USN-3090-2

Advisory lineage Upstream: 2 Downstream: 0
Published: 30 Sept 2016, 16:44
Last modified:04 Feb 2026, 02:20

Vulnerability Summary

Overall Risk (default)
minimal
0/100
CVSS Score
No data
EPSS Score
No data
KEV
Not listed
Ransomware
No reports
Public exploits
None found
Dark Web
Not detected

Timeline

30 Sept 2016, 16:44
Published
Vulnerability first disclosed
04 Feb 2026, 02:20
Last Modified
Vulnerability information updated

Description

Pillow regression USN-3090-1 fixed vulnerabilities in Pillow. The patch to fix CVE-2014-9601 caused a regression which resulted in failures when processing certain png images. This update temporarily reverts the security fix for CVE-2014-9601 pending further investigation. We apologize for the inconvenience. Original advisory details: It was discovered that a flaw in processing a compressed text chunk in a PNG image could cause the image to have a large size when decompressed, potentially leading to a denial of service. (CVE-2014-9601) Andrew Drake discovered that Pillow incorrectly validated input. A remote attacker could use this to cause Pillow to crash, resulting in a denial of service. (CVE-2014-3589) Eric Soroos discovered that Pillow incorrectly handled certain malformed FLI, Tiff, and PhotoCD files. A remote attacker could use this issue to cause Pillow to crash, resulting in a denial of service. (CVE-2016-0740, CVE-2016-0775, CVE-2016-2533)

Affected Systems

  • ubuntu•pillow

    < 2.3.0-1ubuntu3.3

References (3)