The (1) HTTP and (2) FTP coders in ImageMagick before 6.9.3-10 and 7.x before 7.0.1-1 allow remote attackers to conduct server-side request forgery (SSRF) attacks via a crafted image.
The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.
| Name | Vendor | Start Version | End Version |
|---|---|---|---|
| Enterprise_linux_desktop | Redhat | 6.0 (including) | 6.0 (including) |
| Enterprise_linux_desktop | Redhat | 7.0 (including) | 7.0 (including) |
| Enterprise_linux_eus | Redhat | 6.7 (including) | 6.7 (including) |
| Enterprise_linux_eus | Redhat | 7.2 (including) | 7.2 (including) |
| Enterprise_linux_eus | Redhat | 7.3 (including) | 7.3 (including) |
| Enterprise_linux_eus | Redhat | 7.4 (including) | 7.4 (including) |
| Enterprise_linux_eus | Redhat | 7.5 (including) | 7.5 (including) |
| Enterprise_linux_eus | Redhat | 7.6 (including) | 7.6 (including) |
| Enterprise_linux_eus | Redhat | 7.7 (including) | 7.7 (including) |
| Enterprise_linux_for_ibm_z_systems | Redhat | 6.0_s390x (including) | 6.0_s390x (including) |
| Enterprise_linux_for_ibm_z_systems | Redhat | 7.0_s390x (including) | 7.0_s390x (including) |
| Enterprise_linux_for_ibm_z_systems_eus | Redhat | 6.7_s390x (including) | 6.7_s390x (including) |
| Enterprise_linux_for_ibm_z_systems_eus | Redhat | 7.2_s390x (including) | 7.2_s390x (including) |
| Enterprise_linux_for_ibm_z_systems_eus | Redhat | 7.3_s390x (including) | 7.3_s390x (including) |
| Enterprise_linux_for_ibm_z_systems_eus | Redhat | 7.4_s390x (including) | 7.4_s390x (including) |
| Enterprise_linux_for_ibm_z_systems_eus | Redhat | 7.5_s390x (including) | 7.5_s390x (including) |
| Enterprise_linux_for_ibm_z_systems_eus | Redhat | 7.6_s390x (including) | 7.6_s390x (including) |
| Enterprise_linux_for_ibm_z_systems_eus | Redhat | 7.7_s390x (including) | 7.7_s390x (including) |
| Enterprise_linux_for_power_big_endian | Redhat | 6.0_ppc64 (including) | 6.0_ppc64 (including) |
| Enterprise_linux_for_power_big_endian | Redhat | 7.0_ppc64 (including) | 7.0_ppc64 (including) |
| Enterprise_linux_for_power_big_endian_eus | Redhat | 6.7_ppc64 (including) | 6.7_ppc64 (including) |
| Enterprise_linux_for_power_big_endian_eus | Redhat | 7.2_ppc64 (including) | 7.2_ppc64 (including) |
| Enterprise_linux_for_power_big_endian_eus | Redhat | 7.3_ppc64 (including) | 7.3_ppc64 (including) |
| Enterprise_linux_for_power_big_endian_eus | Redhat | 7.4_ppc64 (including) | 7.4_ppc64 (including) |
| Enterprise_linux_for_power_big_endian_eus | Redhat | 7.5_ppc64 (including) | 7.5_ppc64 (including) |
| Enterprise_linux_for_power_big_endian_eus | Redhat | 7.6_ppc64 (including) | 7.6_ppc64 (including) |
| Enterprise_linux_for_power_big_endian_eus | Redhat | 7.7_ppc64 (including) | 7.7_ppc64 (including) |
| Enterprise_linux_for_power_little_endian | Redhat | 7.0_ppc64le (including) | 7.0_ppc64le (including) |
| Enterprise_linux_for_power_little_endian_eus | Redhat | 7.2_ppc64le (including) | 7.2_ppc64le (including) |
| Enterprise_linux_for_power_little_endian_eus | Redhat | 7.3_ppc64le (including) | 7.3_ppc64le (including) |
| Enterprise_linux_for_power_little_endian_eus | Redhat | 7.4_ppc64le (including) | 7.4_ppc64le (including) |
| Enterprise_linux_for_power_little_endian_eus | Redhat | 7.5_ppc64le (including) | 7.5_ppc64le (including) |
| Enterprise_linux_for_power_little_endian_eus | Redhat | 7.6_ppc64le (including) | 7.6_ppc64le (including) |
| Enterprise_linux_for_power_little_endian_eus | Redhat | 7.7_ppc64le (including) | 7.7_ppc64le (including) |
| Enterprise_linux_hpc_node | Redhat | 6.0 (including) | 6.0 (including) |
| Enterprise_linux_hpc_node | Redhat | 7.0 (including) | 7.0 (including) |
| Enterprise_linux_hpc_node_eus | Redhat | 7.2 (including) | 7.2 (including) |
| Enterprise_linux_server | Redhat | 6.0 (including) | 6.0 (including) |
| Enterprise_linux_server | Redhat | 7.0 (including) | 7.0 (including) |
| Enterprise_linux_server_aus | Redhat | 7.2 (including) | 7.2 (including) |
| Enterprise_linux_server_aus | Redhat | 7.3 (including) | 7.3 (including) |
| Enterprise_linux_server_aus | Redhat | 7.4 (including) | 7.4 (including) |
| Enterprise_linux_server_aus | Redhat | 7.6 (including) | 7.6 (including) |
| Enterprise_linux_server_aus | Redhat | 7.7 (including) | 7.7 (including) |
| Enterprise_linux_server_from_rhui | Redhat | 6.0 (including) | 6.0 (including) |
| Enterprise_linux_server_from_rhui | Redhat | 7.0 (including) | 7.0 (including) |
| Enterprise_linux_server_supplementary_eus | Redhat | 6.7z (including) | 6.7z (including) |
| Enterprise_linux_server_tus | Redhat | 7.2 (including) | 7.2 (including) |
| Enterprise_linux_server_tus | Redhat | 7.3 (including) | 7.3 (including) |
| Enterprise_linux_server_tus | Redhat | 7.6 (including) | 7.6 (including) |
| Enterprise_linux_server_tus | Redhat | 7.7 (including) | 7.7 (including) |
| Enterprise_linux_workstation | Redhat | 6.0 (including) | 6.0 (including) |
| Enterprise_linux_workstation | Redhat | 7.0 (including) | 7.0 (including) |
| Red Hat Enterprise Linux 6 | RedHat | ImageMagick-0:6.7.2.7-4.el6_7 | * |
| Red Hat Enterprise Linux 7 | RedHat | ImageMagick-0:6.7.8.9-13.el7_2 | * |
| Graphicsmagick | Ubuntu | artful | * |
| Graphicsmagick | Ubuntu | precise | * |
| Graphicsmagick | Ubuntu | trusty | * |
| Graphicsmagick | Ubuntu | wily | * |
| Graphicsmagick | Ubuntu | xenial | * |
| Graphicsmagick | Ubuntu | yakkety | * |
| Graphicsmagick | Ubuntu | zesty | * |
| Imagemagick | Ubuntu | artful | * |
| Imagemagick | Ubuntu | bionic | * |
| Imagemagick | Ubuntu | cosmic | * |
| Imagemagick | Ubuntu | devel | * |
| Imagemagick | Ubuntu | precise | * |
| Imagemagick | Ubuntu | trusty | * |
| Imagemagick | Ubuntu | wily | * |
| Imagemagick | Ubuntu | xenial | * |
| Imagemagick | Ubuntu | yakkety | * |
| Imagemagick | Ubuntu | zesty | * |