Skip to content
OpenAdvisories
Medium ALAS2-2025-2803 1 CVE

Moderate: python-pillow security update (Amazon Linux 2)

Published Mar 13, 2025 · Updated Mar 25, 2025

Ecosystem: Amazon Linux

Summary

Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2016-2533: Buffer overflow in the ImagingPcdDecode function in PcdDecode.c in Pillow before 3.1.1 and Python Imaging Library (PIL) 1.1.7 and earlier allows remote attackers to cause a denial of service (crash) via a crafted PhotoCD file.

Fixed packages 6

ReleasePackageFixed in
Amazon Linux · 2 python-pillow 0:2.0.0-23.gitd1c6db8.amzn2.0.16
Amazon Linux · 2 python-pillow-debuginfo 0:2.0.0-23.gitd1c6db8.amzn2.0.16
Amazon Linux · 2 python-pillow-devel 0:2.0.0-23.gitd1c6db8.amzn2.0.16
Amazon Linux · 2 python-pillow-doc 0:2.0.0-23.gitd1c6db8.amzn2.0.16
Amazon Linux · 2 python-pillow-sane 0:2.0.0-23.gitd1c6db8.amzn2.0.16
Amazon Linux · 2 python-pillow-tk 0:2.0.0-23.gitd1c6db8.amzn2.0.16

Vulnerabilities 1

  • Medium 6.5
    CVE-2016-2533

    Pillow buffer overflow in ImagingPcdDecode

    Buffer overflow in the ImagingPcdDecode function in PcdDecode.c in Pillow before 3.1.1 and Python Imaging Library (PIL) 1.1.7 and earlier allows remote attackers to cause a denial of service (crash) via a crafted PhotoCD file.

    pillow pillow pillow Debian Ubuntu PyPI

References

  • web
    https://alas.aws.amazon.com/cve/html/CVE-2016-2533.html