USN-3090-1

Advisory lineage Upstream: 10 Downstream: 0
Published: 27 Sept 2016, 19:55
Last modified:04 Feb 2026, 02:37

Vulnerability Summary

Overall Risk (default)
minimal
0/100
CVSS Score
No data
EPSS Score
No data
KEV
Not listed
Ransomware
No reports
Public exploits
None found
Dark Web
Not detected

Timeline

27 Sept 2016, 19:55
Published
Vulnerability first disclosed
04 Feb 2026, 02:37
Last Modified
Vulnerability information updated

Description

Pillow vulnerabilities It was discovered that a flaw in processing a compressed text chunk in a PNG image could cause the image to have a large size when decompressed, potentially leading to a denial of service. (CVE-2014-9601) Andrew Drake discovered that Pillow incorrectly validated input. A remote attacker could use this to cause Pillow to crash, resulting in a denial of service. (CVE-2014-3589) Eric Soroos discovered that Pillow incorrectly handled certain malformed FLI, Tiff, and PhotoCD files. A remote attacker could use this issue to cause Pillow to crash, resulting in a denial of service. (CVE-2016-0740, CVE-2016-0775, CVE-2016-2533)

Affected Systems

  • ubuntu•pillow

    < 2.3.0-1ubuntu3.2

References (6)