Skip to content
OpenAdvisories
Medium ALAS2-2024-2413 1 CVE

Moderate: python-pillow security update (Amazon Linux 2)

Published Jan 3, 2024 · Updated Jan 9, 2024

Ecosystem: Amazon Linux

Summary

Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2016-9189: Pillow before 3.3.2 allows context-dependent attackers to obtain sensitive information by using the "crafted image file" approach, related to an "Integer Overflow" issue affecting the Image.core.map_buffer in map.c component.

Fixed packages 6

ReleasePackageFixed in
Amazon Linux · 2 python-pillow 0:2.0.0-23.gitd1c6db8.amzn2.0.9
Amazon Linux · 2 python-pillow-debuginfo 0:2.0.0-23.gitd1c6db8.amzn2.0.9
Amazon Linux · 2 python-pillow-devel 0:2.0.0-23.gitd1c6db8.amzn2.0.9
Amazon Linux · 2 python-pillow-doc 0:2.0.0-23.gitd1c6db8.amzn2.0.9
Amazon Linux · 2 python-pillow-sane 0:2.0.0-23.gitd1c6db8.amzn2.0.9
Amazon Linux · 2 python-pillow-tk 0:2.0.0-23.gitd1c6db8.amzn2.0.9

Vulnerabilities 1

  • Medium 5.5
    CVE-2016-9189

    Pillow Integer overflow in Map.c

    Pillow before 3.3.2 allows context-dependent attackers to obtain sensitive information by using the "crafted image file" approach, related to an "Integer Overflow" issue affecting the Image.core.map_buffer in map.c component.

    pillow pillow pillow Debian Ubuntu PyPI

References

  • web
    https://alas.aws.amazon.com/cve/html/CVE-2016-9189.html