PT-2017-8324 · Pillow · Pillow

Andrej Nemec · Published 2016-04-13 · Updated 2024-06-15 · CVE-2016-3076

Positive Technologies (AI Summary)

CVSS v4.0

7.1

High

Base vector

AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Pillow versions 2.5.0 through 3.1.1

Description A heap-based buffer overflow issue exists, allowing remote attackers to cause a denial of service (memory corruption) via a crafted Jpeg2000 file. This issue is related to the j2k encode entry function.

Recommendations For Pillow versions 2.5.0 through 3.1.1, update to a version that contains a fix for this issue to prevent potential memory corruption.

Fix

Buffer Overflow

Weakness Enumeration

CWE-119

Related Identifiers

CVE-2016-3076

GHSA-V9PC-9MVP-X87G

MGASA-2016-0141

OPENSUSE-SU-2024:10511-1

OPENSUSE-SU-2024:11209-1

OPENSUSE-SU-2024:13827-1

PYSEC-2017-92

SUSE-SU-2018:1174-1

SUSE-SU-2018:1191-1

SUSE-SU-2019:1321-1

Affected Products

Pillow

References · 53

• https://osv.dev/vulnerability/GHSA-v9pc-9mvp-x87g · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2016-3076 · Security Note
• https://security-tracker.debian.org/tracker/CVE-2016-3076 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2016-3076 · Security Note
• http://pillow.readthedocs.io/en/4.1.x/releasenotes/3.1.2.html · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2016-3076 · Vendor Advisory
• https://lists.fedoraproject.org/pipermail/package-announce/2016-April/181943.html · Vendor Advisory
• https://osv.dev/vulnerability/MGASA-2016-0141 · Vendor Advisory
• https://ubuntu.com/security/CVE-2016-3076 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2016-3076 · Vendor Advisory
• https://osv.dev/vulnerability/PYSEC-2017-92 · Vendor Advisory
• https://advisories.mageia.org/MGASA-2016-0141.html · Security Note
• https://osv.dev/vulnerability/SUSE-SU-2018:1174-1 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2019:1321-1 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2018:1191-1 · Vendor Advisory