CVE-2016-3715

MediumCVSS 5.5/10Known exploited (CISA KEV)Last modified Jun 17, 2026

Description

The EPHEMERAL coder in ImageMagick before 6.9.3-10 and 7.x before 7.0.1-1 allows remote attackers to delete arbitrary files via a crafted image.

Metrics

CVSS 3.1 5.5/10CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N

Weakness enumeration

CWE-552

Affected software

No affected versions have been published.

Timeline

Published
May 5, 2016
Last modified
Jun 17, 2026
Added to CISA KEV
Nov 3, 2021
NVD status
Analyzed

Related CVEs from 2016

CVE-2016-37163.3The MSL coder in ImageMagick before 6.9.3-10 and 7.x before 7.0.1-1 allows remote attackers to move arbitrary files via a crafted image.CVE-2016-37175.5The LABEL coder in ImageMagick before 6.9.3-10 and 7.x before 7.0.1-1 allows remote attackers to read arbitrary files via a crafted image.CVE-2016-37185.5The (1) HTTP and (2) FTP coders in ImageMagick before 6.9.3-10 and 7.x before 7.0.1-1 allow remote attackers to conduct server-side request CVE-2016-37209.8XML external entity (XXE) vulnerability in XmlMapper in the Data format extension for Jackson (aka jackson-dataformat-xml) allows attackers CVE-2016-37214.3Jenkins before 2.3 and LTS before 1.651.2 might allow remote authenticated users to inject arbitrary build parameters into the build environCVE-2016-37224.3Jenkins before 2.3 and LTS before 1.651.2 allow remote authenticated users with multiple accounts to cause a denial of service (unable to loCVE-2016-37234.3Jenkins before 2.3 and LTS before 1.651.2 allow remote authenticated users with read access to obtain sensitive plugin installation informatCVE-2016-37246.5Jenkins before 2.3 and LTS before 1.651.2 allow remote authenticated users with extended read access to obtain sensitive password informatioCVE-2016-37254.3Jenkins before 2.3 and LTS before 1.651.2 allows remote authenticated users to trigger updating of update site metadata by leveraging a missCVE-2016-37267.4Multiple open redirect vulnerabilities in Jenkins before 2.3 and LTS before 1.651.2 allow remote attackers to redirect users to arbitrary weCVE-2016-37274.3The API URL computer/(master)/api/xml in Jenkins before 2.3 and LTS before 1.651.2 allows remote authenticated users with extended read permCVE-2016-37288.8Eval injection vulnerability in tftp_api.rb in the TFTP module in the Smart-Proxy in Foreman before 1.10.4 and 1.11.x before 1.11.2 allows r
CVE-2016-3715: Medium severity, CVSS 5.5 | Vulnix