Critical Code Execution Vulnerability in Pillow Package
Summary
CVE-2016-9190: Pillow before 3.3.2 allows context-dependent attackers to execute arbitrary code by using the "crafted image file" approach, related to an "Insecure Sign Extension" issue affecting the ImagingNew in Storage.c component. Affects pillow across 2 version ranges.
< 3.4.2-1
< aab33141f381d5577cdef9033b7fdff79122a10c
Fixed in 3.4.2-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
Pillow is a widely used Python Imaging Library that adds image processing capabilities to your Python interpreter. It supports opening, manipulating, and saving many different image file formats. Despite its robust functionality, Pillow has been found vulnerable to a specific issue that allows context-dependent attackers to execute arbitrary code through crafted image files.
Vulnerability Detail
The vulnerability, identified as CVE-2016-9190, arises from an 'Insecure Sign Extension' issue in the ImagingNew function within the Storage.c component of Pillow. This flaw allows attackers to exploit the library by providing specially crafted image files, leading to potential arbitrary code execution. The implications of this vulnerability are severe, as it can compromise the integrity and security of applications relying on Pillow for image processing.
How To Fix
Minimum fixed version
3.4.2-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade pillowTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If upgrading is not immediately feasible, consider validating and sanitizing all image inputs before processing them with Pillow. This can help mitigate the risk of exploitation by ensuring that only safe and expected image formats are processed.
Conclusion
The CVE-2016-9190 vulnerability in the Pillow package poses a significant risk of arbitrary code execution through crafted image files. It is crucial for developers using Pillow to upgrade to the latest version to mitigate this risk. Additionally, utilizing tools like Vulert can help monitor for such vulnerabilities in real-time.
See every vulnerability recorded for pillow →
FAQ
CVE-2016-9190 is a vulnerability in the Pillow package that allows attackers to execute arbitrary code through specially crafted image files.
You can use the Vulert platform to monitor and alert for open-source vulnerabilities in your software. Visit Vulert Scanner to check if your application is affected without any signup.
Exploitation of this vulnerability can lead to arbitrary code execution, potentially compromising the security and integrity of the application using Pillow.
Yes, upgrading to Pillow version 3.4.2-1 or later resolves the vulnerability.
As a temporary measure, validate and sanitize all image inputs before processing them to reduce the risk of exploitation.
References
Related vulnerabilities
Recent vulnerabilities recorded for pillow.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
