Arbitrary code execution - CVE-2016-7906

Vulnerability identifier: #VU835

CSH Severity: Low

CVSS v4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:L/SC:N/SI:N/SA:N]

CVE-ID: CVE-2016-7906

CWE-ID: CWE-416

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote unauthenticated user to cause arbitrary code execution on the target system.
The weakness exists due to use after free caused by a specially crafted image and letting attackers to execute arbitrary code or cause the application crash.
Successful exploitation of the vulnerability results in arbitrary code execution on the vulnerable system.

Arch Linux
Gentoo Linux
imagemagick (Alpine package)

Update to version 6.9.6.0-1.

imagemagick (Alpine package) - update to 6.9.6.8-r0

• https://access.redhat.com/security/cve/CVE-2016-7906

• Arch Linux update for imagemagick
• Arbitrary code execution in imagemagick (Alpine package)
• Gentoo update for ImageMagick