CVE-2014-9601
Pillow < 2.7.0 - Denial of Service via Decompressed PNG Text Chunk
Title source: llmDescription
Pillow before 2.7.0 allows remote attackers to cause a denial of service via a compressed text chunk in a PNG image that has a large size when it is decompressed.
References (7)
Core 7
Core References
Third Party Advisory vendor-advisory
x_refsource_suse
http://lists.opensuse.org/opensuse-updates/2015-04/msg00056.html
Third Party Advisory x_refsource_confirm
https://www.djangoproject.com/weblog/2015/jan/02/pillow-security-release/
Third Party Advisory vendor-advisory
x_refsource_fedora
http://lists.fedoraproject.org/pipermail/package-announce/2015-January/148442.html
Third Party Advisory x_refsource_confirm
http://www.oracle.com/technetwork/topics/security/bulletinjul2015-2511963.html
Vendor Advisory x_refsource_confirm
http://pillow.readthedocs.org/releasenotes/2.7.0.html
Third Party Advisory, VDB Entry vdb-entry
x_refsource_bid
http://www.securityfocus.com/bid/77758
Vendor Advisory x_refsource_confirm
https://github.com/python-pillow/Pillow/pull/1060
Scores
EPSS
0.0103
EPSS Percentile
77.6%
Details
CWE
CWE-20
Status
published
Products (5)
fedoraproject/fedora
21
opensuse/opensuse
13.2
oracle/solaris
11.2
pypi/pillow
0 - 2.7.0PyPI
python/pillow
< 2.6.2
Published
Jan 16, 2015
Tracked Since
Feb 18, 2026