Published: 16/01/2015 Updated: 30/10/2018

CVSS v2 Base Score: 5 | Impact Score: 2.9 | Exploitability Score: 10

VMScore: 445

Vector: AV:N/AC:L/Au:N/C:N/I:N/A:P

Pillow prior to 2.7.0 allows remote malicious users to cause a denial of service via a compressed text chunk in a PNG image that has a large size when it is decompressed.

Vulnerable Product	Search on Vulmon	Subscribe to Product
python pillow
oracle solaris 11.2
fedoraproject fedora 21
opensuse opensuse 13.2

Debian Bug report logs - #776303 pillow: CVE-2014-9601 Package: src:pillow; Maintainer for src:pillow is Matthias Klose <doko@debianorg>; Reported by: Moritz Muehlenhoff <jmm@debianorg> Date: Mon, 26 Jan 2015 13:21:02 UTC Severity: important Tags: fixed-upstream, security, upstream Fixed in version pillow/261-2 ...

USN-3090-1 fixed vulnerabilities in Pillow The patch to fix CVE-2014-9601 caused a regression which resulted in failures when processing certain png images This update temporarily reverts the security fix for CVE-2014-9601 pending further investigation ...

Several security issues were fixed in the Python Imaging Library ...

Pillow could be made to crash if it received specially crafted input or opened a specially crafted file ...

Several security issues were fixed in Pillow ...

Pillow before 270 allows remote attackers to cause a denial of service via a compressed text chunk in a PNG image that has a large size when it is decompressed (CVE-2014-9601) Pillow before 332 allows context-dependent attackers to execute arbitrary code by using the "crafted image file" approach, related to an "Insecure Sign Extension" issue ...

Pillow before 270 allows remote attackers to cause a denial of service via a compressed text chunk in a PNG image that has a large size when it is decompressed ...

CWE-20 https://github.com/python-pillow/Pillow/pull/1060 https://www.djangoproject.com/weblog/2015/jan/02/pillow-security-release/http://pillow.readthedocs.org/releasenotes/2.7.0.html http://lists.fedoraproject.org/pipermail/package-announce/2015-January/148442.html http://lists.opensuse.org/opensuse-updates/2015-04/msg00056.html http://www.oracle.com/technetwork/topics/security/bulletinjul2015-2511963.html http://www.securityfocus.com/bid/77758 https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=776303 https://nvd.nist.gov https://usn.ubuntu.com/3090-2/https://access.redhat.com/security/cve/cve-2014-9601

CVE-2014-9601

Vulnerability Summary

Vulnerability Trend

Vendor Advisories

References

Vulmon Search

About

Products

Connect