GHSA-3c5c-7235-994j

Suggest an improvement
Source
https://github.com/advisories/GHSA-3c5c-7235-994j
Import Source
https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2018/07/GHSA-3c5c-7235-994j/GHSA-3c5c-7235-994j.json
JSON Data
https://api.osv.dev/v1/vulns/GHSA-3c5c-7235-994j
Aliases
Published
2018-07-24T20:15:13Z
Modified
2024-10-08T13:23:17.777450Z
Severity
  • 6.5 (Medium) CVSS_V3 - CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H CVSS Calculator
  • 7.1 (High) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N CVSS Calculator
Summary
Pillow buffer overflow in ImagingPcdDecode
Details

Buffer overflow in the ImagingPcdDecode function in PcdDecode.c in Pillow before 3.1.1 and Python Imaging Library (PIL) 1.1.7 and earlier allows remote attackers to cause a denial of service (crash) via a crafted PhotoCD file.

Database specific 
{
    "nvd_published_at": null,
    "github_reviewed": true,
    "github_reviewed_at": "2020-06-16T20:54:46Z",
    "cwe_ids": [
        "CWE-119"
    ],
    "severity": "HIGH"
}
References

Affected packages

PyPI / pillow

Package

Name
pillow
View open source insights on deps.dev
Purl
pkg:pypi/pillow

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
3.1.1

Affected versions

1.*

1.0
1.1
1.2
1.3
1.4
1.5
1.6
1.7.0
1.7.1
1.7.2
1.7.3
1.7.4
1.7.5
1.7.6
1.7.7
1.7.8

2.*

2.0.0
2.1.0
2.2.0
2.2.1
2.2.2
2.3.0
2.3.1
2.3.2
2.4.0
2.5.0
2.5.1
2.5.2
2.5.3
2.6.0
2.6.1
2.6.2
2.7.0
2.8.0
2.8.1
2.8.2
2.9.0

3.*

3.0.0
3.1.0.rc1
3.1.0rc1
3.1.0