PT-2015-3727 · Pillow · Pillow

Andrew Drake · Published 2015-05-01 · Updated 2024-06-15 · CVE-2014-3598

Positive Technologies (AI Summary)

CVSS v4.0

8.7

High

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Pillow versions prior to 2.5.3

Description The issue allows remote attackers to cause a denial of service via a crafted image, specifically affecting the Jpeg2KImagePlugin plugin.

Recommendations For versions prior to 2.5.3, update to version 2.5.3 or later to resolve the issue.

Fix

Weakness Enumeration

CWE-399

Related Identifiers

CVE-2014-3598

GHSA-J6F7-G425-4GMX

OPENSUSE-SU-2024:10511-1

OPENSUSE-SU-2024:10567-1

OPENSUSE-SU-2024:11209-1

OPENSUSE-SU-2024:13827-1

PYSEC-2015-15

SUSE-SU-2015:0777-1

SUSE-SU-2015:1102-1

Affected Products

Pillow

References · 51

• https://osv.dev/vulnerability/openSUSE-SU-2024:10567-1 · Vendor Advisory
• https://osv.dev/vulnerability/PYSEC-2015-15 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2014-3598 · Vendor Advisory
• https://pypi.python.org/pypi/Pillow/2.5.3 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-j6f7-g425-4gmx · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2014-3598 · Security Note
• https://osv.dev/vulnerability/CVE-2014-3598 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2015:1102-1 · Vendor Advisory
• http://lists.opensuse.org/opensuse-updates/2015-04/msg00056.html · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2014-3598 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2024:10511-1 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2024:13827-1 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2024:11209-1 · Vendor Advisory
• https://github.com/python-pillow/Pillow · Note
• https://github.com/python-pillow/Pillow/commit/347a1d8d956f9e64af4463ee25311b60cdd5657d · Note