Description
The gnuplot delegate functionality in ImageMagick before 6.9.4-0 and GraphicsMagick allows remote attackers to execute arbitrary commands via unspecified vectors.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | graphicsmagick | 1.3.24-1 | — |
| Debian 14 | imagemagick | 8:6.9.6.2+dfsg-2 | — |
| Debian 13 | graphicsmagick | 1.3.24-1 | — |
| Debian 13 | imagemagick | 8:6.9.6.2+dfsg-2 | — |
| Debian 12 | graphicsmagick | 1.3.24-1 | — |
| Debian 12 | imagemagick | 8:6.9.6.2+dfsg-2 | — |
| Debian 8 | graphicsmagick | 1.3.20-3+deb8u4 | DLA-1456-1 |
| Debian 8 | imagemagick | 8:6.8.9.9-5+deb8u2 | DSA-3580-1 |
| Debian 7 | graphicsmagick | 1.3.16-1.1+deb7u1 | DLA-484-1 |
| Debian 7 | imagemagick | 8:6.7.7.10-5+deb7u5 | DLA-486-1 |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 16.04 LTS | graphicsmagick | 1.3.23-1ubuntu0.1 | — |
| Ubuntu 16.04 LTS | imagemagick | 8:6.8.9.9-7ubuntu5.1 | — |
| Ubuntu 14.04 LTS | graphicsmagick | 1.3.18-1ubuntu3.1 | — |
| Ubuntu 14.04 LTS | imagemagick | 8:6.7.7.10-6ubuntu3.1 | — |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 7 | ImageMagick +5 | 6.7.8.9-15.el7_2 | RHSA-2016:1237 |
| RHEL 6 | ImageMagick +5 | 6.7.2.7-5.el6_8 | RHSA-2016:1237 |
Advisories 5
- RHSA-2016:1237 Red Hat Security Advisory: ImageMagick security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- DLA-484-1 graphicsmagick - security update Debian Security (DSA / DLA) · Mar 9, 2026
- DLA-486-1 imagemagick - security update Debian Security (DSA / DLA) · Mar 9, 2026
- DSA-3580-1 imagemagick - security update Debian Security (DSA / DLA) · Mar 9, 2026
- DLA-1456-1 graphicsmagick - security update Debian Security (DSA / DLA) · Mar 9, 2026
References
- http://git.imagemagick.org/repos/ImageMagick/commit/70a2cf326ed32bedee144b961005c63846541a16
- RHSA-2016:1237 vendor-advisory
- http://www.oracle.com/technetwork/topics/security/linuxbulletinapr2016-2952096.html
- 91018 vdb-entry
- [oss-security] 20160602 Re: ImageMagick CVEs mailing-list
- [debian-lts-announce] 20180803 [SECURITY] [DLA 1456-1] graphicsmagick security update mailing-list