ImageMagick before 6.9.11-40 and 7.x before 7.0.10-40 mishandles the -authenticate option, which allows setting a password for password-protected PDF files. The user-controlled password was not properly escaped/sanitized and it was therefore possible to inject additional shell commands via coders/pdf.c.
{ "availability": "No subscription required", "ubuntu_priority": "negligible", "binaries": [ { "imagemagick-common": "8:6.9.10.23+dfsg-2.1ubuntu11.9", "libimage-magick-q16-perl": "8:6.9.10.23+dfsg-2.1ubuntu11.9", "libmagickcore-6.q16hdri-6-extra-dbgsym": "8:6.9.10.23+dfsg-2.1ubuntu11.9", "libimage-magick-q16hdri-perl": "8:6.9.10.23+dfsg-2.1ubuntu11.9", "libmagick++-6.q16-8-dbgsym": "8:6.9.10.23+dfsg-2.1ubuntu11.9", "libmagick++-dev": "8:6.9.10.23+dfsg-2.1ubuntu11.9", "imagemagick-6-common": "8:6.9.10.23+dfsg-2.1ubuntu11.9", "imagemagick-6.q16hdri-dbgsym": "8:6.9.10.23+dfsg-2.1ubuntu11.9", "libimage-magick-perl": "8:6.9.10.23+dfsg-2.1ubuntu11.9", "libmagickwand-6.q16hdri-6": "8:6.9.10.23+dfsg-2.1ubuntu11.9", "libmagick++-6.q16hdri-dev": "8:6.9.10.23+dfsg-2.1ubuntu11.9", "imagemagick-6.q16-dbgsym": "8:6.9.10.23+dfsg-2.1ubuntu11.9", "libmagickwand-6.q16-6-dbgsym": "8:6.9.10.23+dfsg-2.1ubuntu11.9", "libmagickcore-6.q16-6-extra-dbgsym": "8:6.9.10.23+dfsg-2.1ubuntu11.9", "libmagickcore-6.q16-dev": "8:6.9.10.23+dfsg-2.1ubuntu11.9", "libmagickwand-dev": "8:6.9.10.23+dfsg-2.1ubuntu11.9", "imagemagick-6-doc": "8:6.9.10.23+dfsg-2.1ubuntu11.9", "libmagickwand-6.q16-dev": "8:6.9.10.23+dfsg-2.1ubuntu11.9", "perlmagick": "8:6.9.10.23+dfsg-2.1ubuntu11.9", "libmagick++-6.q16hdri-8-dbgsym": "8:6.9.10.23+dfsg-2.1ubuntu11.9", "libimage-magick-q16-perl-dbgsym": "8:6.9.10.23+dfsg-2.1ubuntu11.9", "libmagickcore-6.q16hdri-dev": "8:6.9.10.23+dfsg-2.1ubuntu11.9", "libmagickwand-6-headers": "8:6.9.10.23+dfsg-2.1ubuntu11.9", "libmagickcore-6.q16-6": "8:6.9.10.23+dfsg-2.1ubuntu11.9", "libmagick++-6-headers": "8:6.9.10.23+dfsg-2.1ubuntu11.9", "libmagickcore-6-headers": "8:6.9.10.23+dfsg-2.1ubuntu11.9", "libmagickwand-6.q16hdri-dev": "8:6.9.10.23+dfsg-2.1ubuntu11.9", "libmagickwand-6.q16hdri-6-dbgsym": "8:6.9.10.23+dfsg-2.1ubuntu11.9", "libmagickcore-6.q16hdri-6-extra": "8:6.9.10.23+dfsg-2.1ubuntu11.9", "libmagickcore-6.q16hdri-6": "8:6.9.10.23+dfsg-2.1ubuntu11.9", "imagemagick-doc": "8:6.9.10.23+dfsg-2.1ubuntu11.9", "libmagickcore-6.q16-6-extra": "8:6.9.10.23+dfsg-2.1ubuntu11.9", "libmagick++-6.q16-8": "8:6.9.10.23+dfsg-2.1ubuntu11.9", "imagemagick": "8:6.9.10.23+dfsg-2.1ubuntu11.9", "libmagick++-6.q16hdri-8": "8:6.9.10.23+dfsg-2.1ubuntu11.9", "libmagickcore-6-arch-config": "8:6.9.10.23+dfsg-2.1ubuntu11.9", "imagemagick-6.q16": "8:6.9.10.23+dfsg-2.1ubuntu11.9", "libmagick++-6.q16-dev": "8:6.9.10.23+dfsg-2.1ubuntu11.9", "libmagickwand-6.q16-6": "8:6.9.10.23+dfsg-2.1ubuntu11.9", "imagemagick-6.q16hdri": "8:6.9.10.23+dfsg-2.1ubuntu11.9", "libmagickcore-6.q16hdri-6-dbgsym": "8:6.9.10.23+dfsg-2.1ubuntu11.9", "libmagickcore-6.q16-6-dbgsym": "8:6.9.10.23+dfsg-2.1ubuntu11.9", "libimage-magick-q16hdri-perl-dbgsym": "8:6.9.10.23+dfsg-2.1ubuntu11.9", "libmagickcore-dev": "8:6.9.10.23+dfsg-2.1ubuntu11.9" } ] }
{ "availability": "No subscription required", "ubuntu_priority": "negligible", "binaries": [ { "imagemagick-common": "8:6.9.11.60+dfsg-1ubuntu1", "libimage-magick-q16-perl": "8:6.9.11.60+dfsg-1ubuntu1", "libmagickcore-6.q16hdri-6-extra-dbgsym": "8:6.9.11.60+dfsg-1ubuntu1", "libimage-magick-q16hdri-perl": "8:6.9.11.60+dfsg-1ubuntu1", "libmagick++-6.q16-8-dbgsym": "8:6.9.11.60+dfsg-1ubuntu1", "libmagick++-dev": "8:6.9.11.60+dfsg-1ubuntu1", "imagemagick-6-common": "8:6.9.11.60+dfsg-1ubuntu1", "imagemagick-6.q16hdri-dbgsym": "8:6.9.11.60+dfsg-1ubuntu1", "libimage-magick-perl": "8:6.9.11.60+dfsg-1ubuntu1", "libmagickwand-6.q16hdri-6": "8:6.9.11.60+dfsg-1ubuntu1", "libmagick++-6.q16hdri-dev": "8:6.9.11.60+dfsg-1ubuntu1", "imagemagick-6.q16-dbgsym": "8:6.9.11.60+dfsg-1ubuntu1", "libmagickwand-6.q16-6-dbgsym": "8:6.9.11.60+dfsg-1ubuntu1", "libmagickcore-6.q16-6-extra-dbgsym": "8:6.9.11.60+dfsg-1ubuntu1", "libmagickcore-6.q16-dev": "8:6.9.11.60+dfsg-1ubuntu1", "libmagickwand-dev": "8:6.9.11.60+dfsg-1ubuntu1", "imagemagick-6-doc": "8:6.9.11.60+dfsg-1ubuntu1", "libmagickwand-6.q16-dev": "8:6.9.11.60+dfsg-1ubuntu1", "perlmagick": "8:6.9.11.60+dfsg-1ubuntu1", "libmagick++-6.q16hdri-8-dbgsym": "8:6.9.11.60+dfsg-1ubuntu1", "libimage-magick-q16-perl-dbgsym": "8:6.9.11.60+dfsg-1ubuntu1", "libmagickcore-6.q16hdri-dev": "8:6.9.11.60+dfsg-1ubuntu1", "libmagickwand-6-headers": "8:6.9.11.60+dfsg-1ubuntu1", "libmagickcore-6.q16-6": "8:6.9.11.60+dfsg-1ubuntu1", "libmagick++-6-headers": "8:6.9.11.60+dfsg-1ubuntu1", "libmagickcore-6-headers": "8:6.9.11.60+dfsg-1ubuntu1", "libmagickwand-6.q16hdri-dev": "8:6.9.11.60+dfsg-1ubuntu1", "libmagickwand-6.q16hdri-6-dbgsym": "8:6.9.11.60+dfsg-1ubuntu1", "libmagickcore-6.q16hdri-6-extra": "8:6.9.11.60+dfsg-1ubuntu1", "libmagickcore-6.q16hdri-6": "8:6.9.11.60+dfsg-1ubuntu1", "imagemagick-doc": "8:6.9.11.60+dfsg-1ubuntu1", "libmagickcore-6.q16-6-extra": "8:6.9.11.60+dfsg-1ubuntu1", "libmagick++-6.q16-8": "8:6.9.11.60+dfsg-1ubuntu1", "imagemagick": "8:6.9.11.60+dfsg-1ubuntu1", "libmagick++-6.q16hdri-8": "8:6.9.11.60+dfsg-1ubuntu1", "libmagickcore-6-arch-config": "8:6.9.11.60+dfsg-1ubuntu1", "imagemagick-6.q16": "8:6.9.11.60+dfsg-1ubuntu1", "libmagick++-6.q16-dev": "8:6.9.11.60+dfsg-1ubuntu1", "libmagickwand-6.q16-6": "8:6.9.11.60+dfsg-1ubuntu1", "imagemagick-6.q16hdri": "8:6.9.11.60+dfsg-1ubuntu1", "libmagickcore-6.q16hdri-6-dbgsym": "8:6.9.11.60+dfsg-1ubuntu1", "libmagickcore-6.q16-6-dbgsym": "8:6.9.11.60+dfsg-1ubuntu1", "libimage-magick-q16hdri-perl-dbgsym": "8:6.9.11.60+dfsg-1ubuntu1", "libmagickcore-dev": "8:6.9.11.60+dfsg-1ubuntu1" } ] }