PyPI/pillow CVE-2014-3598: unknown, EPSS 1.99%

The Jpeg2KImagePlugin plugin in Pillow before 2.5.3 allows remote attackers to cause a denial of service via a crafted image.

Action: Upgrade pillow to 2.5.3 or later.

pip install pillow==2.5.3

Affected

Fixed versions

Sources

• osv: PYSEC-2015-15
• https://pypi.python.org/pypi/Pillow/2.5.3
• http://lists.opensuse.org/opensuse-updates/2015-04/msg00056.html
• https://github.com/advisories/GHSA-j6f7-g425-4gmx

CVE-2014-3598 · published 2015-05-01T15:59:00Z · modified 2026-06-10T17:02:29.206078964Z · JSON