PT-2016-7689 · Pillow+1 · Pillow+1

Wiredfool · Publicado 2016-11-04 · Atualizado 2019-07-08 · CVE-2016-9189

Positive Technologies (AI Summary)

CVSS v4.0

6.9

Média

Vetor base

AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Pillow versions prior to 3.3.2

Description The issue allows context-dependent attackers to obtain sensitive information by using the "crafted image file" approach, related to an "Integer Overflow" issue affecting the Image.core.map buffer in map.c component.

Recommendations For Pillow versions prior to 3.3.2, update to version 3.3.2 or later to resolve the issue. As a temporary workaround, consider restricting the use of crafted image files to minimize the risk of exploitation.

Correção

Integer Overflow

Enumeração de Fraquezas

CWE-190

Identificadores relacionados

CVE-2016-9189

DLA-705-1

DSA-3710-1

GHSA-RWR3-C2Q8-GM56

MGASA-2016-0383

PYSEC-2016-8

SUSE-SU-2019:1321-1

SUSE-SU-2019:1772-1

USN-3229-1

USN-3230-1

Produtos afetados

Pillow

Ubuntu

Referências · 37

• https://github.com/python-pillow/Pillow · Nota
• https://github.com/python-pillow/Pillow/issues/2105 · Correção
• https://github.com/python-pillow/Pillow/pull/2146/commits/c50ebe6459a131a1ea8ca531f10da616d3ceaa0f · Correção
• https://github.com/pypa/advisory-database/tree/main/vulns/pillow/PYSEC-2016-8.yaml · Nota
• https://bugzilla.suse.com/973786 · Nota
• https://suse.com/security/cve/CVE-2016-3076 · Nota
• https://security-tracker.debian.org/tracker/CVE-2016-9189 · Aviso do Fabricante
• https://osv.dev/vulnerability/PYSEC-2016-8 · Aviso do Fabricante
• http://securityfocus.com/bid/94234 · Nota
• https://suse.com/support/update/announcement/2019/suse-su-20191772-1 · Nota
• http://debian.org/security/2016/dsa-3710 · Aviso do Fabricante
• https://osv.dev/vulnerability/SUSE-SU-2019:1772-1 · Aviso do Fabricante
• https://security.gentoo.org/glsa/201612-52 · Aviso do Fabricante
• https://osv.dev/vulnerability/DEBIAN-CVE-2016-9189 · Aviso do Fabricante
• http://pillow.readthedocs.io/en/3.4.x/releasenotes/3.3.2.html · Aviso do Fabricante