisories/23090"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://secunia.com/advisories/28800"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://slackware.com/security/viewer.php?l=slackware-security\u0026y=2006\u0026m=slackware-security.341682"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://sunsolve.sun.com/search/document.do?assetkey=1-26-231321-1"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://www.debian.org/security/2006/dsa-957"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://www.mandriva.com/security/advisories?name=MDKSA-2006:024"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://www.novell.com/linux/security/advisories/2006_06_sr.html"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://www.osvdb.org/22121"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://www.securityfocus.com/archive/1/452718/100/100/threaded"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://www.securityfocus.com/bid/16093"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://www.ubuntu.com/usn/usn-246-1"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://www.vupen.com/english/advisories/2008/0412"
    },
    {
      "source": "cve@mitre.org",
      "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/23927"
    },
    {
      "source": "cve@mitre.org",
      "url": "https://issues.rpath.com/browse/RPL-389"
    },
    {
      "source": "cve@mitre.org",
      "url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10353"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "ftp://patches.sgi.com/support/free/security/advisories/20060301-01.U.asc"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Exploit"
      ],
      "url": "http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=345238"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://rhn.redhat.com/errata/RHSA-2006-0178.html"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "http://secunia.com/advisories/18261"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://secunia.com/advisories/18607"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://secunia.com/advisories/18631"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://secunia.com/advisories/18871"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://secunia.com/advisories/19183"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://secunia.com/advisories/19408"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://secunia.com/advisories/23090"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://secunia.com/advisories/28800"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://slackware.com/security/viewer.php?l=slackware-security\u0026y=2006\u0026m=slackware-security.341682"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://sunsolve.sun.com/search/document.do?assetkey=1-26-231321-1"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://www.debian.org/security/2006/dsa-957"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://www.mandriva.com/security/advisories?name=MDKSA-2006:024"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://www.novell.com/linux/security/advisories/2006_06_sr.html"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://www.osvdb.org/22121"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://www.securityfocus.com/archive/1/452718/100/100/threaded"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://www.securityfocus.com/bid/16093"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://www.ubuntu.com/usn/usn-246-1"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://www.vupen.com/english/advisories/2008/0412"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/23927"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "https://issues.rpath.com/browse/RPL-389"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10353"
    }
  ],
  "sourceIdentifier": "cve@mitre.org",
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "NVD-CWE-Other"
        }
      ],
      "source": "nvd@nist.gov",
      "type": "Primary"
    }
  ]
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.