CVE-2016-0775

What it actually does

A buffer overflow vulnerability exists in the `ImagingFliDecode` function within the Pillow library. When parsing a specially crafted FLI/FLC image file, the function can write data beyond the boundaries of an allocated buffer. This memory corruption leads to a process crash, resulting in a denial of service.

Why it matters to the business

Applications using the vulnerable Pillow library to process images, particularly those that handle user-uploaded content, can be forced to crash by a remote attacker. This can lead to service unavailability and disruption of business operations that rely on image processing workflows, such as user profile updates, content management systems, or data analysis pipelines.

How an attack unfolds

An attacker crafts a malicious FLI or FLC image file containing data that triggers a buffer overflow. The attacker then uploads this file to a web application or service that uses a vulnerable version of the Pillow library for backend image processing (e.g., thumbnail generation, format conversion). When the application attempts to process the malicious file, the `ImagingFliDecode` function overflows a buffer, causing the application process to crash, thereby achieving a denial of service against the service.

How to fix it

Upgrade the Pillow library to version 3.1.1 or later. For systems using `python-pillow/pillow` from GIT, update to a version including commit `893a40850c2d5da41537958e40569c029a6e127b` or later. If an immediate upgrade is not possible, consider implementing input validation to block files with `.fli` or `.flc` extensions from being processed by the library as a temporary mitigation.

How to confirm the fix worked

To validate the fix, check the installed version of the Pillow library in your environment using the appropriate package manager (e.g., `pip show Pillow`). Ensure the version is 3.1.1 or higher. You can also perform a security test by obtaining or creating a proof-of-concept (PoC) FLI file and attempting to process it with the application in a non-production environment. A patched system will handle the file without crashing, likely by raising an error, while a vulnerable system will crash.

Typical attack path

1. An attacker creates a malicious FLI or FLC image file designed to cause a buffer overflow.
2. The attacker identifies a target application that accepts image uploads and uses a vulnerable version of the Pillow library.
3. The attacker submits the malicious image file to the application through a standard file upload feature.
4. The backend application receives the file and passes it to the Pillow library for processing.
5. The library's vulnerable `ImagingFliDecode` function attempts to decode the file, triggers the overflow, and causes the entire process to crash.

How to detect it

To detect potential exploitation, review application and system logs for unexpected crashes, segmentation faults, or unhandled exceptions in processes responsible for image processing. Correlate these crashes with the processing of files having `.fli` or `.flc` extensions. If core dumps are enabled, analyzing a crash dump may reveal memory corruption originating from the `ImagingFliDecode` function within the Pillow library.

• file.extension:.fli
• file.extension:.flc
• symbol:ImagingFliDecode

What your security team should do

• Immediately upgrade all instances of the Pillow library to version 3.1.1 or newer, prioritizing public-facing applications that process user-submitted images.
• Use software composition analysis (SCA) tools to scan your codebase and dependencies to identify all projects utilizing vulnerable versions of Pillow.
• If patching is delayed, configure application firewalls or file upload logic to reject files with `.fli` and `.flc` extensions to prevent them from reaching the vulnerable code path.