The remote Solaris system is missing necessary patches to address security updates :

  - PIL/IcnsImagePlugin.py in Python Imaging Library (PIL)     and Pillow before 2.3.2 and 2.5.x before 2.5.2 allows     remote attackers to cause a denial of service via a     crafted block size. (CVE-2014-3589)

Andrew Drake discovered that missing input sanitising in the icns decoder of the Python Imaging Library could result in denial of service if a malformed image is processed.

Andrew Drake discovered that missing input sanitising in the icns decoder of the Python Imaging Library could result in denial of service if a malformed image is processed.

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - PIL/IcnsImagePlugin.py in Python Imaging Library (PIL) and Pillow before 2.3.2 and 2.5.x before 2.5.2     allows remote attackers to cause a denial of service via a crafted block size. (CVE-2014-3589)

Note that Nessus relies on the presence of the package as reported by the vendor.

According to the versions of the python-pillow package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - Pillow before 2.7.0 allows remote attackers to cause a     denial of service via a compressed text chunk in a PNG     image that has a large size when it is     decompressed.(CVE-2014-9601)

  - The (1) load_djpeg function in JpegImagePlugin.py, (2)     Ghostscript function in EpsImagePlugin.py, (3) load     function in IptcImagePlugin.py, and (4) _copy function     in Image.py in Python Image Library (PIL) 1.1.7 and     earlier and Pillow before 2.3.1 do not properly create     temporary files, which allow local users to overwrite     arbitrary files and obtain sensitive information via a     symlink attack on the temporary file.(CVE-2014-1932)

  - The (1) JpegImagePlugin.py and (2) EpsImagePlugin.py     scripts in Python Image Library (PIL) 1.1.7 and earlier     and Pillow before 2.3.1 uses the names of temporary     files on the command line, which makes it easier for     local users to conduct symlink attacks by listing the     processes.(CVE-2014-1933)

  - Python Image Library (PIL) 1.1.7 and earlier and Pillow     2.3 might allow remote attackers to execute arbitrary     commands via shell metacharacters in unspecified     vectors related to CVE-2014-1932, possibly     JpegImagePlugin.py.(CVE-2014-3007)

  - PIL/IcnsImagePlugin.py in Python Imaging Library (PIL)     and Pillow before 2.3.2 and 2.5.x before 2.5.2 allows     remote attackers to cause a denial of service via a     crafted block size.(CVE-2014-3589)

  - Buffer overflow in the ImagingLibTiffDecode function in     libImaging/TiffDecode.c in Pillow before 3.1.1 allows     remote attackers to overwrite memory via a crafted TIFF     file.(CVE-2016-0740)

  - Buffer overflow in the ImagingFliDecode function in     libImaging/FliDecode.c in Pillow before 3.1.1 allows     remote attackers to cause a denial of service (crash)     via a crafted FLI file.(CVE-2016-0775)

  - Buffer overflow in the ImagingPcdDecode function in     PcdDecode.c in Pillow before 3.1.1 and Python Imaging     Library (PIL) 1.1.7 and earlier allows remote attackers     to cause a denial of service (crash) via a crafted     PhotoCD file.(CVE-2016-2533)

  - Pillow before 3.3.2 allows context-dependent attackers     to obtain sensitive information by using the 'crafted     image file' approach, related to an 'Integer Overflow'     issue affecting the Image.core.map_buffer in map.c     component.(CVE-2016-9189)

  - Pillow before 3.3.2 allows context-dependent attackers     to execute arbitrary code by using the 'crafted image     file' approach, related to an 'Insecure Sign Extension'     issue affecting the ImagingNew in Storage.c     component.(CVE-2016-9190)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the python-pillow package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - Buffer overflow in the ImagingFliDecode function in     libImaging/FliDecode.c in Pillow before 3.1.1 allows     remote attackers to cause a denial of service (crash)     via a crafted FLI file.(CVE-2016-0775)

  - Buffer overflow in the ImagingLibTiffDecode function in     libImaging/TiffDecode.c in Pillow before 3.1.1 allows     remote attackers to overwrite memory via a crafted TIFF     file.(CVE-2016-0740)

  - Buffer overflow in the ImagingPcdDecode function in     PcdDecode.c in Pillow before 3.1.1 and Python Imaging     Library (PIL) 1.1.7 and earlier allows remote attackers     to cause a denial of service (crash) via a crafted     PhotoCD file.(CVE-2016-2533)

  - PIL/IcnsImagePlugin.py in Python Imaging Library (PIL)     and Pillow before 2.3.2 and 2.5.x before 2.5.2 allows     remote attackers to cause a denial of service via a     crafted block size.(CVE-2014-3589)

  - Pillow before 2.7.0 allows remote attackers to cause a     denial of service via a compressed text chunk in a PNG     image that has a large size when it is     decompressed.(CVE-2014-9601)

  - Pillow before 3.3.2 allows context-dependent attackers     to execute arbitrary code by using the 'crafted image     file' approach, related to an 'Insecure Sign Extension'     issue affecting the ImagingNew in Storage.c     component.(CVE-2016-9190)

  - Pillow before 3.3.2 allows context-dependent attackers     to obtain sensitive information by using the 'crafted     image file' approach, related to an 'Integer Overflow'     issue affecting the Image.core.map_buffer in map.c     component.(CVE-2016-9189)

  - Python Image Library (PIL) 1.1.7 and earlier and Pillow     2.3 might allow remote attackers to execute arbitrary     commands via shell metacharacters in unspecified     vectors related to CVE-2014-1932, possibly     JpegImagePlugin.py.(CVE-2014-3007)

  - The (1) JpegImagePlugin.py and (2) EpsImagePlugin.py     scripts in Python Image Library (PIL) 1.1.7 and earlier     and Pillow before 2.3.1 uses the names of temporary     files on the command line, which makes it easier for     local users to conduct symlink attacks by listing the     processes.(CVE-2014-1933)

  - The (1) load_djpeg function in JpegImagePlugin.py, (2)     Ghostscript function in EpsImagePlugin.py, (3) load     function in IptcImagePlugin.py, and (4) _copy function     in Image.py in Python Image Library (PIL) 1.1.7 and     earlier and Pillow before 2.3.1 do not properly create     temporary files, which allow local users to overwrite     arbitrary files and obtain sensitive information via a     symlink attack on the temporary file.(CVE-2014-1932)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	名稱	產品	系列	已發布	已更新	嚴重性
80747	Oracle Solaris Third-Party Patch Update : py_pil (cve_2014_3589_input_validation)	Nessus	Solaris Local Security Checks	2015/1/19	2021/1/14	medium
77343	Debian DSA-3009-1 : python-imaging - security update	Nessus	Debian Local Security Checks	2014/8/23	2021/1/11	medium
82188	Debian DLA-41-1 : python-imaging security update	Nessus	Debian Local Security Checks	2015/3/26	2021/1/11	medium
218062	Linux Distros Unpatched Vulnerability : CVE-2014-3589	Nessus	Misc.	2025/3/4	2025/9/3	high
131591	EulerOS 2.0 SP2 : python-pillow (EulerOS-SA-2019-2437)	Nessus	Huawei Local Security Checks	2019/12/4	2024/4/8	high
132189	EulerOS 2.0 SP3 : python-pillow (EulerOS-SA-2019-2654)	Nessus	Huawei Local Security Checks	2019/12/18	2024/4/3	high

偵測

搜尋 Plugin

medium

medium

medium

high

high

high