CVE catalog
CVE-2016-0775
pillow: CVE-2016-0775
- Severity
- Medium · CVSS 6.5
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H - Published
- Source
- [NVD] · [CVE record]
- EPSS
- 2.52% · Oct 25, 2026
Buffer overflow in the ImagingFliDecode function in libImaging/FliDecode.c in Pillow before 3.1.1 allows remote attackers to cause a denial of service (crash) via a crafted FLI file.
Vulnerable and fixed packages
Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.
| Distribution | Package | Release | Version | Status |
|---|---|---|---|---|
| Debian | pillow | sid | 13.0.0-1 | fixed |
| Debian | pillow | forky | 12.3.0-1 | fixed |
| Debian | pillow | trixie | 11.1.0-5+deb13u4 | fixed |
| Debian | pillow | trixie-security | 11.1.0-5+deb13u3 | fixed |
| Debian | pillow | bookworm | 9.4.0-1.1+deb12u1 | fixed |
| Debian | pillow | bookworm-security | 9.4.0-1.1+deb12u1 | fixed |
| Suse | python-Pillow | enterprise storage 5 | 2.8.1-3.9.1 | fixed |
| Suse | ansible | openstack cloud 7 | 2.2.3.0-17.2 | fixed |
| Suse | crowbar-core | openstack cloud 7 | 4.0+git.1600767499.0615a418f-9.69.3 | fixed |
| Suse | crowbar-openstack | openstack cloud 7 | 4.0+git.1599037255.25b759234-9.74.4 | fixed |
| Suse | grafana | openstack cloud 7 | 6.7.4-1.17.1 | fixed |
| Suse | grafana-natel-discrete-panel | openstack cloud 7 | 0.0.9-1.6.5 | fixed |
| Suse | openstack-aodh | openstack cloud 7 | 3.0.5~dev2-2.11.2 | fixed |
| Suse | openstack-aodh-doc | openstack cloud 7 | 3.0.5~dev2-2.11.1 | fixed |
| Suse | openstack-barbican | openstack cloud 7 | 3.0.1~dev9-2.12.4 | fixed |
| Suse | openstack-barbican-doc | openstack cloud 7 | 3.0.1~dev9-2.12.2 | fixed |
| Suse | openstack-cinder | openstack cloud 7 | 9.1.5~dev6-4.28.1 | fixed |
| Suse | openstack-cinder-doc | openstack cloud 7 | 9.1.5~dev6-4.28.1 | fixed |
| Suse | openstack-gnocchi | openstack cloud 7 | 3.0.7~dev1-2.8.2 | fixed |
| Suse | openstack-heat | openstack cloud 7 | 7.0.7~dev10-5.17.3 | fixed |
| Suse | openstack-heat-doc | openstack cloud 7 | 7.0.7~dev10-5.17.2 | fixed |
| Suse | openstack-ironic | openstack cloud 7 | 6.2.5~dev3-2.8.2 | fixed |
| Suse | openstack-ironic-doc | openstack cloud 7 | 6.2.5~dev3-2.8.2 | fixed |
| Suse | openstack-magnum | openstack cloud 7 | 3.3.2~dev7-14.14.4 | fixed |
| Suse | openstack-magnum-doc | openstack cloud 7 | 3.3.2~dev7-14.14.2 | fixed |
| Suse | openstack-manila | openstack cloud 7 | 3.0.1~dev30-4.17.2 | fixed |
| Suse | openstack-manila-doc | openstack cloud 7 | 3.0.1~dev30-4.17.1 | fixed |
| Suse | openstack-monasca-agent | openstack cloud 7 | 1.10.1~dev4-13.3 | fixed |
| Suse | openstack-murano | openstack cloud 7 | 3.0.1~dev21-7.5.3 | fixed |
| Suse | openstack-murano-doc | openstack cloud 7 | 3.0.1~dev21-7.5.1 | fixed |
| Suse | openstack-neutron | openstack cloud 7 | 9.4.2~dev21-7.43.2 | fixed |
| Suse | openstack-neutron-doc | openstack cloud 7 | 9.4.2~dev21-7.43.1 | fixed |
| Suse | openstack-neutron-vpnaas | openstack cloud 7 | 9.0.1~dev8-5.8.2 | fixed |
| Suse | openstack-neutron-vpnaas-doc | openstack cloud 7 | 9.0.1~dev8-5.8.2 | fixed |
| Suse | openstack-nova | openstack cloud 7 | 14.0.11~dev13-4.45.3 | fixed |
| Suse | openstack-nova-doc | openstack cloud 7 | 14.0.11~dev13-4.45.2 | fixed |
| Suse | openstack-sahara | openstack cloud 7 | 5.0.2~dev3-14.3 | fixed |
| Suse | openstack-sahara-doc | openstack cloud 7 | 5.0.2~dev3-14.1 | fixed |
| Suse | python-Pillow | openstack cloud 7 | 2.8.1-4.17.2 | fixed |
| Suse | rubygem-crowbar-client | openstack cloud 7 | 3.9.3-7.23.1 | fixed |
| Ubuntu | pillow | 14.04 | 2.2.1-1ubuntu2 | vulnerable |
| Ubuntu | pillow | 14.04 | 2.2.1-2ubuntu1 | vulnerable |
| Ubuntu | pillow | 14.04 | 2.2.1-3ubuntu2 | vulnerable |
| Ubuntu | pillow | 14.04 | 2.2.1-3ubuntu3 | vulnerable |
| Ubuntu | pillow | 14.04 | 2.2.1-3ubuntu4 | vulnerable |
| Ubuntu | pillow | 14.04 | 2.2.1-3ubuntu6 | vulnerable |
| Ubuntu | pillow | 14.04 | 2.3.0-1ubuntu1 | vulnerable |
| Ubuntu | pillow | 14.04 | 2.3.0-1ubuntu2 | vulnerable |
| Ubuntu | pillow | 14.04 | 2.3.0-1ubuntu3 | vulnerable |
| Ubuntu | pillow | 14.04 | 2.3.0-1ubuntu3.2 | fixed |
Fixed-version evidence
| Distribution | Package | Type | Release | Fixed version | Urgency | Origin | Bugs |
|---|---|---|---|---|---|---|---|
| Debian | pillow | source | sid | 3.1.1-1 | not yet assigned | Not reported | [813909] |
| Debian | pillow | source | forky | 3.1.1-1 | not yet assigned | Not reported | [813909] |
| Debian | pillow | source | trixie | 3.1.1-1 | not yet assigned | Not reported | [813909] |
| Debian | pillow | source | bookworm | 3.1.1-1 | not yet assigned | Not reported | [813909] |
| Suse | python-Pillow | rpm | enterprise storage 5 | 2.8.1-3.9.1 | Not reported | SUSE-SU-2020:2057-1 | Not reported |
| Suse | ansible | rpm | openstack cloud 7 | 2.2.3.0-17.2 | Not reported | SUSE-SU-2020:2911-1 | Not reported |
| Suse | crowbar-core | rpm | openstack cloud 7 | 4.0+git.1600767499.0615a418f-9.69.3 | Not reported | SUSE-SU-2020:2911-1 | Not reported |
| Suse | crowbar-openstack | rpm | openstack cloud 7 | 4.0+git.1599037255.25b759234-9.74.4 | Not reported | SUSE-SU-2020:2911-1 | Not reported |
| Suse | grafana | rpm | openstack cloud 7 | 6.7.4-1.17.1 | Not reported | SUSE-SU-2020:2911-1 | Not reported |
| Suse | grafana-natel-discrete-panel | rpm | openstack cloud 7 | 0.0.9-1.6.5 | Not reported | SUSE-SU-2020:2911-1 | Not reported |
| Suse | openstack-aodh | rpm | openstack cloud 7 | 3.0.5~dev2-2.11.2 | Not reported | SUSE-SU-2020:2911-1 | Not reported |
| Suse | openstack-aodh-doc | rpm | openstack cloud 7 | 3.0.5~dev2-2.11.1 | Not reported | SUSE-SU-2020:2911-1 | Not reported |
| Suse | openstack-barbican | rpm | openstack cloud 7 | 3.0.1~dev9-2.12.4 | Not reported | SUSE-SU-2020:2911-1 | Not reported |
| Suse | openstack-barbican-doc | rpm | openstack cloud 7 | 3.0.1~dev9-2.12.2 | Not reported | SUSE-SU-2020:2911-1 | Not reported |
| Suse | openstack-cinder | rpm | openstack cloud 7 | 9.1.5~dev6-4.28.1 | Not reported | SUSE-SU-2020:2911-1 | Not reported |
| Suse | openstack-cinder-doc | rpm | openstack cloud 7 | 9.1.5~dev6-4.28.1 | Not reported | SUSE-SU-2020:2911-1 | Not reported |
| Suse | openstack-gnocchi | rpm | openstack cloud 7 | 3.0.7~dev1-2.8.2 | Not reported | SUSE-SU-2020:2911-1 | Not reported |
| Suse | openstack-heat | rpm | openstack cloud 7 | 7.0.7~dev10-5.17.3 | Not reported | SUSE-SU-2020:2911-1 | Not reported |
| Suse | openstack-heat-doc | rpm | openstack cloud 7 | 7.0.7~dev10-5.17.2 | Not reported | SUSE-SU-2020:2911-1 | Not reported |
| Suse | openstack-ironic | rpm | openstack cloud 7 | 6.2.5~dev3-2.8.2 | Not reported | SUSE-SU-2020:2911-1 | Not reported |
| Suse | openstack-ironic-doc | rpm | openstack cloud 7 | 6.2.5~dev3-2.8.2 | Not reported | SUSE-SU-2020:2911-1 | Not reported |
| Suse | openstack-magnum | rpm | openstack cloud 7 | 3.3.2~dev7-14.14.4 | Not reported | SUSE-SU-2020:2911-1 | Not reported |
| Suse | openstack-magnum-doc | rpm | openstack cloud 7 | 3.3.2~dev7-14.14.2 | Not reported | SUSE-SU-2020:2911-1 | Not reported |
| Suse | openstack-manila | rpm | openstack cloud 7 | 3.0.1~dev30-4.17.2 | Not reported | SUSE-SU-2020:2911-1 | Not reported |
| Suse | openstack-manila-doc | rpm | openstack cloud 7 | 3.0.1~dev30-4.17.1 | Not reported | SUSE-SU-2020:2911-1 | Not reported |
| Suse | openstack-monasca-agent | rpm | openstack cloud 7 | 1.10.1~dev4-13.3 | Not reported | SUSE-SU-2020:2911-1 | Not reported |
| Suse | openstack-murano | rpm | openstack cloud 7 | 3.0.1~dev21-7.5.3 | Not reported | SUSE-SU-2020:2911-1 | Not reported |
| Suse | openstack-murano-doc | rpm | openstack cloud 7 | 3.0.1~dev21-7.5.1 | Not reported | SUSE-SU-2020:2911-1 | Not reported |
| Suse | openstack-neutron | rpm | openstack cloud 7 | 9.4.2~dev21-7.43.2 | Not reported | SUSE-SU-2020:2911-1 | Not reported |
| Suse | openstack-neutron-doc | rpm | openstack cloud 7 | 9.4.2~dev21-7.43.1 | Not reported | SUSE-SU-2020:2911-1 | Not reported |
| Suse | openstack-neutron-vpnaas | rpm | openstack cloud 7 | 9.0.1~dev8-5.8.2 | Not reported | SUSE-SU-2020:2911-1 | Not reported |
| Suse | openstack-neutron-vpnaas-doc | rpm | openstack cloud 7 | 9.0.1~dev8-5.8.2 | Not reported | SUSE-SU-2020:2911-1 | Not reported |
| Suse | openstack-nova | rpm | openstack cloud 7 | 14.0.11~dev13-4.45.3 | Not reported | SUSE-SU-2020:2911-1 | Not reported |
| Suse | openstack-nova-doc | rpm | openstack cloud 7 | 14.0.11~dev13-4.45.2 | Not reported | SUSE-SU-2020:2911-1 | Not reported |
| Suse | openstack-sahara | rpm | openstack cloud 7 | 5.0.2~dev3-14.3 | Not reported | SUSE-SU-2020:2911-1 | Not reported |
| Suse | openstack-sahara-doc | rpm | openstack cloud 7 | 5.0.2~dev3-14.1 | Not reported | SUSE-SU-2020:2911-1 | Not reported |
| Suse | python-Pillow | rpm | openstack cloud 7 | 2.8.1-4.17.2 | Not reported | SUSE-SU-2020:2911-1 | Not reported |
| Suse | rubygem-crowbar-client | rpm | openstack cloud 7 | 3.9.3-7.23.1 | Not reported | SUSE-SU-2020:2911-1 | Not reported |
| Ubuntu | pillow | deb | 14.04 | 2.3.0-1ubuntu3.2 | Not reported | UBUNTU-CVE-2016-0775 | Not reported |
OpenFactory catalog packages
Matching against OpenFactory catalog package versions is in progress.
[Debian 12 (Bookworm)]
- [python3-pil]Unknown
Source package: [pillow]
Details (4)
9.4.0-1.1+deb12u1· amd64 · bookwormFixed · Fixed:
3.1.1-1dsa · pillow · debian · bookworm; dsa · pillow · debian · 12
9.4.0-1.1+deb12u1· arm64 · bookwormFixed · Fixed:
3.1.1-1dsa · pillow · debian · bookworm; dsa · pillow · debian · 12
9.4.0-1.1+deb12u1· amd64 · bookworm-securityFixed · Fixed:
3.1.1-1dsa · pillow · debian · bookworm; dsa · pillow · debian · 12
9.4.0-1.1+deb12u1· arm64 · bookworm-securityFixed · Fixed:
3.1.1-1dsa · pillow · debian · bookworm; dsa · pillow · debian · 12
- [python3-pil.imagetk]Unknown
Source package: [pillow]
Details (4)
9.4.0-1.1+deb12u1· amd64 · bookwormFixed · Fixed:
3.1.1-1dsa · pillow · debian · bookworm; dsa · pillow · debian · 12
9.4.0-1.1+deb12u1· arm64 · bookwormFixed · Fixed:
3.1.1-1dsa · pillow · debian · bookworm; dsa · pillow · debian · 12
9.4.0-1.1+deb12u1· amd64 · bookworm-securityFixed · Fixed:
3.1.1-1dsa · pillow · debian · bookworm; dsa · pillow · debian · 12
9.4.0-1.1+deb12u1· arm64 · bookworm-securityFixed · Fixed:
3.1.1-1dsa · pillow · debian · bookworm; dsa · pillow · debian · 12
- [python-pil-doc]Unknown
Source package: [pillow]
Details (4)
9.4.0-1.1+deb12u1· all · bookwormFixed · Fixed:
3.1.1-1dsa · pillow · debian · bookworm; dsa · pillow · debian · 12
9.4.0-1.1+deb12u1· all · bookwormFixed · Fixed:
3.1.1-1dsa · pillow · debian · bookworm; dsa · pillow · debian · 12
9.4.0-1.1+deb12u1· all · bookworm-securityFixed · Fixed:
3.1.1-1dsa · pillow · debian · bookworm; dsa · pillow · debian · 12
9.4.0-1.1+deb12u1· all · bookworm-securityFixed · Fixed:
3.1.1-1dsa · pillow · debian · bookworm; dsa · pillow · debian · 12
[Debian 13 (Trixie)]
- [python3-pil]Unknown
Source package: [pillow]
Details (4)
11.1.0-5+deb13u4· amd64 · trixieFixed · Fixed:
3.1.1-1dsa · pillow · debian · 13
11.1.0-5+deb13u4· arm64 · trixieFixed · Fixed:
3.1.1-1dsa · pillow · debian · 13
11.1.0-5+deb13u3· amd64 · trixie-securityFixed · Fixed:
3.1.1-1dsa · pillow · debian · 13
11.1.0-5+deb13u3· arm64 · trixie-securityFixed · Fixed:
3.1.1-1dsa · pillow · debian · 13
- [python3-pil.imagetk]Unknown
Source package: [pillow]
Details (4)
11.1.0-5+deb13u4· amd64 · trixieFixed · Fixed:
3.1.1-1dsa · pillow · debian · 13
11.1.0-5+deb13u4· arm64 · trixieFixed · Fixed:
3.1.1-1dsa · pillow · debian · 13
11.1.0-5+deb13u3· amd64 · trixie-securityFixed · Fixed:
3.1.1-1dsa · pillow · debian · 13
11.1.0-5+deb13u3· arm64 · trixie-securityFixed · Fixed:
3.1.1-1dsa · pillow · debian · 13
- [python-pil-doc]Unknown
Source package: [pillow]
Details (4)
11.1.0-5+deb13u4· all · trixieFixed · Fixed:
3.1.1-1dsa · pillow · debian · 13
11.1.0-5+deb13u4· all · trixieFixed · Fixed:
3.1.1-1dsa · pillow · debian · 13
11.1.0-5+deb13u3· all · trixie-securityFixed · Fixed:
3.1.1-1dsa · pillow · debian · 13
11.1.0-5+deb13u3· all · trixie-securityFixed · Fixed:
3.1.1-1dsa · pillow · debian · 13
Observed:
References
- [https://ftp.suse.com/pub/projects/security/csaf/opensuse-su-2026_11261-1.json]
- [https://osv.dev/vulnerability/DEBIAN-CVE-2016-0775]
- [https://osv.dev/vulnerability/DLA-422-1]
- [https://osv.dev/vulnerability/SUSE-SU-2020:2057-1]
- [https://osv.dev/vulnerability/SUSE-SU-2020:2911-1]
- [https://osv.dev/vulnerability/UBUNTU-CVE-2016-0775]
- [https://security-tracker.debian.org/tracker/CVE-2016-0775]
- [https://wid.cert-bund.de/.well-known/csaf/white/2016/wid-sec-w-2024-0426.json]
[CERT-Bund public advisories] · [Debian Security Tracker] · [FIRST EPSS] · [OSV Package Vulnerability Database] · [SUSE security advisories and VEX]