id: PYSEC-2017-92
details: Heap-based buffer overflow in the j2k_encode_entry function in Pillow 2.5.0
  through 3.1.1 allows remote attackers to cause a denial of service (memory corruption)
  via a crafted Jpeg2000 file.
affected:
- package:
    name: pillow
    ecosystem: PyPI
    purl: pkg:pypi/pillow
  ranges:
  - type: ECOSYSTEM
    events:
    - introduced: 2.5.0
    - fixed: 3.1.2
  versions:
  - 2.5.0
  - 2.5.1
  - 2.5.2
  - 2.5.3
  - 2.6.0
  - 2.6.1
  - 2.6.2
  - 2.7.0
  - 2.8.0
  - 2.8.1
  - 2.8.2
  - 2.9.0
  - 3.0.0
  - 3.1.0
  - 3.1.0.rc1
  - 3.1.0rc1
  - 3.1.1
references:
- type: REPORT
  url: https://bugzilla.redhat.com/show_bug.cgi?id=1321929
- type: WEB
  url: http://pillow.readthedocs.io/en/4.1.x/releasenotes/3.1.2.html
- type: WEB
  url: http://www.securityfocus.com/bid/98042
- type: ADVISORY
  url: https://github.com/advisories/GHSA-v9pc-9mvp-x87g
aliases:
- CVE-2016-3076
- GHSA-v9pc-9mvp-x87g
modified: "2021-08-27T03:22:10.292415Z"
published: "2017-04-24T18:59:00Z"