Search for packages
| purl | pkg:deb/debian/pillow@8.1.2%2Bdfsg-0.3%2Bdeb11u2 |
| Next non-vulnerable version | 9.4.0-1.1+deb12u1 |
| Latest non-vulnerable version | 9.4.0-1.1+deb12u1 |
| Risk | 4.1 |
| Vulnerability | Summary | Fixed by |
|---|---|---|
|
VCID-19e1-19hk-duet
Aliases: BIT-pillow-2022-45198 CVE-2022-45198 GHSA-m2vv-5vj5-2hm7 PYSEC-2022-42979 |
Pillow before 9.2.0 performs Improper Handling of Highly Compressed GIF Data (Data Amplification). |
Affected by 0 other vulnerabilities. |
|
VCID-1vt7-c6e3-7qc8
Aliases: BIT-pillow-2021-23437 CVE-2021-23437 GHSA-98vv-pw6r-q6q4 PYSEC-2021-317 SNYK-PYTHON-PILLOW-1319443 |
The package pillow from 0 and before 8.3.2 are vulnerable to Regular Expression Denial of Service (ReDoS) via the getrgb function. |
Affected by 0 other vulnerabilities. |
|
VCID-brp2-dtrf-jyfr
Aliases: BIT-pillow-2022-24303 CVE-2022-24303 GHSA-9j59-75qj-795w GMS-2022-348 PYSEC-2022-168 |
Pillow before 9.0.1 allows attackers to delete files because spaces in temporary pathnames are mishandled. |
Affected by 0 other vulnerabilities. |
| Vulnerability | Summary | Aliases |
|---|---|---|
| VCID-3qb5-8p8w-gkad | Pillow before 8.1.1 allows attackers to cause a denial of service (memory consumption) because the reported size of a contained image is not properly checked for a BLP container, and thus an attempted memory allocation can be very large. |
BIT-pillow-2021-27921
CVE-2021-27921 GHSA-f4w8-cv6p-x6r5 PYSEC-2021-40 |
| VCID-3uk9-eds5-rkgc | An issue was discovered in Pillow before 8.2.0. PSDImagePlugin.PsdImageFile lacked a sanity check on the number of input layers relative to the size of the data block. This could lead to a DoS on Image.open prior to Image.load. |
BIT-pillow-2021-28675
CVE-2021-28675 GHSA-g6rj-rv7j-xwp4 PYSEC-2021-139 |
| VCID-53ac-ceq4-qkhf | Pillow before 8.1.1 allows attackers to cause a denial of service (memory consumption) because the reported size of a contained image is not properly checked for an ICNS container, and thus an attempted memory allocation can be very large. |
BIT-pillow-2021-27922
CVE-2021-27922 GHSA-3wvg-mj6g-m9cv PYSEC-2021-41 |
| VCID-64n5-pugj-vue8 | Pillow buffer overflow vulnerability In _imagingcms.c in Pillow before 10.3.0, a buffer overflow exists because strcpy is used instead of strncpy. |
CVE-2024-28219
GHSA-44wm-f244-xhp3 |
| VCID-6gyu-fzpg-c3bn | In Pillow before 8.1.0, TiffDecode has a heap-based buffer overflow when decoding crafted YCbCr files because of certain interpretation conflicts with LibTIFF in RGBA mode. |
BIT-pillow-2020-35654
CVE-2020-35654 GHSA-vqcj-wrf2-7v73 PYSEC-2021-70 |
| VCID-7bjx-gkf7-cke9 | In Pillow before 8.1.0, SGIRleDecode has a 4-byte buffer over-read when decoding crafted SGI RLE image files because offsets and length tables are mishandled. |
BIT-pillow-2020-35655
CVE-2020-35655 GHSA-hf64-x4gq-p99h PYSEC-2021-71 |
| VCID-8n2b-wvya-53e1 | In libImaging/PcxDecode.c in Pillow before 7.1.0, an out-of-bounds read can occur when reading PCX files where state->shuffle is instructed to read beyond state->buffer. |
BIT-pillow-2020-10378
CVE-2020-10378 GHSA-3xv8-3j54-hgrp PYSEC-2020-77 |
| VCID-9ckw-ra54-z3b7 | Arbitrary Code Execution in Pillow Pillow through 10.1.0 allows PIL.ImageMath.eval Arbitrary Code Execution via the environment parameter, a different vulnerability than CVE-2022-22817 (which was about the expression parameter). |
CVE-2023-50447
GHSA-3f63-hfp8-52jq |
| VCID-and9-6jty-pyeq | In Pillow before 7.1.0, there are two Buffer Overflows in libImaging/TiffDecode.c. |
BIT-pillow-2020-10379
CVE-2020-10379 GHSA-8843-m7mw-mxqm PYSEC-2020-78 |
| VCID-aubw-tsmn-ffcq | An issue was discovered in Pillow before 8.2.0. For EPS data, the readline implementation used in EPSImageFile has to deal with any combination of \r and \n as line endings. It used an accidentally quadratic method of accumulating lines while looking for a line ending. A malicious EPS file could use this to perform a DoS of Pillow in the open phase, before an image was accepted for opening. |
BIT-pillow-2021-28677
CVE-2021-28677 GHSA-q5hq-fp76-qmrc PYSEC-2021-93 |
| VCID-b3au-rcgp-2fag | There is a DoS vulnerability in Pillow before 6.2.2 caused by FpxImagePlugin.py calling the range function on an unvalidated 32-bit integer if the number of bands is large. On Windows running 32-bit Python, this results in an OverflowError or MemoryError due to the 2 GB limit. However, on Linux running 64-bit Python this results in the process being terminated by the OOM killer. |
CVE-2019-19911
GHSA-5gm3-px64-rw72 PYSEC-2020-172 |
| VCID-b5a2-83ej-puaw | In libImaging/SgiRleDecode.c in Pillow through 7.0.0, a number of out-of-bounds reads exist in the parsing of SGI image files, a different issue than CVE-2020-5311. |
BIT-pillow-2020-11538
CVE-2020-11538 GHSA-43fq-w8qq-v88h PYSEC-2020-80 |
| VCID-cas2-jb3y-vyhz | An issue was discovered in Pillow before 6.2.0. When reading specially crafted invalid image files, the library can either allocate very large amounts of memory or take an extremely long period of time to process the image. |
CVE-2019-16865
GHSA-j7mj-748x-7p78 PYSEC-2019-110 |
| VCID-df4x-jt3h-17hx | path_getbbox in path.c in Pillow before 9.0.0 has a buffer over-read during initialization of ImagePath.Path. |
BIT-pillow-2022-22816
CVE-2022-22816 GHSA-xrcv-f9gm-v42c PYSEC-2022-9 |
| VCID-dpc3-td9q-dyee | path_getbbox in path.c in Pillow before 9.0.0 improperly initializes ImagePath.Path. |
BIT-pillow-2022-22815
CVE-2022-22815 GHSA-pw3c-h7wp-cvhx PYSEC-2022-8 |
| VCID-en6t-uxtq-bfek | An issue was discovered in Pillow before 8.1.1. TiffDecode has a heap-based buffer overflow when decoding crafted YCbCr files because of certain interpretation conflicts with LibTIFF in RGBA mode. NOTE: this issue exists because of an incomplete fix for CVE-2020-35654. |
BIT-pillow-2021-25289
CVE-2021-25289 GHSA-57h3-9rgr-c24m PYSEC-2021-35 |
| VCID-gvjw-funa-sqak | Pillow before 8.1.1 allows attackers to cause a denial of service (memory consumption) because the reported size of a contained image is not properly checked for an ICO container, and thus an attempted memory allocation can be very large. |
BIT-pillow-2021-27923
CVE-2021-27923 GHSA-95q3-8gr9-gm8w PYSEC-2021-42 |
| VCID-haum-8zpg-6kgf | Pillow before 7.1.0 has multiple out-of-bounds reads in libImaging/FliDecode.c. |
BIT-pillow-2020-10177
CVE-2020-10177 GHSA-cqhg-xjhh-p8hf PYSEC-2020-76 |
| VCID-hmmq-5772-bycm | libImaging/FliDecode.c in Pillow before 6.2.2 has an FLI buffer overflow. |
BIT-pillow-2020-5313
CVE-2020-5313 GHSA-hj69-c76v-86wr PYSEC-2020-84 |
| VCID-m3tm-h4q9-9yay | libImaging/SgiRleDecode.c in Pillow before 6.2.2 has an SGI buffer overflow. |
BIT-pillow-2020-5311
CVE-2020-5311 GHSA-r7rm-8j6h-r933 PYSEC-2020-82 |
| VCID-n1hp-atex-ubh4 | An issue was discovered in Pillow before 10.0.0. It is a Denial of Service that uncontrollably allocates memory to process a given task, potentially causing a service to crash by having it run out of memory. This occurs for truetype in ImageFont when textlength in an ImageDraw instance operates on a long text argument. |
BIT-pillow-2023-44271
CVE-2023-44271 GHSA-8ghj-p4vj-mr35 PYSEC-2023-227 |
| VCID-n1w5-f5p7-xuhb | An issue was discovered in Pillow before 8.2.0. There is an out-of-bounds read in J2kDecode, in j2ku_graya_la. |
BIT-pillow-2021-25287
CVE-2021-25287 GHSA-77gc-v2xv-rvvh PYSEC-2021-137 |
| VCID-p6r3-puh1-zyg6 | An issue was discovered in Pillow before 8.1.1. There is an out-of-bounds read in SGIRleDecode.c. |
BIT-pillow-2021-25293
CVE-2021-25293 GHSA-p43w-g3c5-g5mq PYSEC-2021-39 |
| VCID-q4bb-qnxe-8bfa | PIL.ImageMath.eval in Pillow before 9.0.0 allows evaluation of arbitrary expressions, such as ones that use the Python exec method. |
BIT-pillow-2022-22817
CVE-2022-22817 GHSA-8vj2-vxx3-667w PYSEC-2022-10 |
| VCID-rncf-9nf8-wud3 | An issue was discovered in Pillow before 8.1.1. In TiffDecode.c, there is a negative-offset memcpy with an invalid size. |
BIT-pillow-2021-25290
CVE-2021-25290 GHSA-8xjq-8fcg-g5hw PYSEC-2021-36 |
| VCID-sns1-ksqr-vbhr | libImaging/PcxDecode.c in Pillow before 6.2.2 has a PCX P mode buffer overflow. |
BIT-pillow-2020-5312
CVE-2020-5312 GHSA-p49h-hjvm-jg3h PYSEC-2020-83 |
| VCID-stft-hsk9-zfdy | libImaging/TiffDecode.c in Pillow before 6.2.2 has a TIFF decoding integer overflow, related to realloc. |
BIT-pillow-2020-5310
CVE-2020-5310 GHSA-vcqg-3p29-xw73 PYSEC-2020-81 |
| VCID-ue18-zzau-x7hy | An issue was discovered in Pillow before 8.2.0. There is an out-of-bounds read in J2kDecode, in j2ku_gray_i. |
BIT-pillow-2021-25288
CVE-2021-25288 GHSA-rwv7-3v45-hg29 PYSEC-2021-138 |
| VCID-uf5t-asns-tudp | In libImaging/Jpeg2KDecode.c in Pillow before 7.1.0, there are multiple out-of-bounds reads via a crafted JP2 file. |
BIT-pillow-2020-10994
CVE-2020-10994 GHSA-vj42-xq3r-hr3r PYSEC-2020-79 |
| VCID-vwbu-ruxm-tbh4 | An issue was discovered in Pillow before 8.1.1. In TiffDecode.c, there is an out-of-bounds read in TiffreadRGBATile via invalid tile boundaries. |
BIT-pillow-2021-25291
CVE-2021-25291 GHSA-mvg9-xffr-p774 PYSEC-2021-37 |
| VCID-vxh1-8rvt-kkak | An issue was discovered in Pillow before 8.1.1. The PDF parser allows a regular expression DoS (ReDoS) attack via a crafted PDF file because of a catastrophic backtracking regex. |
BIT-pillow-2021-25292
CVE-2021-25292 GHSA-9hx2-hgq2-2g4f PYSEC-2021-38 |
| VCID-vyzt-df2u-h3cc | An issue was discovered in Pillow before 8.2.0. For BLP data, BlpImagePlugin did not properly check that reads (after jumping to file offsets) returned data. This could lead to a DoS where the decoder could be run a large number of times on empty data. |
BIT-pillow-2021-28678
CVE-2021-28678 GHSA-hjfx-8p6c-g7gx PYSEC-2021-94 |
| VCID-w9uy-fnpm-cbak | Pillow through 8.2.0 and PIL (aka Python Imaging Library) through 1.1.7 allow an attacker to pass controlled parameters directly into a convert function to trigger a buffer overflow in Convert.c. |
BIT-pillow-2021-34552
CVE-2021-34552 GHSA-7534-mm45-c74v PYSEC-2021-331 |
| VCID-x15z-dejc-9ba6 | In Pillow before 8.1.0, PcxDecode has a buffer over-read when decoding a crafted PCX file because the user-supplied stride value is trusted for buffer calculations. |
BIT-pillow-2020-35653
CVE-2020-35653 GHSA-f5g8-5qq7-938w PYSEC-2021-69 |
| VCID-xesd-d294-7fcx | An issue was discovered in Pillow before 8.2.0. For FLI data, FliDecode did not properly check that the block advance was non-zero, potentially leading to an infinite loop on load. |
BIT-pillow-2021-28676
CVE-2021-28676 GHSA-7r7m-5h27-29hp PYSEC-2021-92 |