PyPI/pillow CVE-2016-3076: medium 5.5, EPSS 2.59%

Heap-based buffer overflow in the j2k_encode_entry function in Pillow 2.5.0 through 3.1.1 allows remote attackers to cause a denial of service (memory corruption) via a crafted Jpeg2000 file.

Action: Upgrade pillow to 3.1.2 or later.

pip install pillow==3.1.2

Affected

Fixed versions

Sources

• osv: PYSEC-2017-92
• nvd: CVE-2016-3076
• https://bugzilla.redhat.com/show_bug.cgi?id=1321929
• http://pillow.readthedocs.io/en/4.1.x/releasenotes/3.1.2.html
• http://www.securityfocus.com/bid/98042
• https://github.com/advisories/GHSA-v9pc-9mvp-x87g

CVE-2016-3076 · published 2017-04-24T18:59:00Z · modified 2026-06-10T17:02:29.228891550Z · JSON