CVE-2016-0740

MEDIUM

Pillow <3.1.1 - Buffer Overflow

Title source: llm

Description

Buffer overflow in the ImagingLibTiffDecode function in libImaging/TiffDecode.c in Pillow before 3.1.1 allows remote attackers to overwrite memory via a crafted TIFF file.

References (4)

[Patch, Vendor Advisory] https://github.com/python-pillow/Pillow/blob/c3cb690fed5d4bf0c45576759de55d054916c165/CHANGES.rst

[Patch] https://github.com/python-pillow/Pillow/commit/6dcbf5bd96b717c58d7b642949da8d323099928e

[Third Party Advisory] http://www.debian.org/security/2016/dsa-3499

[Third Party Advisory] https://security.gentoo.org/glsa/201612-52

Scores

CVSS v3 6.5

EPSS 0.0015

EPSS Percentile 35.0%

Attack Vector NETWORK

CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N

Classification

CWE

CWE-119

Status draft

Affected Products (4)

python/pillow < 3.1.0

debian/debian_linux

pypi/pillow < 3.1.1PyPI

Timeline

Published Apr 13, 2016

Tracked Since Feb 18, 2026