Pillow Integer overflow in Map.c

MEDIUM 5.5CVE-2016-9189 · GHSA-rwr3-c2q8-gm56 · PYSEC-2016-8 · Published 04/11/2016 · updated 17/06/2026

Package	Affected versions	Patched versions
pillow PyPI	`< 3.3.2`	`3.3.2`
pillow python	`≤ 3.3.1`	No fix yet

Description

Pillow before 3.3.2 allows context-dependent attackers to obtain sensitive information by using the "crafted image file" approach, related to an "Integer Overflow" issue affecting the Image.core.map_buffer in map.c component.

NVD description

References

nvd.nist.gov/vuln/detail/CVE-2016-9189 · ADVISORY
python-pillow/Pillow · WEB
python-pillow/Pillow#2146 · WEB
GitHub Advisory GHSA-rwr3-c2q8-gm56 · ADVISORY
pypa/advisory-database · WEB
python-pillow/Pillow · WEB
security.gentoo.org/glsa/201612-52 · WEB
pillow.readthedocs.io/en/3.4.x/releasenotes/3.3.2.html · WEB
debian.org/security/2016/dsa-3710 · WEB
securityfocus.com/bid/94234 · WEB

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free