PT-2015-3727 · Pillow · Pillow

Andrew Drake · Publicado 2015-05-01 · Atualizado 2024-06-15 · CVE-2014-3598

Positive Technologies (AI Summary)

CVSS v4.0

8.7

Alta

Vetor base

AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Pillow versions prior to 2.5.3

Description The issue allows remote attackers to cause a denial of service via a crafted image, specifically affecting the Jpeg2KImagePlugin plugin.

Recommendations For versions prior to 2.5.3, update to version 2.5.3 or later to resolve the issue.

Correção

Enumeração de Fraquezas

CWE-399

Identificadores relacionados

CVE-2014-3598

GHSA-J6F7-G425-4GMX

OPENSUSE-SU-2024:10511-1

OPENSUSE-SU-2024:10567-1

OPENSUSE-SU-2024:11209-1

OPENSUSE-SU-2024:13827-1

PYSEC-2015-15

SUSE-SU-2015:0777-1

SUSE-SU-2015:1102-1

Produtos afetados

Pillow

Referências · 51

• https://github.com/python-pillow/Pillow · Nota
• https://github.com/python-pillow/Pillow/commit/347a1d8d956f9e64af4463ee25311b60cdd5657d · Nota
• https://github.com/pypa/advisory-database/tree/main/vulns/pillow/PYSEC-2015-15.yaml · Nota
• https://suse.com/security/cve/CVE-2016-3076 · Nota
• https://osv.dev/vulnerability/openSUSE-SU-2024:10567-1 · Aviso do Fabricante
• https://suse.com/security/cve/CVE-2021-23437 · Nota
• https://suse.com/security/cve/CVE-2021-25289 · Nota
• https://osv.dev/vulnerability/PYSEC-2015-15 · Aviso do Fabricante
• https://bugzilla.suse.com/927862 · Nota
• https://security-tracker.debian.org/tracker/CVE-2014-3598 · Aviso do Fabricante
• https://pypi.python.org/pypi/Pillow/2.5.3 · Aviso do Fabricante
• https://osv.dev/vulnerability/GHSA-j6f7-g425-4gmx · Aviso do Fabricante
• https://bugzilla.suse.com/929914 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2014-3598 · Nota de Segurança
• https://suse.com/security/cve/CVE-2020-35655 · Nota