Homepage
About Snyk

Arbitrary Code Execution Affecting pillow package, versions [,3.3.2)

Severity

 Recommended
0.0
high
0
10

CVSS assessment made by Snyk's Security Team

    Threat Intelligence

    EPSS
    0.37% (74th percentile)

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications
  • Snyk ID SNYK-PYTHON-PILLOW-40444
  • published 11 Apr 2016
  • disclosed 11 Apr 2016
  • credit Unknown
Report a new vulnerability Found a mistake?

Introduced: 11 Apr 2016

CVE-2016-9190 Open this link in a new tab
CWE-94 Open this link in a new tab

Overview

pillow is a Python Imaging Library (Fork).

Pillow before 3.3.2 allows context-dependent attackers to execute arbitrary code by using the "crafted image file" approach, related to an "Insecure Sign Extension" issue affecting the ImagingNew in Storage.c component.

References

CVSS Scores

version 3.1
Expand this section

Snyk

Recommended
7.8 high
  • Attack Vector (AV)
    Local
  • Attack Complexity (AC)
    Low
  • Privileges Required (PR)
    None
  • User Interaction (UI)
    Required
  • Scope (S)
    Unchanged
  • Confidentiality (C)
    High
  • Integrity (I)
    High
  • Availability (A)
    High