PYSEC-2017-92
At a glance
- Published
- Updated
- CVE
- CVE-2016-3076
- Aliases
- GHSA-v9pc-9mvp-x87g
Description
Heap-based buffer overflow in the j2k_encode_entry function in Pillow 2.5.0 through 3.1.1 allows remote attackers to cause a denial of service (memory corruption) via a crafted Jpeg2000 file.
Affected packages
| Package | Versions |
|---|---|
| PyPI · pillow | introduced 2.5.0, fixed 3.1.2 |
References
- https://bugzilla.redhat.com/show_bug.cgi?id=1321929 REPORT
- http://pillow.readthedocs.io/en/4.1.x/releasenotes/3.1.2.html WEB
- http://www.securityfocus.com/bid/98042 WEB
- https://github.com/advisories/GHSA-v9pc-9mvp-x87g ADVISORY
Sources
| Source | Licence |
|---|---|
| OSV.dev | CC-BY 4.0 — PyPA Advisory Database |