CVE-2014-9601

Pillow before 2.7.0 allows remote attackers to cause a denial of service via a compressed text chunk in a PNG image that has a large size when it is decompressed.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
5 UNKNOWN
NETWORK
LOW
AV:N/AC:L/Au:N/C:N/I:N/A:P
Base Score
CVSS 3.x
EPSS Score
Percentile: 91%
Affected Products (NVD)
VendorProductVersion
pythonpillow
𝑥
≤ 2.6.2
oraclesolaris
11.2
opensuseopensuse
13.2
𝑥
= Vulnerable software versions
Debian logo
Debian Releases
Debian Product
Codename
pillow
bookworm
9.4.0-1.1+deb12u1
fixed
bookworm (security)
9.4.0-1.1+deb12u1
fixed
bullseye
8.1.2+dfsg-0.3+deb11u2
fixed
bullseye (security)
8.1.2+dfsg-0.3+deb11u2
fixed
sid
10.4.0-1
fixed
squeeze
no-dsa
trixie
10.4.0-1
fixed
wheezy
no-dsa
Ubuntu logo
Ubuntu Releases
Ubuntu Product
Codename
pillow
lucid
dne
precise
dne
trusty
Fixed 2.3.0-1ubuntu3.4
released
utopic
ignored
vivid
not-affected
wily
not-affected
xenial
not-affected
yakkety
not-affected
python-imaging
precise
Fixed 1.1.7-4ubuntu0.12.04.3
released
trusty
dne
xenial
dne
yakkety
dne
Amazon Linux logo
Amazon Linux Releases
Amazon Package
Release
python-pillow
Amazon Linux 2
0:2.0.0-23.gitd1c6db8.amzn2.0.4
fixed
python-pillow-debuginfo
Amazon Linux 2
0:2.0.0-23.gitd1c6db8.amzn2.0.4
fixed
python-pillow-devel
Amazon Linux 2
0:2.0.0-23.gitd1c6db8.amzn2.0.4
fixed
python-pillow-doc
Amazon Linux 2
0:2.0.0-23.gitd1c6db8.amzn2.0.4
fixed
python-pillow-sane
Amazon Linux 2
0:2.0.0-23.gitd1c6db8.amzn2.0.4
fixed
python-pillow-tk
Amazon Linux 2
0:2.0.0-23.gitd1c6db8.amzn2.0.4
fixed
Common Weakness Enumeration
References
http://lists.fedoraproject.org/pipermail/package-announce/2015-January/148442.html
http://lists.opensuse.org/opensuse-updates/2015-04/msg00056.html
http://pillow.readthedocs.org/releasenotes/2.7.0.html
http://www.oracle.com/technetwork/topics/security/bulletinjul2015-2511963.html
http://www.securityfocus.com/bid/77758
https://github.com/python-pillow/Pillow/pull/1060
https://www.djangoproject.com/weblog/2015/jan/02/pillow-security-release/
http://lists.fedoraproject.org/pipermail/package-announce/2015-January/148442.html
http://lists.opensuse.org/opensuse-updates/2015-04/msg00056.html
http://pillow.readthedocs.org/releasenotes/2.7.0.html
http://www.oracle.com/technetwork/topics/security/bulletinjul2015-2511963.html
http://www.securityfocus.com/bid/77758
https://github.com/python-pillow/Pillow/pull/1060
https://www.djangoproject.com/weblog/2015/jan/02/pillow-security-release/