PT-2017-8324 · Pillow · Pillow

Andrej Nemec · Publicado 2016-04-13 · Atualizado 2024-06-15 · CVE-2016-3076

Positive Technologies (AI Summary)

CVSS v4.0

7.1

Alta

Vetor base

AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Pillow versions 2.5.0 through 3.1.1

Description A heap-based buffer overflow issue exists, allowing remote attackers to cause a denial of service (memory corruption) via a crafted Jpeg2000 file. This issue is related to the j2k encode entry function.

Recommendations For Pillow versions 2.5.0 through 3.1.1, update to a version that contains a fix for this issue to prevent potential memory corruption.

Correção

Buffer Overflow

Enumeração de Fraquezas

CWE-119

Identificadores relacionados

CVE-2016-3076

GHSA-V9PC-9MVP-X87G

MGASA-2016-0141

OPENSUSE-SU-2024:10511-1

OPENSUSE-SU-2024:11209-1

OPENSUSE-SU-2024:13827-1

PYSEC-2017-92

SUSE-SU-2018:1174-1

SUSE-SU-2018:1191-1

SUSE-SU-2019:1321-1

Produtos afetados

Pillow

Referências · 53

• https://github.com/python-pillow/Pillow · Nota
• https://github.com/python-pillow/Pillow/blob/4.1.x/docs/releasenotes/3.1.2.rst · Nota
• https://github.com/python-pillow/Pillow/commit/a1f244343df389cf15cdfff80327594821097295 · Nota
• https://github.com/pypa/advisory-database/tree/main/vulns/pillow/PYSEC-2017-92.yaml · Nota
• https://suse.com/security/cve/CVE-2016-3076 · Nota
• https://bugzilla.suse.com/973786 · Nota
• https://osv.dev/vulnerability/GHSA-v9pc-9mvp-x87g · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2016-3076 · Nota de Segurança
• https://suse.com/support/update/announcement/2018/suse-su-20181191-1 · Nota
• http://securityfocus.com/bid/98042 · Nota
• https://security-tracker.debian.org/tracker/CVE-2016-3076 · Aviso do Fabricante
• https://cve.org/CVERecord?id=CVE-2016-3076 · Nota de Segurança
• https://suse.com/security/cve/CVE-2021-23437 · Nota
• https://suse.com/security/cve/CVE-2021-25289 · Nota
• http://pillow.readthedocs.io/en/4.1.x/releasenotes/3.1.2.html · Aviso do Fabricante