GitHub Advisoryadvisory · PyPI

GHSA-hvr8-466p-75rh Pillow Integer overflow in ImagingResampleHorizontal

CRITICAL Published 2018-07-24 Modified 2024-10-08 Official page ↗
Aliases
CVE-2016-4009
Ecosystem
PyPI
Packages
pillow
Severity
Critical
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weaknesses
CWE-119
Reviewed
2020-06-16

Affected packages

• PyPI pillow: < 3.1.1 → fixed in 3.1.1

Description

Integer overflow in the `ImagingResampleHorizontal` function in `libImaging/Resample.c` in Pillow before 3.1.1 allows remote attackers to have unspecified impact via negative values of the new size, which triggers a heap-based buffer overflow.

Related

Alias · CVE (1)

  • CVE-2016-4009 Integer overflow in the ImagingResampleHorizontal function in libImaging/Resample.c in Pillow before 3.1.1 allows remote attackers to have… vulnerability

Weakness · CWE (1)

  • CWE-119 Improper Restriction of Operations within the Bounds of a Memory Buffer weakness

References