{"id":"CVE-2016-9190","aliases":["DEBIAN-CVE-2016-9190","DLA-705-1","DSA-3710-1","EUVD-2016-0025","GHSA-w4vg-rf63-f3j3","MGASA-2016-0383","PYSEC-2016-9","SUSE-SU-2018:1174-1","SUSE-SU-2018:1191-1","SUSE-SU-2019:1321-1","UBUNTU-CVE-2016-9190","USN-3230-1"],"status":"published","title":"Arbitrary code using \"crafted image file\" approach affecting Pillow","description":"Pillow before 3.3.2 allows context-dependent attackers to execute arbitrary code by using the \"crafted image file\" approach, related to an \"Insecure Sign Extension\" issue affecting the ImagingNew in Storage.c component.","severity":{"version":"3.0","score":7.8,"vector":"CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-08","score":0.01897,"percentile":0.79778,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-284"],"published":"2016-11-04T00:00:00Z","modified":"2026-10-24T10:47:22Z","fixes":[{"ecosystem":"PyPI","package":"pillow","fixed_in":["3.3.2"],"sources":["ghsa","osv"]},{"ecosystem":"Debian:12","package":"pillow","fixed_in":["3.4.2-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"pillow","fixed_in":["3.4.2-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"pillow","fixed_in":["3.4.2-1"],"sources":["osv"]},{"ecosystem":"Ubuntu:14.04:LTS","package":"pillow","fixed_in":["2.3.0-1ubuntu3.4"],"sources":["osv"]},{"ecosystem":"Ubuntu:16.04:LTS","package":"pillow","fixed_in":["3.1.2-0ubuntu1.1"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"PyPI","package":"pillow","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.3.2"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"pillow","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.4.2-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"pillow","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.4.2-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"pillow","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.4.2-1"}]}]},{"source":"osv","ecosystem":"Debian:7","package":"python-imaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.1.7-4+deb7u3"}]}],"versions":["1.1.7-4","1.1.7-4+deb7u1","1.1.7-4+deb7u2"],"bundled":2},{"source":"osv","ecosystem":"Debian:8","package":"pillow","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.6.1-2+deb8u3"}]}],"versions":["2.6.1-2","2.6.1-2+deb8u1","2.6.1-2+deb8u2"],"bundled":2},{"source":"osv","ecosystem":"PyPI","package":"pillow","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.3.2"}]}],"versions":["1.0","1.1","1.2","1.3","1.4","1.5","1.6","1.7.0","1.7.1","1.7.2","1.7.3","1.7.4","1.7.5","1.7.6","1.7.7","1.7.8","2.0.0","2.1.0","2.2.0","2.2.1","2.2.2","2.3.0","2.3.1","2.3.2","2.4.0","2.5.0","2.5.1","2.5.2","2.5.3","2.6.0","2.6.1","2.6.2","2.7.0","2.8.0","2.8.1","2.8.2","2.9.0","3.0.0","3.1.0","3.1.0.rc1","3.1.0rc1","3.1.1","3.1.2","3.2.0","3.3.0","3.3.1"]},{"source":"osv","ecosystem":"Mageia:5","package":"python-pillow","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.6.2-2.6.mga5"}]}],"bundled":2},{"source":"osv","ecosystem":"PyPI","package":"pillow","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.3.2"}]}],"versions":["1.0","1.1","1.2","1.3","1.4","1.5","1.6","1.7.0","1.7.1","1.7.2","1.7.3","1.7.4","1.7.5","1.7.6","1.7.7","1.7.8","2.0.0","2.1.0","2.2.0","2.2.1","2.2.2","2.3.0","2.3.1","2.3.2","2.4.0","2.5.0","2.5.1","2.5.2","2.5.3","2.6.0","2.6.1","2.6.2","2.7.0","2.8.0","2.8.1","2.8.2","2.9.0","3.0.0","3.1.0","3.1.0.rc1","3.1.0rc1","3.1.1","3.1.2","3.2.0","3.3.0","3.3.1"]},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 7","package":"python-Pillow","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.8.1-4.3.2"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Enterprise Storage 4","package":"python-Pillow","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.8.1-4.3.2"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 6","package":"python-Pillow","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.7.0-4.3.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Enterprise Storage 5","package":"python-Pillow","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.8.1-3.3.1"}]}],"bundled":3},{"source":"osv","ecosystem":"Ubuntu:14.04:LTS","package":"pillow","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.3.0-1ubuntu3.4"}]}],"versions":["2.2.1-1ubuntu2","2.2.1-2ubuntu1","2.2.1-3ubuntu2","2.2.1-3ubuntu3","2.2.1-3ubuntu4","2.2.1-3ubuntu6","2.3.0-1ubuntu1","2.3.0-1ubuntu2","2.3.0-1ubuntu3","2.3.0-1ubuntu3.2","2.3.0-1ubuntu3.3"]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"pillow","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.2-0ubuntu1.1"}]}],"versions":["2.9.0-1","3.0.0-1","3.0.0-1build1","3.1.0-1","3.1.1-1","3.1.2-0ubuntu1"]},{"source":"osv","ecosystem":"Ubuntu:14.04:LTS","package":"pillow","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.3.0-1ubuntu3.4"}]}],"versions":["2.2.1-1ubuntu2","2.2.1-2ubuntu1","2.2.1-3ubuntu2","2.2.1-3ubuntu3","2.2.1-3ubuntu4","2.2.1-3ubuntu6","2.3.0-1ubuntu1","2.3.0-1ubuntu2","2.3.0-1ubuntu3","2.3.0-1ubuntu3.2","2.3.0-1ubuntu3.3"],"bundled":3},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"pillow","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.2-0ubuntu1.1"}]}],"versions":["2.9.0-1","3.0.0-1","3.0.0-1build1","3.1.0-1","3.1.1-1","3.1.2-0ubuntu1"],"bundled":3}],"products":[{"vendor":"debian","product":"debian_linux"},{"vendor":"python","product":"pillow"}],"references":[{"url":"https://security.gentoo.org/glsa/201612-52","tags":["vendor-advisory","x_refsource_GENTOO","x_transferred","advisory","web"]},{"url":"http://www.securityfocus.com/bid/94234","tags":["vdb-entry","x_refsource_BID","x_transferred","Third Party Advisory","VDB Entry","advisory","web"]},{"url":"https://github.com/python-pillow/Pillow/issues/2105","tags":["x_refsource_CONFIRM","x_transferred","Issue Tracking","Patch","Third Party Advisory","fix","web","report"]},{"url":"http://www.debian.org/security/2016/dsa-3710","tags":["vendor-advisory","x_refsource_DEBIAN","x_transferred","Third Party Advisory","advisory","web"]},{"url":"http://pillow.readthedocs.io/en/3.4.x/releasenotes/3.3.2.html","tags":["x_refsource_CONFIRM","x_transferred","Vendor Advisory","advisory","web","report"]},{"url":"https://github.com/python-pillow/Pillow/pull/2146/commits/5d8a0be45aad78c5a22c8d099118ee26ef8144af","tags":["x_refsource_CONFIRM","x_transferred","Issue Tracking","Patch","Third Party Advisory","fix","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2016-9190","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-w4vg-rf63-f3j3","tags":["advisory"]},{"url":"https://github.com/pypa/advisory-database/tree/main/vulns/pillow/PYSEC-2016-9.yaml","tags":["web"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2016-9190","tags":["advisory"]},{"url":"https://github.com/python-pillow/Pillow","tags":["package"]},{"url":"https://advisories.mageia.org/MGASA-2016-0383.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=19739","tags":["report"]},{"url":"https://www.suse.com/support/update/announcement/2018/suse-su-20181174-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1008846","tags":["report"]},{"url":"https://bugzilla.suse.com/973786","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2016-3076","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-9190","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2018/suse-su-20181191-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2019/suse-su-20191321-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1008845","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2016-9189","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2016-9190","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-3230-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/notices/USN-3229-1","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2016-9190","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2014-9601","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2016-9189","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2016-9190","description":"Pillow before 3.3.2 allows context-dependent attackers to execute arbitrary code by using the \"crafted image file\" approach, related to an \"Insecure Sign Extension\" issue affecting the ImagingNew in Storage.c component.","status":"published","published":"2016-11-04T10:00:00Z","modified":"2024-08-06T02:42:11.192Z","updated_at":"2026-11-02T14:33:32.103757Z"}],"euvd":[{"id":"EUVD-2016-0025","description":"Pillow before 3.3.2 allows context-dependent attackers to execute arbitrary code by using the \"crafted image file\" approach, related to an \"Insecure Sign Extension\" issue affecting the ImagingNew in Storage.c component.","status":"published","published":"2016-11-04T10:00:00Z","modified":"2024-08-06T02:42:11Z","updated_at":"2026-11-03T02:22:28.196866Z"}],"ghsa":[{"id":"GHSA-w4vg-rf63-f3j3","title":"Arbitrary code using \"crafted image file\" approach affecting Pillow","description":"Pillow before 3.3.2 allows context-dependent attackers to execute arbitrary code by using the \"crafted image file\" approach, related to an \"Insecure Sign Extension\" issue affecting the ImagingNew in Storage.c component.","status":"published","published":"2018-07-12T14:45:42Z","modified":"2024-10-08T13:00:30Z","cvss":[{"version":"4.0","score":8.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","level":"high"},{"version":"3.0","score":7.8,"vector":"CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-284"],"updated_at":"2026-11-02T14:38:08.742903Z"}],"nvd":[{"id":"CVE-2016-9190","description":"Pillow before 3.3.2 allows context-dependent attackers to execute arbitrary code by using the \"crafted image file\" approach, related to an \"Insecure Sign Extension\" issue affecting the ImagingNew in Storage.c component.","status":"published","published":"2016-11-04T10:59:10.803Z","modified":"2026-06-17T00:55:39.247Z","cvss":[{"version":"3.0","score":7.8,"vector":"CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high","assessor":"primary"},{"version":"2.0","score":6.8,"vector":"AV:N/AC:M/Au:N/C:P/I:P/A:P","level":"medium","assessor":"primary"}],"cwes":["CWE-284"],"updated_at":"2026-11-02T14:03:32.086916Z"}],"osv":[{"id":"CVE-2016-9190","description":"Pillow before 3.3.2 allows context-dependent attackers to execute arbitrary code by using the \"crafted image file\" approach, related to an \"Insecure Sign Extension\" issue affecting the ImagingNew in Storage.c component.","status":"published","published":"2016-11-04T10:59:10.803Z","modified":"2026-10-24T10:47:22.873456892Z","cvss":[{"version":"3.0","score":7.8,"vector":"CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:44:03.171316Z"},{"id":"DEBIAN-CVE-2016-9190","description":"Pillow before 3.3.2 allows context-dependent attackers to execute arbitrary code by using the \"crafted image file\" approach, related to an \"Insecure Sign Extension\" issue affecting the ImagingNew in Storage.c component.","status":"published","published":"2016-11-04T10:59:10.803Z","modified":"2026-09-22T07:02:38.59680556Z","cvss":[{"version":"3.0","score":7.8,"vector":"CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:45:28.207321Z"},{"id":"GHSA-w4vg-rf63-f3j3","title":"Arbitrary code using \"crafted image file\" approach affecting Pillow","description":"Pillow before 3.3.2 allows context-dependent attackers to execute arbitrary code by using the \"crafted image file\" approach, related to an \"Insecure Sign Extension\" issue affecting the ImagingNew in Storage.c component.","status":"published","published":"2018-07-12T14:45:42Z","modified":"2024-10-08T13:02:50.77575Z","cvss":[{"version":"3.0","score":7.8,"vector":"CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"},{"version":"4.0","score":8.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","level":"high"}],"cwes":["CWE-284"],"updated_at":"2026-11-02T15:46:58.04805Z"},{"id":"UBUNTU-CVE-2016-9190","description":"Pillow before 3.3.2 allows context-dependent attackers to execute arbitrary code by using the \"crafted image file\" approach, related to an \"Insecure Sign Extension\" issue affecting the ImagingNew in Storage.c component.","status":"published","published":"2016-11-04T00:00:00Z","modified":"2026-02-04T02:44:34.261459Z","cvss":[{"version":"3.0","score":7.8,"vector":"CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:54:12.994319Z"},{"id":"DLA-705-1","title":"python-imaging - security update","status":"published","published":"2016-11-07T00:00:00Z","modified":"2026-03-09T02:09:12.106969Z","updated_at":"2026-11-02T15:46:13.207219Z"},{"id":"DSA-3710-1","title":"pillow - security update","status":"published","published":"2016-11-10T00:00:00Z","modified":"2026-03-09T01:21:03.839998Z","updated_at":"2026-11-02T15:46:16.523846Z"},{"id":"MGASA-2016-0383","title":"Updated python-pillow packages fix security vulnerabilities","description":"It was discovered that there were a number of memory overflow issues\nin python-pillow, a Python image manipulation library. (CVE-2016-9189\nand CVE-2016-9190)\n","status":"published","published":"2016-11-17T16:37:05Z","modified":"2026-04-16T06:22:21.312537686Z","updated_at":"2026-11-02T15:49:40.103088Z"},{"id":"PYSEC-2016-9","description":"Pillow before 3.3.2 allows context-dependent attackers to execute arbitrary code by using the \"crafted image file\" approach, related to an \"Insecure Sign Extension\" issue affecting the ImagingNew in Storage.c component.","status":"published","published":"2016-11-04T10:59:00Z","modified":"2023-11-08T03:58:38.172599Z","updated_at":"2026-11-02T15:52:51.645172Z"},{"id":"SUSE-SU-2018:1174-1","title":"Security update for python-Pillow","description":"This update for python-Pillow fixes the following issues:\n\n  * CVE-2016-9190: Pillow allows context-dependent attackers to execute arbitrary code by using the \n    \\'crafted image file\\' approach, related to an \\'Insecure Sign Extension\\' issue affecting the \n    ImagingNew in Storage.c component. (bsc#1008846)\n\n  * CVE-2016-3076: Heap-based buffer overflow in the j2k_encode_entry function allows remote attackers \n    to cause a denial of service (memory corruption) via a crafted Jpeg2000 file. (bsc#973786) \n\n","status":"published","published":"2018-05-08T20:14:49Z","modified":"2026-02-04T04:33:43.446656Z","updated_at":"2026-11-02T15:53:44.594517Z"},{"id":"SUSE-SU-2018:1191-1","title":"Security update for python-Pillow","description":"This update for python-Pillow fixes the following issues:\n\n   * CVE-2016-9190: Pillow allows context-dependent attackers to execute arbitrary code by using the \n    \\'crafted image file\\' approach, related to an \\'Insecure Sign Extension\\' issue affecting the \n    ImagingNew in Storage.c component. (bsc#1008846)\n\n   * CVE-2016-3076: Heap-based buffer overflow in the j2k_encode_entry function allows remote attackers \n    to cause a denial of service (memory corruption) via a crafted Jpeg2000 file. (bsc#973786) \n\n\n","status":"published","published":"2018-05-09T14:28:43Z","modified":"2026-02-04T04:19:29.791184Z","updated_at":"2026-11-02T15:53:44.972817Z"},{"id":"SUSE-SU-2019:1321-1","title":"Security update for python-Pillow","description":"This update for python-Pillow fixes the following issues:\n\nSecurity issues fixed:\n\n- CVE-2016-9189: Fixed a integer overflows leading to memory disclosure in PyImaging_MapBuffer() (bsc#1008845).\n- CVE-2016-9190: Fixed a code execution vulnerability using a crafted image file in ImagingNew() (bsc#1008846).\n- CVE-2016-3076: Fixed a integer overflow in j2k_encode_entry() (bsc#973786)\n","status":"published","published":"2019-05-23T11:47:16Z","modified":"2026-02-04T03:32:37.208269Z","updated_at":"2026-11-02T15:53:45.926331Z"},{"id":"USN-3230-1","title":"pillow vulnerabilities","description":"It was discovered that Pillow incorrectly handled certain compressed text\nchunks in PNG images. A remote attacker could possibly use this issue to\ncause Pillow to crash, resulting in a denial of service. This issue only\naffected Ubuntu 14.04 LTS. (CVE-2014-9601)\n\nCris Neckar discovered that Pillow incorrectly handled certain malformed\nimages. A remote attacker could use this issue to cause Pillow to crash,\nresulting in a denial of service, or possibly obtain sensitive information.\n(CVE-2016-9189)\n\nCris Neckar discovered that Pillow incorrectly handled certain malformed\nimages. A remote attacker could use this issue to cause Pillow to crash,\nresulting in a denial of service, or possibly execute arbitrary code.\n(CVE-2016-9190)\n","status":"published","published":"2017-03-13T17:04:12Z","modified":"2026-02-10T04:41:06Z","updated_at":"2026-11-02T16:58:10.303275Z"}]}}