{"id":"CVE-2016-3076","aliases":["DEBIAN-CVE-2016-3076","EUVD-2017-0083","GHSA-v9pc-9mvp-x87g","MGASA-2016-0141","PYSEC-2017-92","SUSE-SU-2018:1174-1","SUSE-SU-2018:1191-1","SUSE-SU-2019:1321-1","UBUNTU-CVE-2016-3076","openSUSE-SU-2024:10511-1","openSUSE-SU-2024:11209-1","openSUSE-SU-2024:13827-1","openSUSE-SU-2026:11261-1"],"status":"published","title":"Pillow Buffer overflow in Jpeg2KEncode.c","description":"Heap-based buffer overflow in the j2k_encode_entry function in Pillow 2.5.0 through 3.1.1 allows remote attackers to cause a denial of service (memory corruption) via a crafted Jpeg2000 file.","severity":{"version":"3.0","score":5.5,"vector":"CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-08","score":0.02594,"percentile":0.85422,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-119"],"published":"2016-04-13T17:39:04Z","modified":"2026-10-24T10:30:34Z","fixes":[{"ecosystem":"PyPI","package":"pillow","fixed_in":["3.1.2"],"sources":["ghsa","osv"]},{"ecosystem":"Debian:12","package":"pillow","fixed_in":["3.2.0-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"pillow","fixed_in":["3.2.0-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"pillow","fixed_in":["3.2.0-1"],"sources":["osv"]},{"ecosystem":"Mageia:5","package":"python-pillow","fixed_in":["2.6.2-2.5.mga5"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"PyPI","package":"pillow","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.5.0"},{"fixed":"3.1.2"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"pillow","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.0-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"pillow","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.0-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"pillow","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.0-1"}]}]},{"source":"osv","ecosystem":"PyPI","package":"pillow","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.5.0"},{"fixed":"3.1.2"}]}],"versions":["2.5.0","2.5.1","2.5.2","2.5.3","2.6.0","2.6.1","2.6.2","2.7.0","2.8.0","2.8.1","2.8.2","2.9.0","3.0.0","3.1.0","3.1.0.rc1","3.1.0rc1","3.1.1"]},{"source":"osv","ecosystem":"Mageia:5","package":"python-pillow","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.6.2-2.5.mga5"}]}]},{"source":"osv","ecosystem":"PyPI","package":"pillow","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.5.0"},{"fixed":"3.1.2"}]}],"versions":["2.5.0","2.5.1","2.5.2","2.5.3","2.6.0","2.6.1","2.6.2","2.7.0","2.8.0","2.8.1","2.8.2","2.9.0","3.0.0","3.1.0","3.1.0.rc1","3.1.0rc1","3.1.1"]},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 7","package":"python-Pillow","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.8.1-4.3.2"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Enterprise Storage 4","package":"python-Pillow","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.8.1-4.3.2"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 6","package":"python-Pillow","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.7.0-4.3.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Enterprise Storage 5","package":"python-Pillow","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.8.1-3.3.1"}]}],"bundled":3},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"python-Pillow","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.4.2-1.1"}]}],"bundled":5},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"python-Pillow","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.3.2-1.2"}]}],"bundled":17},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"python-Pillow","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10.3.0-1.1"}]}],"bundled":18},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"python-Pillow","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"12.3.0-1.1"}]}],"bundled":24}],"products":[{"vendor":"python","product":"pillow"}],"references":[{"url":"http://pillow.readthedocs.io/en/4.1.x/releasenotes/3.1.2.html","tags":["x_refsource_CONFIRM","x_transferred","Release Notes","Vendor Advisory","advisory","web"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1321929","tags":["x_refsource_CONFIRM","x_transferred","Issue Tracking","Third Party Advisory","VDB Entry","report","web"]},{"url":"http://www.securityfocus.com/bid/98042","tags":["vdb-entry","x_refsource_BID","x_transferred","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2016-3076","tags":["advisory"]},{"url":"https://github.com/python-pillow/Pillow/blob/4.1.x/docs/releasenotes/3.1.2.rst","tags":["web"]},{"url":"https://github.com/pypa/advisory-database/tree/main/vulns/pillow/PYSEC-2017-92.yaml","tags":["web"]},{"url":"https://web.archive.org/web/20200227174644/http://www.securityfocus.com/bid/98042","tags":["web"]},{"url":"https://github.com/advisories/GHSA-v9pc-9mvp-x87g","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2016-3076","tags":["advisory"]},{"url":"https://github.com/python-pillow/Pillow","tags":["package"]},{"url":"https://advisories.mageia.org/MGASA-2016-0141.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=18186","tags":["report"]},{"url":"https://lists.fedoraproject.org/pipermail/package-announce/2016-April/181943.html","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2018/suse-su-20181174-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1008846","tags":["report"]},{"url":"https://bugzilla.suse.com/973786","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2016-3076","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-9190","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2018/suse-su-20181191-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2019/suse-su-20191321-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1008845","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2016-9189","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2016-3076","tags":["report"]},{"url":"https://github.com/python-pillow/Pillow/commit/a1f244343df389cf15cdfff80327594821097295","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2016-3076","tags":["report"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2014-3589","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-3598","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-0740","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-0775","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-15999","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-35653","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-35654","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-35655","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-23437","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-25289","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-25290","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-25291","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-25292","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-25293","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-27921","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-34552","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-28219","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-44271","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-50447","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-42311","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-4775","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-54059","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-55379","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2016-3076","description":"Heap-based buffer overflow in the j2k_encode_entry function in Pillow 2.5.0 through 3.1.1 allows remote attackers to cause a denial of service (memory corruption) via a crafted Jpeg2000 file.","status":"published","published":"2017-04-24T18:00:00Z","modified":"2024-08-05T23:40:15.588Z","updated_at":"2026-11-02T14:33:33.758954Z"}],"euvd":[{"id":"EUVD-2017-0083","description":"Heap-based buffer overflow in the j2k_encode_entry function in Pillow 2.5.0 through 3.1.1 allows remote attackers to cause a denial of service (memory corruption) via a crafted Jpeg2000 file.","status":"published","published":"2017-04-24T18:00:00Z","modified":"2024-08-05T23:40:15Z","updated_at":"2026-11-03T02:22:51.132305Z"}],"ghsa":[{"id":"GHSA-v9pc-9mvp-x87g","title":"Pillow Buffer overflow in Jpeg2KEncode.c","description":"Heap-based buffer overflow in the j2k_encode_entry function in Pillow 2.5.0 through 3.1.1 allows remote attackers to cause a denial of service (memory corruption) via a crafted Jpeg2000 file.","status":"published","published":"2022-05-17T02:47:20Z","modified":"2024-10-09T21:04:58Z","cvss":[{"version":"3.0","score":5.5,"vector":"CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium"},{"version":"4.0","score":7.1,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","level":"high"}],"cwes":["CWE-119"],"updated_at":"2026-11-02T14:38:09.785133Z"}],"nvd":[{"id":"CVE-2016-3076","description":"Heap-based buffer overflow in the j2k_encode_entry function in Pillow 2.5.0 through 3.1.1 allows remote attackers to cause a denial of service (memory corruption) via a crafted Jpeg2000 file.","status":"published","published":"2017-04-24T18:59:00.43Z","modified":"2026-06-17T00:44:55.423Z","cvss":[{"version":"3.0","score":5.5,"vector":"CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium","assessor":"primary"},{"version":"2.0","score":4.3,"vector":"AV:N/AC:M/Au:N/C:N/I:N/A:P","level":"medium","assessor":"primary"}],"cwes":["CWE-119"],"updated_at":"2026-11-02T14:03:37.619685Z"}],"osv":[{"id":"CVE-2016-3076","description":"Heap-based buffer overflow in the j2k_encode_entry function in Pillow 2.5.0 through 3.1.1 allows remote attackers to cause a denial of service (memory corruption) via a crafted Jpeg2000 file.","status":"published","published":"2017-04-24T18:59:00.43Z","modified":"2026-10-24T10:30:34.624472902Z","cvss":[{"version":"3.0","score":5.5,"vector":"CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:44:02.114472Z"},{"id":"DEBIAN-CVE-2016-3076","description":"Heap-based buffer overflow in the j2k_encode_entry function in Pillow 2.5.0 through 3.1.1 allows remote attackers to cause a denial of service (memory corruption) via a crafted Jpeg2000 file.","status":"published","published":"2017-04-24T18:59:00.43Z","modified":"2026-09-22T07:01:58.236989569Z","cvss":[{"version":"3.0","score":5.5,"vector":"CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:45:27.627285Z"},{"id":"GHSA-v9pc-9mvp-x87g","title":"Pillow Buffer overflow in Jpeg2KEncode.c","description":"Heap-based buffer overflow in the j2k_encode_entry function in Pillow 2.5.0 through 3.1.1 allows remote attackers to cause a denial of service (memory corruption) via a crafted Jpeg2000 file.","status":"published","published":"2022-05-17T02:47:20Z","modified":"2024-10-09T21:25:28.863663Z","cvss":[{"version":"3.0","score":5.5,"vector":"CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium"},{"version":"4.0","score":7.1,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","level":"high"}],"cwes":["CWE-119"],"updated_at":"2026-11-02T15:46:56.981655Z"},{"id":"UBUNTU-CVE-2016-3076","description":"Heap-based buffer overflow in the j2k_encode_entry function in Pillow 2.5.0 through 3.1.1 allows remote attackers to cause a denial of service (memory corruption) via a crafted Jpeg2000 file.","status":"withdrawn","published":"2017-04-24T18:59:00Z","modified":"2025-07-16T08:12:09.932656Z","cvss":[{"version":"3.0","score":5.5,"vector":"CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:54:11.872222Z"},{"id":"MGASA-2016-0141","title":"Updated python-pillow packages fix CVE-2016-3076","description":"This update fixes an integer overflow in Jpeg2KEncode.c causing a buffer\noverflow (CVE-2016-3076).\n","status":"published","published":"2016-04-13T17:39:04Z","modified":"2026-04-16T06:24:22.212656135Z","updated_at":"2026-11-02T15:49:39.792687Z"},{"id":"openSUSE-SU-2024:10511-1","title":"python3-Pillow-3.4.2-1.1 on GA media","description":"These are all security issues fixed in the python3-Pillow-3.4.2-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T03:50:43.233864Z","updated_at":"2026-11-02T16:58:34.487567Z"},{"id":"openSUSE-SU-2024:11209-1","title":"python36-Pillow-8.3.2-1.2 on GA media","description":"These are all security issues fixed in the python36-Pillow-8.3.2-1.2 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T03:15:01.713817Z","updated_at":"2026-11-02T16:58:34.894275Z"},{"id":"openSUSE-SU-2024:13827-1","title":"python310-Pillow-10.3.0-1.1 on GA media","description":"These are all security issues fixed in the python310-Pillow-10.3.0-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T04:32:45.098529Z","updated_at":"2026-11-02T16:58:36.327643Z"},{"id":"openSUSE-SU-2026:11261-1","title":"python313-Pillow-12.3.0-1.1 on GA media","description":"These are all security issues fixed in the python313-Pillow-12.3.0-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-07-12T00:00:00Z","modified":"2026-07-13T09:00:11.048299149Z","updated_at":"2026-11-02T16:58:38.95195Z"},{"id":"PYSEC-2017-92","description":"Heap-based buffer overflow in the j2k_encode_entry function in Pillow 2.5.0 through 3.1.1 allows remote attackers to cause a denial of service (memory corruption) via a crafted Jpeg2000 file.","status":"published","published":"2017-04-24T18:59:00Z","modified":"2026-06-10T17:02:29.22889155Z","updated_at":"2026-11-02T15:52:51.645172Z"},{"id":"SUSE-SU-2018:1174-1","title":"Security update for python-Pillow","description":"This update for python-Pillow fixes the following issues:\n\n  * CVE-2016-9190: Pillow allows context-dependent attackers to execute arbitrary code by using the \n    \\'crafted image file\\' approach, related to an \\'Insecure Sign Extension\\' issue affecting the \n    ImagingNew in Storage.c component. (bsc#1008846)\n\n  * CVE-2016-3076: Heap-based buffer overflow in the j2k_encode_entry function allows remote attackers \n    to cause a denial of service (memory corruption) via a crafted Jpeg2000 file. (bsc#973786) \n\n","status":"published","published":"2018-05-08T20:14:49Z","modified":"2026-02-04T04:33:43.446656Z","updated_at":"2026-11-02T15:53:44.594517Z"},{"id":"SUSE-SU-2018:1191-1","title":"Security update for python-Pillow","description":"This update for python-Pillow fixes the following issues:\n\n   * CVE-2016-9190: Pillow allows context-dependent attackers to execute arbitrary code by using the \n    \\'crafted image file\\' approach, related to an \\'Insecure Sign Extension\\' issue affecting the \n    ImagingNew in Storage.c component. (bsc#1008846)\n\n   * CVE-2016-3076: Heap-based buffer overflow in the j2k_encode_entry function allows remote attackers \n    to cause a denial of service (memory corruption) via a crafted Jpeg2000 file. (bsc#973786) \n\n\n","status":"published","published":"2018-05-09T14:28:43Z","modified":"2026-02-04T04:19:29.791184Z","updated_at":"2026-11-02T15:53:44.972817Z"},{"id":"SUSE-SU-2019:1321-1","title":"Security update for python-Pillow","description":"This update for python-Pillow fixes the following issues:\n\nSecurity issues fixed:\n\n- CVE-2016-9189: Fixed a integer overflows leading to memory disclosure in PyImaging_MapBuffer() (bsc#1008845).\n- CVE-2016-9190: Fixed a code execution vulnerability using a crafted image file in ImagingNew() (bsc#1008846).\n- CVE-2016-3076: Fixed a integer overflow in j2k_encode_entry() (bsc#973786)\n","status":"published","published":"2019-05-23T11:47:16Z","modified":"2026-02-04T03:32:37.208269Z","updated_at":"2026-11-02T15:53:45.926331Z"}]}}