Your submission was sent successfully! Close

You have successfully unsubscribed! Close

Thank you for signing up for our newsletter!
In these regular emails you will find the latest updates about Ubuntu and upcoming events where you can meet our team.Close

CVE-2016-9189

Published: 4 November 2016

Pillow before 3.3.2 allows context-dependent attackers to obtain sensitive information by using the "crafted image file" approach, related to an "Integer Overflow" issue affecting the Image.core.map_buffer in map.c component.

Priority

Medium

CVSS 3 base score: 5.5

Status

Package Release Status
pillow
Launchpad, Ubuntu, Debian
upstream
Released (3.3.2)
precise Does not exist

trusty
Released (2.3.0-1ubuntu3.4)
xenial
Released (3.1.2-0ubuntu1.1)
yakkety
Released (3.3.1-1ubuntu0.1)
Patches:
upstream: https://github.com/python-pillow/Pillow/commit/c50ebe6459a131a1ea8ca531f10da616d3ceaa0f
upstream: https://github.com/python-pillow/Pillow/commit/7d6f4104a114d106cd9502e040a78e793fb72393
upstream: https://github.com/python-pillow/Pillow/commit/a662443b7f3fe394115d2eb9d71fb956b3848063
python-imaging
Launchpad, Ubuntu, Debian
upstream Needs triage

precise
Released (1.1.7-4ubuntu0.12.04.3)
trusty Does not exist

xenial Does not exist

yakkety Does not exist