CVE-2016-9190: Sign Extension in Storage.c

November 4, 2016 (updated June 30, 2017)

Pillow allows context-dependent attackers to execute arbitrary code by using the “crafted image file” approach, related to an “Insecure Sign Extension” issue affecting the ImagingNew in Storage.c component.

References

pillow.readthedocs.io/en/3.4.x/releasenotes/3.3.2.html
github.com/python-pillow/Pillow/issues/2105
github.com/python-pillow/Pillow/pull/2146/commits/5d8a0be45aad78c5a22c8d099118ee26ef8144af

Detect and mitigate CVE-2016-9190 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →