NVD

Id
22313  
Name
CVE-2016-9190  
Description
Pillow before 3.3.2 allows context-dependent attackers to execute arbitrary code by using the "crafted image file" approach, related to an "Insecure Sign Extension" issue affecting the ImagingNew in Storage.c component.  
Reject
 
CVSS Version
2  
CVSS Score
6.8  
Severity
Medium  
CVSS Base Score
6.8  
CVSS Impact Subscore
6.4  
CVSS Exploit Subscore
8.6  
CVSS Vector
(AV:N/AC:M/Au:N/C:P/I:P/A:P)  
Pub Date
2017-01-19  
Published
2016-11-04  
Modified Date
2017-01-10  
Seq
2016-9190  

Actions

Related NVD References

Id NVD Id NVD No. Reference Actions
118669 22313 CVE-2016-9190 http://pillow.readthedocs.io/en/3.4.x/releasenotes/3.3.2.html  View
118670 22313 CVE-2016-9190 DSA-3710  View
118671 22313 CVE-2016-9190 94234  View
118672 22313 CVE-2016-9190 https://github.com/python-pillow/Pillow/issues/2105  View
118673 22313 CVE-2016-9190 https://github.com/python-pillow/Pillow/pull/2146/commits/5d8a0be45aad78c5a22c8d099118ee26ef8144af  View

Related JVN

Id Name Title Summary Cveinfo Name Cveinfo Id Nvdinfo Name Nvdinfo Id Cvssv2 Cvssv3 Jvnurl Published Date Last Updated Date Actions
4974 JVNDB-2016-005747 Pillow における任意のコードを実行される脆弱性 Pillow には、Storage.c component の ImagingNew の "Insecure Sign Extension" の問題に関する処理に不備があるため、任意のコードを実行される脆弱性が存在します。 CVE-2016-9190 95697 CVE-2016-9190 22313 6.8 7.8 http://jvndb.jvn.jp/ja/contents/2016/JVNDB-2016-005747.html 2016-10-03 2016-11-08 View