PyPI/pillow CVE-2014-3598: high 7.5, EPSS 1.99%

Pillow is vulnerable to Denial of Service (DOS) in the Jpeg2KImagePlugin

Action: Upgrade pillow to 2.5.3 or later.

pip install pillow==2.5.3

Affected

Fixed versions

Sources

• osv: GHSA-j6f7-g425-4gmx
• https://nvd.nist.gov/vuln/detail/CVE-2014-3598
• https://github.com/python-pillow/Pillow/commit/347a1d8d956f9e64af4463ee25311b60cdd5657d
• https://github.com/pypa/advisory-database/tree/main/vulns/pillow/PYSEC-2015-15.yaml
• https://github.com/python-pillow/Pillow
• https://pypi.python.org/pypi/Pillow/2.5.3
• http://lists.opensuse.org/opensuse-updates/2015-04/msg00056.html

CVE-2014-3598 · published 2022-05-14T02:05:20Z · modified 2024-11-29T05:39:23.806220Z · JSON