Skip to content
OpenAdvisories
Medium ALAS2-2025-2768 1 CVE

Moderate: python-pillow security update (Amazon Linux 2)

Published Feb 12, 2025 · Updated Feb 25, 2025

Ecosystem: Amazon Linux

Summary

Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2014-3589: PIL/IcnsImagePlugin.py in Python Imaging Library (PIL) and Pillow before 2.3.2 and 2.5.x before 2.5.2 allows remote attackers to cause a denial of service via a crafted block size.

Fixed packages 6

ReleasePackageFixed in
Amazon Linux · 2 python-pillow 0:2.0.0-23.gitd1c6db8.amzn2.0.14
Amazon Linux · 2 python-pillow-debuginfo 0:2.0.0-23.gitd1c6db8.amzn2.0.14
Amazon Linux · 2 python-pillow-devel 0:2.0.0-23.gitd1c6db8.amzn2.0.14
Amazon Linux · 2 python-pillow-doc 0:2.0.0-23.gitd1c6db8.amzn2.0.14
Amazon Linux · 2 python-pillow-sane 0:2.0.0-23.gitd1c6db8.amzn2.0.14
Amazon Linux · 2 python-pillow-tk 0:2.0.0-23.gitd1c6db8.amzn2.0.14

Vulnerabilities 1

  • High 7.5
    CVE-2014-3589

    Pillow denial of service via Crafted Block Size

    PIL/IcnsImagePlugin.py in Python Imaging Library (PIL) and Pillow before 2.3.2 and 2.5.x before 2.5.2 allows remote attackers to cause a denial of service via a crafted block size.

    pillow pillow pillow Debian Ubuntu PyPI

References

  • web
    https://alas.aws.amazon.com/cve/html/CVE-2014-3589.html