Описание
Heap-based buffer overflow in the j2k_encode_entry function in Pillow 2.5.0 through 3.1.1 allows remote attackers to cause a denial of service (memory corruption) via a crafted Jpeg2000 file.
Пакеты
| Пакет | Статус | Версия исправления | Релиз | Тип |
|---|---|---|---|---|
| pillow | fixed | 3.2.0-1 | package | |
| python-imaging | removed | package |
Примечания
https://github.com/python-pillow/Pillow/commit/a1f244343df389cf15cdfff80327594821097295 (3.2.0)
https://github.com/python-pillow/Pillow/commit/d00d8571c2cc7e0f137e4ce4b3669d0698dee79b (3.1.2)
Marked as unimportant since source vulnerable but in Debian we do
not built against openjpeg by default
EPSS
Связанные уязвимости
Heap-based buffer overflow in the j2k_encode_entry function in Pillow 2.5.0 through 3.1.1 allows remote attackers to cause a denial of service (memory corruption) via a crafted Jpeg2000 file.
Heap-based buffer overflow in the j2k_encode_entry function in Pillow 2.5.0 through 3.1.1 allows remote attackers to cause a denial of service (memory corruption) via a crafted Jpeg2000 file.
Heap-based buffer overflow in the j2k_encode_entry function in Pillow 2.5.0 through 3.1.1 allows remote attackers to cause a denial of service (memory corruption) via a crafted Jpeg2000 file.
EPSS