attack vector is network; attack complexity is high; privileges required is none; user interaction is none; scope is unchanged; confidentiality impact is high; integrity impact is high; availability impact is high.
Affected products
Red Hat Enterprise Linux 7 Extended Lifecycle Support and imagemagick imagemagick
Classified as
CWE-116 (Improper Encoding or Escaping of Output)
Affected Products, Subsystems & Sectors
Vendor
Product
Affected Versions
Patch Status
Red Hat
Red Hat Enterprise Linux 7 Extended Lifecycle Support
imagemagick
imagemagick
Subsystems
OT Supporting Infrastructure
Sectors
Multiple
What to Know
ImageMagick before 7.1.2-15 and 6.9.13-40 contains a command injection vulnerability in the SVG decoder that allows attackers to inject arbitrary MVG drawing commands. Attackers can craft malicious SVG files with injected Magick Vector Graphics commands that execute during rendering. (NVD)
What to Do
Monitor Red Hat's and imagemagick's web pages for any future patch releases.