cve/2016/CVE-2016-5118.md

CVE-2016-5118

Description

The OpenBlob function in blob.c in GraphicsMagick before 1.3.24 and ImageMagick allows remote attackers to execute arbitrary code via a | (pipe) character at the start of a filename.

POC

Reference

• http://www.oracle.com/technetwork/topics/security/bulletinjul2016-3090568.html
• http://www.oracle.com/technetwork/topics/security/linuxbulletinapr2016-2952096.html

Github

• https://github.com/superfish9/pt