Pillow buffer overflow in ImagingPcdDecode

MEDIO 6.5CVE-2016-2533 · GHSA-3c5c-7235-994j · PYSEC-2016-19 · Published 13/04/2016 · updated 17/06/2026

Package	Affected versions	Patched versions
pillow PyPI	`< 3.1.1`	`3.1.1`
pillow python	`≤ 3.1.0`	No fix yet
python imaging python_imaging_project	`≤ 1.1.7`	No fix yet

Description

Buffer overflow in the ImagingPcdDecode function in PcdDecode.c in Pillow before 3.1.1 and Python Imaging Library (PIL) 1.1.7 and earlier allows remote attackers to cause a denial of service (crash) via a crafted PhotoCD file.

NVD description

Buffer overflow in the ImagingPcdDecode function in PcdDecode.c in Pillow before 3.1.1 and Python Imaging Library (PIL) 1.1.7 and earlier allows remote attackers to cause a denial of service (crash) via a crafted PhotoCD file.

References

nvd.nist.gov/vuln/detail/CVE-2016-2533 · ADVISORY
python-pillow/Pillow#1706 · WEB
python-pillow/Pillow commit 5bdf54b · WEB
python-pillow/Pillow commit ae453aa · WEB
GitHub Advisory GHSA-3c5c-7235-994j · ADVISORY
pypa/advisory-database · WEB
python-pillow/Pillow · PACKAGE
python-pillow/Pillow · WEB
python-pillow/Pillow · WEB
security.gentoo.org/glsa/201612-52 · WEB
debian.org/security/2016/dsa-3499 · WEB
openwall.com/lists/oss-security/2016/02/02/5 · WEB
openwall.com/lists/oss-security/2016/02/22/2 · WEB
oracle.com/technetwork/topics/security/bulletinjan2016-2867206.html · WEB

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free