Pillow Buffer overflow in ImagingLibTiffDecode

中危 6.5CVE-2016-0740 · GHSA-hggx-3h72-49ww · PYSEC-2016-5 · Published 13/04/2016 · updated 17/06/2026

Package	Affected versions	Patched versions
pillow PyPI	`< 3.1.1`	`3.1.1`
pillow python	`≤ 3.1.0`	No fix yet

Description

Buffer overflow in the ImagingLibTiffDecode function in libImaging/TiffDecode.c in Pillow before 3.1.1 allows remote attackers to overwrite memory via a crafted TIFF file.

NVD description

Buffer overflow in the ImagingLibTiffDecode function in libImaging/TiffDecode.c in Pillow before 3.1.1 allows remote attackers to overwrite memory via a crafted TIFF file.

References

nvd.nist.gov/vuln/detail/CVE-2016-0740 · ADVISORY
python-pillow/Pillow commit 6dcbf5b · WEB
GitHub Advisory GHSA-hggx-3h72-49ww · ADVISORY
pypa/advisory-database · WEB
python-pillow/Pillow · PACKAGE
python-pillow/Pillow · WEB
security.gentoo.org/glsa/201612-52 · WEB
debian.org/security/2016/dsa-3499 · WEB

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free