Fluid Attacks Database

Description

Pillow denial of service via PNG bomb Pillow before 2.7.0 allows remote attackers to cause a denial of service via a compressed text chunk in a PNG image that has a large size when it is decompressed.

Mitigation

Update Impact

Minimal update. May introduce new vulnerabilities or breaking changes.

Ecosystem	Component	Affected version	Patched versions
pypi	pillow	>=0 <2.7.0	2.7.0
debian 14	pillow	>=0 <2.6.1-2	2.6.1-2
debian 13	pillow	>=0 <2.6.1-2	2.6.1-2
debian 12	pillow	>=0 <2.6.1-2	2.6.1-2
debian 11	pillow	>=0 <2.6.1-2	2.6.1-2
rpm rhel5	python-imaging	-	-
rpm rhel6	python-imaging	-	-
rpm rhel7	python-pillow	-	-

Aliases

1. CVE-2014-96012. NVD-2014-96013. OSV-2014-96014. OSV-DEBIAN-2014-96015. GCVE-2014-96016. SECURITY-TRACKER-CVE-2014-9601

References

1. https://github.com/python-pillow/Pillow/pull/10602. https://github.com/pypa/advisory-database/tree/main/vulns/pillow/PYSEC-2015-16.yaml3. https://web.archive.org/web/20200227221255/http://www.securityfocus.com/bid/777584. https://www.djangoproject.com/weblog/2015/jan/02/pillow-security-release5. http://lists.fedoraproject.org/pipermail/package-announce/2015-January/148442.html6. http://lists.opensuse.org/opensuse-updates/2015-04/msg00056.html7. http://pillow.readthedocs.org/releasenotes/2.7.0.html8. http://www.oracle.com/technetwork/topics/security/bulletinjul2015-2511963.html

Does your application use this vulnerable software?

During the free trial, our tools assess your application, identify vulnerabilities, and provide recommendations for their remediation.