CVE-2014-9601 Pillow denial of service via PNG bomb
MediumCVSS 5.0
EPSS 4.7%
- Published
- Updated
- Exploit status
- No public exploit known
Description
Pillow before 2.7.0 allows remote attackers to cause a denial of service via a compressed text chunk in a PNG image that has a large size when it is decompressed.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| pypi pillow(PyPI) | < 2.7.0 | 2.7.0 |
| pypi pillow(PyPI) | = 1.0 | No fix listed |
| pypi pillow(PyPI) | = 1.1 | No fix listed |
| pypi pillow(PyPI) | = 1.2 | No fix listed |
| pypi pillow(PyPI) | = 1.3 | No fix listed |
| pypi pillow(PyPI) | = 1.4 | No fix listed |
| pypi pillow(PyPI) | = 1.5 | No fix listed |
| pypi pillow(PyPI) | = 1.6 | No fix listed |
| pypi pillow(PyPI) | = 1.7.0 | No fix listed |
| pypi pillow(PyPI) | = 1.7.1 | No fix listed |
| pypi pillow(PyPI) | = 1.7.2 | No fix listed |
| pypi pillow(PyPI) | = 1.7.3 | No fix listed |
| pypi pillow(PyPI) | = 1.7.4 | No fix listed |
| pypi pillow(PyPI) | = 1.7.5 | No fix listed |
| pypi pillow(PyPI) | = 1.7.6 | No fix listed |
| pypi pillow(PyPI) | = 1.7.7 | No fix listed |
| pypi pillow(PyPI) | = 1.7.8 | No fix listed |
| pypi pillow(PyPI) | = 2.0.0 | No fix listed |
| pypi pillow(PyPI) | = 2.1.0 | No fix listed |
| pypi pillow(PyPI) | = 2.2.0 | No fix listed |
| pypi pillow(PyPI) | = 2.2.1 | No fix listed |
| pypi pillow(PyPI) | = 2.2.2 | No fix listed |
| pypi pillow(PyPI) | = 2.3.0 | No fix listed |
| pypi pillow(PyPI) | = 2.3.1 | No fix listed |
| pypi pillow(PyPI) | = 2.3.2 | No fix listed |
Show 15 more
| Product | Affected versions | Fixed in |
|---|---|---|
| pypi pillow(PyPI) | = 2.4.0 | No fix listed |
| pypi pillow(PyPI) | = 2.5.0 | No fix listed |
| pypi pillow(PyPI) | = 2.5.1 | No fix listed |
| pypi pillow(PyPI) | = 2.5.2 | No fix listed |
| pypi pillow(PyPI) | = 2.5.3 | No fix listed |
| pypi pillow(PyPI) | = 2.6.0 | No fix listed |
| pypi pillow(PyPI) | = 2.6.1 | No fix listed |
| pypi pillow(PyPI) | = 2.6.2 | No fix listed |
| debian/pillow(Debian:12) | < 2.6.1-2 | 2.6.1-2 |
| debian/pillow(Debian:13) | < 2.6.1-2 | 2.6.1-2 |
| debian/pillow(Debian:14) | < 2.6.1-2 | 2.6.1-2 |
| python pillow | <= 2.6.2 | No fix listed |
| oracle solaris | = 11.2 | No fix listed |
| fedoraproject fedora | = 21 | No fix listed |
| opensuse | = 13.2 | No fix listed |
References
- nvd.nist.gov third-party-advisory vendor-advisory
- github.com patch vendor-advisory
- github.com
- github.com product
- web.archive.org
- www.djangoproject.com technical-description third-party-advisory
- FEDORA-2015-0667 third-party-advisory vendor-advisory
- openSUSE-SU-2015:0798 third-party-advisory vendor-advisory
- pillow.readthedocs.org vendor-advisory
- www.oracle.com third-party-advisory
- 77758 vdb-entry
- github.com vendor-advisory
- Debian Security Tracker CVE-2014-9601 vendor-advisory
- bugs.debian.org issue-tracking