Buffer Overflow Vulnerability in Pillow Package: CVE-2016-2533
Summary
CVE-2016-2533: Buffer overflow in the ImagingPcdDecode function in PcdDecode.c in Pillow before 3.1.1 and Python Imaging Library (PIL) 1.1.7 and earlier allows remote attackers to cause a denial of service (crash) via a crafted PhotoCD... Affects pillow across 3 version ranges.
< 3.1.1-1
< 5bdf54b5a76b54fb00bd05f2d733e0a4173eefc9
< ae453aa18b66af54e7ff716f4ccb33adca60afd4
Fixed in 3.1.1-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Pillow is a popular Python Imaging Library (PIL) fork that provides extensive capabilities for image processing. It supports opening, manipulating, and saving various image file formats. The library is widely used in web applications, data analysis, and machine learning projects. However, prior to version 3.1.1, Pillow contained a critical vulnerability that could be exploited through specially crafted PhotoCD files, leading to potential denial of service.
Vulnerability Detail
The vulnerability, identified as CVE-2016-2533, is a buffer overflow in the ImagingPcdDecode function located in PcdDecode.c. This flaw allows remote attackers to craft malicious PhotoCD files that, when processed by Pillow, can cause the application to crash. The vulnerability arises from improper handling of input data, which can lead to memory corruption and application instability. The CVSS score for this vulnerability is 6.5, indicating a moderate severity level.
How To Fix
Minimum fixed version
3.1.1-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade pillowTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If immediate upgrading is not feasible, consider validating and sanitizing input files before processing them with Pillow. This can help mitigate the risk of processing malicious files. Additionally, avoid using Pillow for untrusted image sources until the upgrade is applied.
Conclusion
CVE-2016-2533 is a significant vulnerability in the Pillow package that can lead to application crashes when processing malicious files. Users are strongly advised to upgrade to version 3.1.1 or later to mitigate this risk. For those unable to upgrade immediately, implementing input validation can serve as a temporary workaround.
See every vulnerability recorded for pillow →
FAQ
CVE-2016-2533 is a buffer overflow vulnerability in the Pillow package that can lead to application crashes when processing malicious PhotoCD files.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
The primary impact is a denial of service, where the application may crash, disrupting services that rely on image processing.
Yes, you can validate and sanitize input files before processing them with Pillow to reduce the risk of exploitation.
The CVSS score for CVE-2016-2533 is 6.5, indicating a moderate severity level.
Related vulnerabilities
Recent vulnerabilities recorded for pillow.
