CVE-2014-3589: debian python-imaging Improper Input Validation
Vulnerability summary
CVE-2014-3589 is a medium (CVSS 5.0) Improper Input Validation vulnerability in debian python-imaging. EPSS estimates a 3.36% chance of exploitation in the next 30 days, higher than 88.7% of scored vulnerabilities.
Severe, CVSS 8.7 (OSV · Pypi); no exploitation reported by the 5 checked sources; EPSS 3% (FIRST, 03-11-2026)
Source freshness unavailable
How is this decided?Advisory lineage
Upstream 0 · Downstream 7 · Related 7Timeline
- 25-08-2014PublishedVulnerability first disclosed.
- 06-08-2024Last modifiedVulnerability information updated.
Description
PIL/IcnsImagePlugin.py in Python Imaging Library (PIL) and Pillow before 2.3.2 and 2.5.x before 2.5.2 allows remote attackers to cause a denial of service via a crafted block size.
CVSS metrics
3 scores · 2 sources · 3 versionsEPSS trend
Probability
3.36%
Chance of exploitation in the next 30 days
Percentile
89%
Versus all other CVEs
30-day change
No change 0.00 pp
From 3.36% on 04-10-2026
Known exploited
Compare KEV catalogs
CISA KEVNot in the CISA KEV catalog.
ENISA CNWNot in the ENISA CNW catalog.
CIRCLNot in the CIRCL catalog.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Known conditions: network-reachable, no authentication, no user interaction (CVSS vector). Other conditions: not stated in public data.
Debian3 products
- pillow< 2.5.3-1
- python-imaging< 1.1.7-2+deb6u1 | < 1.1.7-4+deb7u1
- python-imagingna
Mageia2 products
- python-imaging< 1.1.7-7.2.mga3
- python-pillow< 2.2.1-0.5.mga4
Opensuse1 product
- opensuseEOL13.2
PyPI1 product
- pillow< 2.3.2 | < 205e056f8f9b06ed7b925cf8aa0874bc4aaf8a7d | ≥ 2.5, < 2.5.2
Python1 product
- pillow≤ 2.3.1 | 2.3.0 | 2.5.0 | 2.5.1 | 2.5.2
Ubuntu1 product
- pillow< 2.3.0-1ubuntu3.2
6 vendors · 9 products
References
19 links- github.com/python-pillow/Pillow/commit/205e056f8f9b06ed7b925cf8aa0874bc4aaf8a7dX Refsource CONFIRMPatchWEBFIX
