CVE-2016-9190

Pillow en versiones anteriores a 3.3.2 permite a atacantes dependientes de contexto ejecutar código arbitrario utilizando la aproximación "archivo de imagen manipulado", relacionado con un problema "Insecure Sign Extension" que afecta a ImagingNew en el componente Storage.c.

It was discovered that the Python Imaging Library incorrectly handled certain compressed text chunks in PNG images. A remote attacker could possibly use this issue to cause the Python Imaging Library to crash, resulting in a denial of service. Cris Neckar discovered that the Python Imaging Library incorrectly handled certain malformed images. A remote attacker could use this issue to cause the Python Imaging Library to crash, resulting in a denial of service, or possibly obtain sensitive information. Various other issues were also addressed.