CVE-2014-9601: fedoraproject fedora Improper Input Validation
Vulnerability summary
CVE-2014-9601 is a medium (CVSS 5.0) Improper Input Validation vulnerability in fedoraproject fedora. EPSS estimates a 4.57% chance of exploitation in the next 30 days, higher than 91.6% of scored vulnerabilities.
Severe, CVSS 8.7 (OSV · Pypi); no exploitation reported by the 5 checked sources; EPSS 5% (FIRST, 03-11-2026)
Source freshness unavailable
How is this decided?Advisory lineage
Upstream 0 · Downstream 2 · Related 2Timeline
- 16-01-2015PublishedVulnerability first disclosed.
- 06-08-2024Last modifiedVulnerability information updated.
Description
Pillow before 2.7.0 allows remote attackers to cause a denial of service via a compressed text chunk in a PNG image that has a large size when it is decompressed.
CVSS metrics
3 scores · 2 sources · 3 versionsEPSS trend
Probability
4.57%
Chance of exploitation in the next 30 days
Percentile
92%
Versus all other CVEs
30-day change
No change 0.00 pp
From 4.57% on 04-10-2026
Known exploited
Compare KEV catalogs
CISA KEVNot in the CISA KEV catalog.
ENISA CNWNot in the ENISA CNW catalog.
CIRCLNot in the CIRCL catalog.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Known conditions: network-reachable, no authentication, no user interaction (CVSS vector). Other conditions: not stated in public data.
Debian1 product
- pillow< 2.6.1-2
Fedoraproject1 product
- fedoraEOL21
Mageia1 product
- python-pillow< 2.6.2-1.1.mga4
Opensuse1 product
- opensuseEOL13.2
Oracle1 product
- solarisEOL11.2
PyPI1 product
- pillow< 2.7.0
Python1 product
- pillow≤ 2.6.2
Ubuntu1 product
- pillow< 2.3.0-1ubuntu3.4 | < 2.3.0-1ubuntu3.3
8 vendors · 8 products
References
25 links- lists.opensuse.org/opensuse-updates/2015-04/msg00056.htmlVendor AdvisoryX Refsource SUSEThird Party AdvisoryWEB
- www.djangoproject.com/weblog/2015/jan/02/pillow-security-release/X Refsource CONFIRMThird Party AdvisoryARTICLEREPORT
- lists.fedoraproject.org/pipermail/package-announce/2015-January/148442.htmlVendor AdvisoryX Refsource FEDORAThird Party AdvisoryWEB
- www.oracle.com/technetwork/topics/security/bulletinjul2015-2511963.htmlX Refsource CONFIRMThird Party AdvisoryWEB
