PT-2016-7690 · Pillow+1 · Pillow+1

Wiredfool · Publicado 2016-11-04 · Atualizado 2019-05-23 · CVE-2016-9190

Positive Technologies (AI Summary)

CVSS v4.0

8.7

Alta

Vetor base

AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Pillow versions prior to 3.3.2

Description The issue allows context-dependent attackers to execute arbitrary code by using a crafted image file, related to an Insecure Sign Extension issue affecting the ImagingNew in Storage.c component.

Recommendations For versions prior to 3.3.2, update to version 3.3.2 or later to resolve the issue.

Correção

Improper Access Control

Enumeração de Fraquezas

CWE-284

Identificadores relacionados

CVE-2016-9190

DLA-705-1

DSA-3710-1

GHSA-W4VG-RF63-F3J3

MGASA-2016-0383

PYSEC-2016-9

SUSE-SU-2018:1174-1

SUSE-SU-2018:1191-1

SUSE-SU-2019:1321-1

USN-3229-1

USN-3230-1

Produtos afetados

Pillow

Ubuntu

Referências · 39

• https://github.com/python-pillow/Pillow · Nota
• https://github.com/python-pillow/Pillow/issues/2105 · Correção
• https://github.com/python-pillow/Pillow/pull/2146/commits/5d8a0be45aad78c5a22c8d099118ee26ef8144af · Correção
• https://github.com/pypa/advisory-database/tree/main/vulns/pillow/PYSEC-2016-9.yaml · Nota
• https://bugzilla.suse.com/973786 · Nota
• https://suse.com/security/cve/CVE-2016-3076 · Nota
• http://securityfocus.com/bid/94234 · Nota
• https://suse.com/support/update/announcement/2018/suse-su-20181191-1 · Nota
• https://osv.dev/vulnerability/CVE-2016-9190 · Aviso do Fabricante
• http://debian.org/security/2016/dsa-3710 · Aviso do Fabricante
• https://osv.dev/vulnerability/DEBIAN-CVE-2016-9190 · Aviso do Fabricante
• https://security.gentoo.org/glsa/201612-52 · Aviso do Fabricante
• https://github.com/advisories/GHSA-w4vg-rf63-f3j3 · Nota
• http://pillow.readthedocs.io/en/3.4.x/releasenotes/3.3.2.html · Aviso do Fabricante
• https://bugzilla.suse.com/1008846 · Nota