CVSS 3.0
6.5 mediumCVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:HCVE-2016-2533
Buffer overflow in the ImagingPcdDecode function in PcdDecode.c in Pillow before 3.1.1 and Python Imaging Library (PIL) 1.1.7 and earlier allows remote attackers to cause a denial of service (crash) via a crafted PhotoCD file.
Severity
- EPSS
- 4.0% chance of exploitation in the next 30 days; higher than 90% of CVEs (scores of 2026-10-31)
- CWE
- CWE-119
- Published
- Modified
- Record from
- the NVD, synced
Affected
- debian:debian_linux
- python:pillow
- python_imaging_project:python_imaging
Packages (OSV)
| Advisory | Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|---|
| GHSA-3c5c-7235-994j | PyPI | pillow | <3.1.1 | 3.1.1 |
| PYSEC-2016-19 | PyPI | pillow | <3.1.1 | 3.1.1 |
References
- http://www.debian.org/security/2016/dsa-3499
- http://www.openwall.com/lists/oss-security/2016/02/02/5
- http://www.openwall.com/lists/oss-security/2016/02/22/2
- http://www.oracle.com/technetwork/topics/security/bulletinjan2016-2867206.html
- https://github.com/python-pillow/Pillow/blob/c3cb690fed5d4bf0c45576759de55d054916c165/CHANGES.rst