Package Instance
Lookup for vulnerable packages by Package URL.
GET /api/packages/27780?format=api
{ "url": "http://public2.vulnerablecode.io/api/packages/27780?format=api", "purl": "pkg:pypi/pillow@9.1.0", "type": "pypi", "namespace": "", "name": "pillow", "version": "9.1.0", "qualifiers": {}, "subpath": "", "is_vulnerable": true, "next_non_vulnerable_version": "12.2.0", "latest_non_vulnerable_version": "12.2.0", "affected_by_vulnerabilities": [ { "url": "http://public2.vulnerablecode.io/api/vulnerabilities/37349?format=api", "vulnerability_id": "VCID-4tub-w66m-uyfu", "summary": "Pillow versions before v10.0.1 bundled libwebp binaries in wheels that are vulnerable to CVE-2023-5129 (previously CVE-2023-4863). Pillow v10.0.1 upgrades the bundled libwebp binary to v1.3.2.", "references": [ { "reference_url": "https://github.com/python-pillow/Pillow/blob/main/CHANGES.rst#1001-2023-09-15", "reference_id": "", "reference_type": "", "scores": [], "url": "https://github.com/python-pillow/Pillow/blob/main/CHANGES.rst#1001-2023-09-15" }, { "reference_url": "https://nvd.nist.gov/vuln/detail/CVE-2023-4863", "reference_id": "", "reference_type": "", "scores": [], "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-4863" }, { "reference_url": "https://nvd.nist.gov/vuln/detail/CVE-2023-5129", "reference_id": "", "reference_type": "", "scores": [], "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-5129" } ], "fixed_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/50048?format=api", "purl": "pkg:pypi/pillow@10.0.1", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-9hza-srk7-sucy" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:pypi/pillow@10.0.1" } ], "aliases": [ "PYSEC-2023-175" ], "risk_score": null, "exploitability": null, "weighted_severity": null, "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-4tub-w66m-uyfu" }, { "url": "http://public2.vulnerablecode.io/api/vulnerabilities/37317?format=api", "vulnerability_id": "VCID-9hza-srk7-sucy", "summary": "Pillow is a Python imaging library. Prior to version 12.2.0, if a font advances for each glyph by an exceeding large amount, when Pillow keeps track of the current position, it may lead to an integer overflow. This issue has been patched in version 12.2.0.", "references": [ { "reference_url": "https://github.com/python-pillow/Pillow/releases/tag/12.2.0", "reference_id": "", "reference_type": "", "scores": [ { "value": "5.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H" } ], "url": "https://github.com/python-pillow/Pillow/releases/tag/12.2.0" }, { "reference_url": "https://github.com/python-pillow/Pillow/security/advisories/GHSA-wjx4-4jcj-g98j", "reference_id": "", "reference_type": "", "scores": [ { "value": "5.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H" } ], "url": "https://github.com/python-pillow/Pillow/security/advisories/GHSA-wjx4-4jcj-g98j" } ], "fixed_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/50058?format=api", "purl": "pkg:pypi/pillow@12.2.0", "is_vulnerable": false, "affected_by_vulnerabilities": [], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:pypi/pillow@12.2.0" } ], "aliases": [ "CVE-2026-42308", "GHSA-wjx4-4jcj-g98j", "PYSEC-2026-165" ], "risk_score": null, "exploitability": null, "weighted_severity": null, "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-9hza-srk7-sucy" }, { "url": "http://public2.vulnerablecode.io/api/vulnerabilities/36096?format=api", "vulnerability_id": "VCID-q9xy-t4zu-zbf5", "summary": "libImaging/TgaRleDecode.c in Pillow 9.1.0 has a heap buffer overflow in the processing of invalid TGA image files.", "references": [ { "reference_url": "https://github.com/python-pillow/Pillow/blob/main/src/libImaging/TgaRleDecode.c", "reference_id": "", "reference_type": "", "scores": [ { "value": "9.8", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" } ], "url": "https://github.com/python-pillow/Pillow/blob/main/src/libImaging/TgaRleDecode.c" }, { "reference_url": "https://pillow.readthedocs.io/en/stable/releasenotes/9.1.1.html", "reference_id": "", "reference_type": "", "scores": [ { "value": "9.8", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" } ], "url": "https://pillow.readthedocs.io/en/stable/releasenotes/9.1.1.html" } ], "fixed_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/27781?format=api", "purl": "pkg:pypi/pillow@9.1.1", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-4tub-w66m-uyfu" }, { "vulnerability": "VCID-9hza-srk7-sucy" }, { "vulnerability": "VCID-vx7b-mwfx-5fg2" }, { "vulnerability": "VCID-x3bz-ehvb-jyfs" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:pypi/pillow@9.1.1" } ], "aliases": [ "CVE-2022-30595", "GHSA-hr8g-f6r6-mr22", "PYSEC-2022-43145" ], "risk_score": null, "exploitability": null, "weighted_severity": null, "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-q9xy-t4zu-zbf5" }, { "url": "http://public2.vulnerablecode.io/api/vulnerabilities/36309?format=api", "vulnerability_id": "VCID-vx7b-mwfx-5fg2", "summary": "Pillow before 9.2.0 performs Improper Handling of Highly Compressed GIF Data (Data Amplification).", "references": [ { "reference_url": "https://bugs.gentoo.org/855683", "reference_id": "", "reference_type": "", "scores": [], "url": "https://bugs.gentoo.org/855683" }, { "reference_url": "https://cwe.mitre.org/data/definitions/409.html", "reference_id": "", "reference_type": "", "scores": [], "url": "https://cwe.mitre.org/data/definitions/409.html" }, { "reference_url": "https://github.com/python-pillow/Pillow/commit/11918eac0628ec8ac0812670d9838361ead2d6a4", "reference_id": "", "reference_type": "", "scores": [], "url": "https://github.com/python-pillow/Pillow/commit/11918eac0628ec8ac0812670d9838361ead2d6a4" }, { "reference_url": "https://github.com/python-pillow/Pillow/pull/6402", "reference_id": "", "reference_type": "", "scores": [], "url": "https://github.com/python-pillow/Pillow/pull/6402" }, { "reference_url": "https://github.com/python-pillow/Pillow/releases/tag/9.2.0", "reference_id": "", "reference_type": "", "scores": [], "url": "https://github.com/python-pillow/Pillow/releases/tag/9.2.0" } ], "fixed_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/29762?format=api", "purl": "pkg:pypi/pillow@9.2.0", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-4tub-w66m-uyfu" }, { "vulnerability": "VCID-9hza-srk7-sucy" }, { "vulnerability": "VCID-q325-dhha-83b2" }, { "vulnerability": "VCID-x3bz-ehvb-jyfs" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:pypi/pillow@9.2.0" } ], "aliases": [ "CVE-2022-45198", "PYSEC-2022-42979" ], "risk_score": null, "exploitability": null, "weighted_severity": null, "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-vx7b-mwfx-5fg2" }, { "url": "http://public2.vulnerablecode.io/api/vulnerabilities/36600?format=api", "vulnerability_id": "VCID-x3bz-ehvb-jyfs", "summary": "An issue was discovered in Pillow before 10.0.0. It is a Denial of Service that uncontrollably allocates memory to process a given task, potentially causing a service to crash by having it run out of memory. This occurs for truetype in ImageFont when textlength in an ImageDraw instance operates on a long text argument.", "references": [ { "reference_url": "https://devhub.checkmarx.com/cve-details/CVE-2023-44271/", "reference_id": "", "reference_type": "", "scores": [], "url": "https://devhub.checkmarx.com/cve-details/CVE-2023-44271/" }, { "reference_url": "https://github.com/pypa/advisory-database/tree/main/vulns/pillow/PYSEC-2023-227.yaml", "reference_id": "", "reference_type": "", "scores": [], "url": "https://github.com/pypa/advisory-database/tree/main/vulns/pillow/PYSEC-2023-227.yaml" }, { "reference_url": "https://github.com/python-pillow/Pillow", "reference_id": "", "reference_type": "", "scores": [], "url": "https://github.com/python-pillow/Pillow" }, { "reference_url": "https://github.com/python-pillow/Pillow/commit/1fe1bb49c452b0318cad12ea9d97c3bef188e9a7", "reference_id": "", "reference_type": "", "scores": [], "url": "https://github.com/python-pillow/Pillow/commit/1fe1bb49c452b0318cad12ea9d97c3bef188e9a7" }, { "reference_url": "https://github.com/python-pillow/Pillow/pull/7244", "reference_id": "", "reference_type": "", "scores": [], "url": "https://github.com/python-pillow/Pillow/pull/7244" }, { "reference_url": "https://lists.debian.org/debian-lts-announce/2024/03/msg00021.html", "reference_id": "", "reference_type": "", "scores": [], "url": "https://lists.debian.org/debian-lts-announce/2024/03/msg00021.html" }, { "reference_url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/N2JOEDUJDQLCUII2LQYZYSM7RJL2I3P4", "reference_id": "", "reference_type": "", "scores": [], "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/N2JOEDUJDQLCUII2LQYZYSM7RJL2I3P4" }, { "reference_url": "https://devhub.checkmarx.com/cve-details/CVE-2023-44271", "reference_id": "CVE-2023-44271", "reference_type": "", "scores": [], "url": "https://devhub.checkmarx.com/cve-details/CVE-2023-44271" }, { "reference_url": "https://nvd.nist.gov/vuln/detail/CVE-2023-44271", "reference_id": "CVE-2023-44271", "reference_type": "", "scores": [], "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-44271" }, { "reference_url": "https://github.com/advisories/GHSA-8ghj-p4vj-mr35", "reference_id": "GHSA-8ghj-p4vj-mr35", "reference_type": "", "scores": [], "url": "https://github.com/advisories/GHSA-8ghj-p4vj-mr35" } ], "fixed_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/37828?format=api", "purl": "pkg:pypi/pillow@10.0.0", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-4tub-w66m-uyfu" }, { "vulnerability": "VCID-9hza-srk7-sucy" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:pypi/pillow@10.0.0" } ], "aliases": [ "CVE-2023-44271", "GHSA-8ghj-p4vj-mr35", "PYSEC-2023-227" ], "risk_score": null, "exploitability": null, "weighted_severity": null, "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-x3bz-ehvb-jyfs" } ], "fixing_vulnerabilities": [], "risk_score": null, "resource_url": "http://public2.vulnerablecode.io/packages/pkg:pypi/pillow@9.1.0" }