CVE-2014-9601
Fixed in a distro release EPSS 5%
Pillow before 2.7.0 allows remote attackers to cause a denial of service via a compressed text chunk in a PNG image that has a large size when it is decompressed.
Products: python pillow, oracle solaris, fedoraproject fedora, opensuse
Fixed upstream
| Ecosystem | Package | Fixed in |
|---|---|---|
| PyPI | pillow | 2.7.0 |
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Amazon Linux 2 | python-pillow | 2.0.0-23.gitd1c6db8.amzn2.0.4 |
| Amazon Linux 2 | python-pillow-devel | 2.0.0-23.gitd1c6db8.amzn2.0.4 |
| Amazon Linux 2 | python-pillow-doc | 2.0.0-23.gitd1c6db8.amzn2.0.4 |
| Amazon Linux 2 | python-pillow-sane | 2.0.0-23.gitd1c6db8.amzn2.0.4 |
| Amazon Linux 2 | python-pillow-tk | 2.0.0-23.gitd1c6db8.amzn2.0.4 |
| Debian 12 | pillow | 2.6.1-2 |
| Debian 13 | pillow | 2.6.1-2 |
| Debian 14 | pillow | 2.6.1-2 |
| Ubuntu 14.04 LTS | pillow | 2.3.0-1ubuntu3.4 |
| Ubuntu 14.04 LTS | pillow | 2.3.0-1ubuntu3.2 |
| Ubuntu 14.04 LTS | pillow | 2.3.0-1ubuntu3.3 |
| Ubuntu 16.04 LTS | pillow | 3.1.2-0ubuntu1.1 |