CVE-2016-9190

Pillow before 3.3.2 allows context-dependent attackers to execute arbitrary code by using the "crafted image file" approach, related to an "Insecure Sign Extension" issue affecting the ImagingNew in Storage.c component.

Score

CVSS 3.0 7.8 High

Status

Modified - cve@mitre.org

Published

2016-11-04

Last modified

2024-08-06

Weaknesses

CWE-284

Affected products

• Debian Linux (Debian)
• Pillow (Python)

References

• http://pillow.readthedocs.io/en/3.4.x/releasenotes/3.3.2.html
• http://www.debian.org/security/2016/dsa-3710
• http://www.securityfocus.com/bid/94234
• https://github.com/python-pillow/Pillow/issues/2105
• https://github.com/python-pillow/Pillow/pull/2146/commits/5d8a0be45aad78c5a22c8d099118ee26ef8144af
• https://security.gentoo.org/glsa/201612-52