Search for vulnerabilities
Vulnerability details: VCID-9hys-qqgb-aaan
Vulnerability ID VCID-9hys-qqgb-aaan
Aliases CVE-2016-2533
GHSA-3c5c-7235-994j
PYSEC-2016-19
Summary Buffer overflow in ImagingPcdDecode Buffer overflow in the `ImagingPcdDecode` function in `PcdDecode.c` allows remote attackers to cause a denial of service (crash) via a crafted PhotoCD file.
Status Published
Exploitability 0.5
Weighted Severity 9.0
Risk 4.5
Affected and Fixed Packages Package Details
Weaknesses (5)
CWE-119 Improper Restriction of Operations within the Bounds of a Memory Buffer
CWE-1035 OWASP Top Ten 2017 Category A9 - Using Components with Known Vulnerabilities
CWE-937 OWASP Top Ten 2013 Category A9 - Using Components with Known Vulnerabilities
CWE-122 Heap-based Buffer Overflow
CWE-787 Out-of-bounds Write
System Score Found at
generic_textual Medium http://people.canonical.com/~ubuntu-security/cve/2016/CVE-2016-2533.html
epss 0.02207 https://api.first.org/data/v1/epss?cve=CVE-2016-2533
epss 0.02207 https://api.first.org/data/v1/epss?cve=CVE-2016-2533
epss 0.02207 https://api.first.org/data/v1/epss?cve=CVE-2016-2533
epss 0.02207 https://api.first.org/data/v1/epss?cve=CVE-2016-2533
epss 0.02207 https://api.first.org/data/v1/epss?cve=CVE-2016-2533
epss 0.02207 https://api.first.org/data/v1/epss?cve=CVE-2016-2533
epss 0.02207 https://api.first.org/data/v1/epss?cve=CVE-2016-2533
epss 0.02207 https://api.first.org/data/v1/epss?cve=CVE-2016-2533
epss 0.02207 https://api.first.org/data/v1/epss?cve=CVE-2016-2533
epss 0.02207 https://api.first.org/data/v1/epss?cve=CVE-2016-2533
epss 0.02207 https://api.first.org/data/v1/epss?cve=CVE-2016-2533
epss 0.02207 https://api.first.org/data/v1/epss?cve=CVE-2016-2533
epss 0.02207 https://api.first.org/data/v1/epss?cve=CVE-2016-2533
epss 0.02207 https://api.first.org/data/v1/epss?cve=CVE-2016-2533
epss 0.02207 https://api.first.org/data/v1/epss?cve=CVE-2016-2533
epss 0.02207 https://api.first.org/data/v1/epss?cve=CVE-2016-2533
epss 0.02207 https://api.first.org/data/v1/epss?cve=CVE-2016-2533
epss 0.02207 https://api.first.org/data/v1/epss?cve=CVE-2016-2533
epss 0.02207 https://api.first.org/data/v1/epss?cve=CVE-2016-2533
epss 0.02207 https://api.first.org/data/v1/epss?cve=CVE-2016-2533
epss 0.02207 https://api.first.org/data/v1/epss?cve=CVE-2016-2533
epss 0.02207 https://api.first.org/data/v1/epss?cve=CVE-2016-2533
epss 0.02207 https://api.first.org/data/v1/epss?cve=CVE-2016-2533
epss 0.02207 https://api.first.org/data/v1/epss?cve=CVE-2016-2533
epss 0.02207 https://api.first.org/data/v1/epss?cve=CVE-2016-2533
epss 0.02207 https://api.first.org/data/v1/epss?cve=CVE-2016-2533
epss 0.02207 https://api.first.org/data/v1/epss?cve=CVE-2016-2533
epss 0.02207 https://api.first.org/data/v1/epss?cve=CVE-2016-2533
epss 0.02207 https://api.first.org/data/v1/epss?cve=CVE-2016-2533
epss 0.02207 https://api.first.org/data/v1/epss?cve=CVE-2016-2533
epss 0.02207 https://api.first.org/data/v1/epss?cve=CVE-2016-2533
epss 0.02207 https://api.first.org/data/v1/epss?cve=CVE-2016-2533
epss 0.02207 https://api.first.org/data/v1/epss?cve=CVE-2016-2533
epss 0.02207 https://api.first.org/data/v1/epss?cve=CVE-2016-2533
epss 0.02207 https://api.first.org/data/v1/epss?cve=CVE-2016-2533
epss 0.02207 https://api.first.org/data/v1/epss?cve=CVE-2016-2533
epss 0.02207 https://api.first.org/data/v1/epss?cve=CVE-2016-2533
epss 0.02207 https://api.first.org/data/v1/epss?cve=CVE-2016-2533
epss 0.02207 https://api.first.org/data/v1/epss?cve=CVE-2016-2533
epss 0.02207 https://api.first.org/data/v1/epss?cve=CVE-2016-2533
epss 0.02207 https://api.first.org/data/v1/epss?cve=CVE-2016-2533
epss 0.02207 https://api.first.org/data/v1/epss?cve=CVE-2016-2533
epss 0.02207 https://api.first.org/data/v1/epss?cve=CVE-2016-2533
epss 0.02207 https://api.first.org/data/v1/epss?cve=CVE-2016-2533
epss 0.02207 https://api.first.org/data/v1/epss?cve=CVE-2016-2533
epss 0.02207 https://api.first.org/data/v1/epss?cve=CVE-2016-2533
epss 0.02207 https://api.first.org/data/v1/epss?cve=CVE-2016-2533
epss 0.02207 https://api.first.org/data/v1/epss?cve=CVE-2016-2533
epss 0.02207 https://api.first.org/data/v1/epss?cve=CVE-2016-2533
epss 0.02207 https://api.first.org/data/v1/epss?cve=CVE-2016-2533
epss 0.02207 https://api.first.org/data/v1/epss?cve=CVE-2016-2533
epss 0.02207 https://api.first.org/data/v1/epss?cve=CVE-2016-2533
epss 0.02207 https://api.first.org/data/v1/epss?cve=CVE-2016-2533
epss 0.02207 https://api.first.org/data/v1/epss?cve=CVE-2016-2533
epss 0.02207 https://api.first.org/data/v1/epss?cve=CVE-2016-2533
epss 0.02207 https://api.first.org/data/v1/epss?cve=CVE-2016-2533
epss 0.02207 https://api.first.org/data/v1/epss?cve=CVE-2016-2533
epss 0.02207 https://api.first.org/data/v1/epss?cve=CVE-2016-2533
epss 0.02207 https://api.first.org/data/v1/epss?cve=CVE-2016-2533
epss 0.02207 https://api.first.org/data/v1/epss?cve=CVE-2016-2533
epss 0.02207 https://api.first.org/data/v1/epss?cve=CVE-2016-2533
epss 0.02207 https://api.first.org/data/v1/epss?cve=CVE-2016-2533
epss 0.02207 https://api.first.org/data/v1/epss?cve=CVE-2016-2533
epss 0.02207 https://api.first.org/data/v1/epss?cve=CVE-2016-2533
epss 0.02207 https://api.first.org/data/v1/epss?cve=CVE-2016-2533
epss 0.06109 https://api.first.org/data/v1/epss?cve=CVE-2016-2533
epss 0.06109 https://api.first.org/data/v1/epss?cve=CVE-2016-2533
epss 0.06109 https://api.first.org/data/v1/epss?cve=CVE-2016-2533
epss 0.06109 https://api.first.org/data/v1/epss?cve=CVE-2016-2533
epss 0.07288 https://api.first.org/data/v1/epss?cve=CVE-2016-2533
epss 0.07288 https://api.first.org/data/v1/epss?cve=CVE-2016-2533
epss 0.07288 https://api.first.org/data/v1/epss?cve=CVE-2016-2533
epss 0.07288 https://api.first.org/data/v1/epss?cve=CVE-2016-2533
epss 0.07288 https://api.first.org/data/v1/epss?cve=CVE-2016-2533
epss 0.07288 https://api.first.org/data/v1/epss?cve=CVE-2016-2533
epss 0.07288 https://api.first.org/data/v1/epss?cve=CVE-2016-2533
epss 0.07288 https://api.first.org/data/v1/epss?cve=CVE-2016-2533
epss 0.07288 https://api.first.org/data/v1/epss?cve=CVE-2016-2533
epss 0.07288 https://api.first.org/data/v1/epss?cve=CVE-2016-2533
epss 0.07288 https://api.first.org/data/v1/epss?cve=CVE-2016-2533
epss 0.11451 https://api.first.org/data/v1/epss?cve=CVE-2016-2533
rhbs medium https://bugzilla.redhat.com/show_bug.cgi?id=1304504
generic_textual Medium https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-0740
generic_textual Medium https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-0775
generic_textual Medium https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-2533
cvssv2 5.1 https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml
cvssv3.1_qr MODERATE https://github.com/advisories/GHSA-3c5c-7235-994j
cvssv3.1 6.5 https://github.com/pypa/advisory-database/tree/main/vulns/pillow/PYSEC-2016-19.yaml
generic_textual HIGH https://github.com/pypa/advisory-database/tree/main/vulns/pillow/PYSEC-2016-19.yaml
cvssv3.1 6.7 https://github.com/python-pillow/Pillow
generic_textual MODERATE https://github.com/python-pillow/Pillow
cvssv3.1 9.8 https://github.com/python-pillow/Pillow/blob/c3cb690fed5d4bf0c45576759de55d054916c165/CHANGES.rst
generic_textual CRITICAL https://github.com/python-pillow/Pillow/blob/c3cb690fed5d4bf0c45576759de55d054916c165/CHANGES.rst
cvssv3.1 6.5 https://github.com/python-pillow/Pillow/blob/c3cb690fed5d4bf0c45576759de55d054916c165/CHANGES.rst?plain=1#L53
generic_textual HIGH https://github.com/python-pillow/Pillow/blob/c3cb690fed5d4bf0c45576759de55d054916c165/CHANGES.rst?plain=1#L53
cvssv3.1 6.5 https://github.com/python-pillow/Pillow/commit/5bdf54b5a76b54fb00bd05f2d733e0a4173eefc9#diff-8ff6909c159597e22288ad818938fd6b
generic_textual HIGH https://github.com/python-pillow/Pillow/commit/5bdf54b5a76b54fb00bd05f2d733e0a4173eefc9#diff-8ff6909c159597e22288ad818938fd6b
generic_textual Medium https://github.com/python-pillow/Pillow/commit/ae453aa18b66af54e7ff716f4ccb33adca60afd4
cvssv3.1 6.5 https://github.com/python-pillow/Pillow/commit/ae453aa18b66af54e7ff716f4ccb33adca60afd4#diff-8ff6909c159597e22288ad818938fd6b
generic_textual HIGH https://github.com/python-pillow/Pillow/commit/ae453aa18b66af54e7ff716f4ccb33adca60afd4#diff-8ff6909c159597e22288ad818938fd6b
cvssv3.1 6.5 https://github.com/python-pillow/Pillow/pull/1706
generic_textual HIGH https://github.com/python-pillow/Pillow/pull/1706
cvssv2 4.3 https://nvd.nist.gov/vuln/detail/CVE-2016-2533
cvssv3 6.5 https://nvd.nist.gov/vuln/detail/CVE-2016-2533
cvssv3.1 7.8 https://security.gentoo.org/glsa/201612-52
generic_textual HIGH https://security.gentoo.org/glsa/201612-52
generic_textual Medium https://ubuntu.com/security/notices/USN-3080-1
cvssv3.1 6.5 http://www.debian.org/security/2016/dsa-3499
generic_textual HIGH http://www.debian.org/security/2016/dsa-3499
cvssv3.1 6.5 http://www.openwall.com/lists/oss-security/2016/02/02/5
generic_textual HIGH http://www.openwall.com/lists/oss-security/2016/02/02/5
cvssv3.1 6.5 http://www.openwall.com/lists/oss-security/2016/02/22/2
generic_textual HIGH http://www.openwall.com/lists/oss-security/2016/02/22/2
cvssv3.1 6.5 http://www.oracle.com/technetwork/topics/security/bulletinjan2016-2867206.html
generic_textual HIGH http://www.oracle.com/technetwork/topics/security/bulletinjan2016-2867206.html
Reference id Reference type URL
http://people.canonical.com/~ubuntu-security/cve/2016/CVE-2016-2533.html
https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2016-2533.json
https://api.first.org/data/v1/epss?cve=CVE-2016-2533
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-0740
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-0775
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-2533
https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml
https://github.com/pypa/advisory-database/tree/main/vulns/pillow/PYSEC-2016-19.yaml
https://github.com/python-pillow/Pillow
https://github.com/python-pillow/Pillow/blob/c3cb690fed5d4bf0c45576759de55d054916c165/CHANGES.rst
https://github.com/python-pillow/Pillow/blob/c3cb690fed5d4bf0c45576759de55d054916c165/CHANGES.rst?plain=1#L53
https://github.com/python-pillow/Pillow/commit/5bdf54b5a76b54fb00bd05f2d733e0a4173eefc9
https://github.com/python-pillow/Pillow/commit/5bdf54b5a76b54fb00bd05f2d733e0a4173eefc9#diff-8ff6909c159597e22288ad818938fd6b
https://github.com/python-pillow/Pillow/commit/ae453aa18b66af54e7ff716f4ccb33adca60afd4
https://github.com/python-pillow/Pillow/commit/ae453aa18b66af54e7ff716f4ccb33adca60afd4#diff-8ff6909c159597e22288ad818938fd6b
https://github.com/python-pillow/Pillow/issues/568
https://github.com/python-pillow/Pillow/pull/1706
https://security.gentoo.org/glsa/201612-52
https://ubuntu.com/security/notices/USN-3080-1
http://www.debian.org/security/2016/dsa-3499
http://www.openwall.com/lists/oss-security/2016/02/02/5
http://www.openwall.com/lists/oss-security/2016/02/22/2
http://www.oracle.com/technetwork/topics/security/bulletinjan2016-2867206.html
1304504 https://bugzilla.redhat.com/show_bug.cgi?id=1304504
cpe:2.3:a:python_imaging_project:python_imaging:*:*:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:python_imaging_project:python_imaging:*:*:*:*:*:*:*:*
cpe:2.3:a:python:pillow:*:*:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:python:pillow:*:*:*:*:*:*:*:*
cpe:2.3:o:debian:debian_linux:7.0:*:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:o:debian:debian_linux:7.0:*:*:*:*:*:*:*
cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*
CVE-2016-2533 https://nvd.nist.gov/vuln/detail/CVE-2016-2533
CVE-2016-2533 http://www.cvedetails.com/cve/CVE-2016-2533/
GHSA-3c5c-7235-994j https://github.com/advisories/GHSA-3c5c-7235-994j
USN-3080-1 https://usn.ubuntu.com/3080-1/
USN-3090-1 https://usn.ubuntu.com/3090-1/
No exploits are available.
Vector: AV:N/AC:H/Au:N/C:P/I:P/A:P Found at https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml
Exploitability (E) Access Vector (AV) Access Complexity (AC) Authentication (Au) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

high

functional

unproven

proof_of_concept

not_defined

local

adjacent_network

network

high

medium

low

multiple

single

none

none

partial

complete

none

partial

complete

none

partial

complete
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H Found at https://github.com/pypa/advisory-database/tree/main/vulns/pillow/PYSEC-2016-19.yaml
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H Found at https://github.com/python-pillow/Pillow
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H Found at https://github.com/python-pillow/Pillow/blob/c3cb690fed5d4bf0c45576759de55d054916c165/CHANGES.rst
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H Found at https://github.com/python-pillow/Pillow/blob/c3cb690fed5d4bf0c45576759de55d054916c165/CHANGES.rst?plain=1#L53
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H Found at https://github.com/python-pillow/Pillow/commit/5bdf54b5a76b54fb00bd05f2d733e0a4173eefc9#diff-8ff6909c159597e22288ad818938fd6b
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H Found at https://github.com/python-pillow/Pillow/commit/ae453aa18b66af54e7ff716f4ccb33adca60afd4#diff-8ff6909c159597e22288ad818938fd6b
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H Found at https://github.com/python-pillow/Pillow/pull/1706
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: AV:N/AC:M/Au:N/C:N/I:N/A:P Found at https://nvd.nist.gov/vuln/detail/CVE-2016-2533
Exploitability (E) Access Vector (AV) Access Complexity (AC) Authentication (Au) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

high

functional

unproven

proof_of_concept

not_defined

local

adjacent_network

network

high

medium

low

multiple

single

none

none

partial

complete

none

partial

complete

none

partial

complete
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H Found at https://nvd.nist.gov/vuln/detail/CVE-2016-2533
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H Found at https://security.gentoo.org/glsa/201612-52
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H Found at http://www.debian.org/security/2016/dsa-3499
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H Found at http://www.openwall.com/lists/oss-security/2016/02/02/5
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H Found at http://www.openwall.com/lists/oss-security/2016/02/22/2
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H Found at http://www.oracle.com/technetwork/topics/security/bulletinjan2016-2867206.html
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Exploit Prediction Scoring System (EPSS)
Percentile 0.82976
EPSS Score 0.02207
Published At March 28, 2025, 12:55 p.m.
Date Actor Action Source VulnerableCode Version
There are no relevant records.