Search for packages
| purl | pkg:pypi/pillow@1.7.6 |
| Vulnerability | Summary | Fixed by |
|---|---|---|
|
VCID-19e1-19hk-duet
Aliases: BIT-pillow-2022-45198 CVE-2022-45198 GHSA-m2vv-5vj5-2hm7 PYSEC-2022-42979 |
Pillow before 9.2.0 performs Improper Handling of Highly Compressed GIF Data (Data Amplification). |
Affected by 7 other vulnerabilities. |
|
VCID-1vt7-c6e3-7qc8
Aliases: BIT-pillow-2021-23437 CVE-2021-23437 GHSA-98vv-pw6r-q6q4 PYSEC-2021-317 SNYK-PYTHON-PILLOW-1319443 |
The package pillow from 0 and before 8.3.2 are vulnerable to Regular Expression Denial of Service (ReDoS) via the getrgb function. |
Affected by 12 other vulnerabilities. |
|
VCID-366h-8f99-r7at
Aliases: CVE-2016-0775 GHSA-8xjv-v9xq-m5h9 PYSEC-2016-6 |
Buffer overflow in the ImagingFliDecode function in libImaging/FliDecode.c in Pillow before 3.1.1 allows remote attackers to cause a denial of service (crash) via a crafted FLI file. |
Affected by 47 other vulnerabilities. |
|
VCID-3qb5-8p8w-gkad
Aliases: BIT-pillow-2021-27921 CVE-2021-27921 GHSA-f4w8-cv6p-x6r5 PYSEC-2021-40 |
Pillow before 8.1.1 allows attackers to cause a denial of service (memory consumption) because the reported size of a contained image is not properly checked for a BLP container, and thus an attempted memory allocation can be very large. |
Affected by 24 other vulnerabilities. Affected by 21 other vulnerabilities. |
|
VCID-3uk9-eds5-rkgc
Aliases: BIT-pillow-2021-28675 CVE-2021-28675 GHSA-g6rj-rv7j-xwp4 PYSEC-2021-139 |
An issue was discovered in Pillow before 8.2.0. PSDImagePlugin.PsdImageFile lacked a sanity check on the number of input layers relative to the size of the data block. This could lead to a DoS on Image.open prior to Image.load. |
Affected by 14 other vulnerabilities. |
|
VCID-53ac-ceq4-qkhf
Aliases: BIT-pillow-2021-27922 CVE-2021-27922 GHSA-3wvg-mj6g-m9cv PYSEC-2021-41 |
Pillow before 8.1.1 allows attackers to cause a denial of service (memory consumption) because the reported size of a contained image is not properly checked for an ICNS container, and thus an attempted memory allocation can be very large. |
Affected by 24 other vulnerabilities. Affected by 21 other vulnerabilities. |
|
VCID-5rv4-k1q9-zue2
Aliases: PYSEC-2023-175 |
Pillow versions before v10.0.1 bundled libwebp binaries in wheels that are vulnerable to CVE-2023-5129 (previously CVE-2023-4863). Pillow v10.0.1 upgrades the bundled libwebp binary to v1.3.2. |
Affected by 2 other vulnerabilities. |
|
VCID-64n5-pugj-vue8
Aliases: CVE-2024-28219 GHSA-44wm-f244-xhp3 |
Pillow buffer overflow vulnerability In _imagingcms.c in Pillow before 10.3.0, a buffer overflow exists because strcpy is used instead of strncpy. |
Affected by 2 other vulnerabilities. |
|
VCID-6gyu-fzpg-c3bn
Aliases: BIT-pillow-2020-35654 CVE-2020-35654 GHSA-vqcj-wrf2-7v73 PYSEC-2021-70 |
In Pillow before 8.1.0, TiffDecode has a heap-based buffer overflow when decoding crafted YCbCr files because of certain interpretation conflicts with LibTIFF in RGBA mode. |
Affected by 29 other vulnerabilities. |
|
VCID-8n2b-wvya-53e1
Aliases: BIT-pillow-2020-10378 CVE-2020-10378 GHSA-3xv8-3j54-hgrp PYSEC-2020-77 |
In libImaging/PcxDecode.c in Pillow before 7.1.0, an out-of-bounds read can occur when reading PCX files where state->shuffle is instructed to read beyond state->buffer. |
Affected by 32 other vulnerabilities. |
|
VCID-9ckw-ra54-z3b7
Aliases: CVE-2023-50447 GHSA-3f63-hfp8-52jq |
Arbitrary Code Execution in Pillow Pillow through 10.1.0 allows PIL.ImageMath.eval Arbitrary Code Execution via the environment parameter, a different vulnerability than CVE-2022-22817 (which was about the expression parameter). |
Affected by 1 other vulnerability. |
|
VCID-and9-6jty-pyeq
Aliases: BIT-pillow-2020-10379 CVE-2020-10379 GHSA-8843-m7mw-mxqm PYSEC-2020-78 |
In Pillow before 7.1.0, there are two Buffer Overflows in libImaging/TiffDecode.c. |
Affected by 32 other vulnerabilities. |
|
VCID-aubw-tsmn-ffcq
Aliases: BIT-pillow-2021-28677 CVE-2021-28677 GHSA-q5hq-fp76-qmrc PYSEC-2021-93 |
An issue was discovered in Pillow before 8.2.0. For EPS data, the readline implementation used in EPSImageFile has to deal with any combination of \r and \n as line endings. It used an accidentally quadratic method of accumulating lines while looking for a line ending. A malicious EPS file could use this to perform a DoS of Pillow in the open phase, before an image was accepted for opening. |
Affected by 14 other vulnerabilities. |
|
VCID-avx2-mahw-mqes
Aliases: CVE-2016-4009 GHSA-hvr8-466p-75rh PYSEC-2016-7 |
Integer overflow in the ImagingResampleHorizontal function in libImaging/Resample.c in Pillow before 3.1.1 allows remote attackers to have unspecified impact via negative values of the new size, which triggers a heap-based buffer overflow. |
Affected by 47 other vulnerabilities. |
|
VCID-b3au-rcgp-2fag
Aliases: CVE-2019-19911 GHSA-5gm3-px64-rw72 PYSEC-2020-172 |
There is a DoS vulnerability in Pillow before 6.2.2 caused by FpxImagePlugin.py calling the range function on an unvalidated 32-bit integer if the number of bands is large. On Windows running 32-bit Python, this results in an OverflowError or MemoryError due to the 2 GB limit. However, on Linux running 64-bit Python this results in the process being terminated by the OOM killer. |
Affected by 37 other vulnerabilities. |
|
VCID-b5a2-83ej-puaw
Aliases: BIT-pillow-2020-11538 CVE-2020-11538 GHSA-43fq-w8qq-v88h PYSEC-2020-80 |
In libImaging/SgiRleDecode.c in Pillow through 7.0.0, a number of out-of-bounds reads exist in the parsing of SGI image files, a different issue than CVE-2020-5311. |
Affected by 32 other vulnerabilities. |
|
VCID-brp2-dtrf-jyfr
Aliases: BIT-pillow-2022-24303 CVE-2022-24303 GHSA-9j59-75qj-795w GMS-2022-348 PYSEC-2022-168 |
Pillow before 9.0.1 allows attackers to delete files because spaces in temporary pathnames are mishandled. |
Affected by 7 other vulnerabilities. |
|
VCID-cas2-jb3y-vyhz
Aliases: CVE-2019-16865 GHSA-j7mj-748x-7p78 PYSEC-2019-110 |
An issue was discovered in Pillow before 6.2.0. When reading specially crafted invalid image files, the library can either allocate very large amounts of memory or take an extremely long period of time to process the image. |
Affected by 43 other vulnerabilities. |
|
VCID-d7uf-zdbv-sba1
Aliases: GHSA-56pw-mpj4-fxww GMS-2023-3137 |
Duplicate This advisory duplicates another. |
Affected by 2 other vulnerabilities. |
|
VCID-df4x-jt3h-17hx
Aliases: BIT-pillow-2022-22816 CVE-2022-22816 GHSA-xrcv-f9gm-v42c PYSEC-2022-9 |
path_getbbox in path.c in Pillow before 9.0.0 has a buffer over-read during initialization of ImagePath.Path. |
Affected by 9 other vulnerabilities. |
|
VCID-dgds-v95g-pbcv
Aliases: CVE-2016-0740 GHSA-hggx-3h72-49ww PYSEC-2016-5 |
Buffer overflow in the ImagingLibTiffDecode function in libImaging/TiffDecode.c in Pillow before 3.1.1 allows remote attackers to overwrite memory via a crafted TIFF file. |
Affected by 47 other vulnerabilities. |
|
VCID-dgy9-uh9h-xfft
Aliases: CVE-2014-1932 GHSA-x895-2wrm-hvp7 PYSEC-2014-22 |
The (1) load_djpeg function in JpegImagePlugin.py, (2) Ghostscript function in EpsImagePlugin.py, (3) load function in IptcImagePlugin.py, and (4) _copy function in Image.py in Python Image Library (PIL) 1.1.7 and earlier and Pillow before 2.3.1 do not properly create temporary files, which allow local users to overwrite arbitrary files and obtain sensitive information via a symlink attack on the temporary file. |
Affected by 54 other vulnerabilities. |
|
VCID-dpc3-td9q-dyee
Aliases: BIT-pillow-2022-22815 CVE-2022-22815 GHSA-pw3c-h7wp-cvhx PYSEC-2022-8 |
path_getbbox in path.c in Pillow before 9.0.0 improperly initializes ImagePath.Path. |
Affected by 9 other vulnerabilities. |
|
VCID-e3gp-zc2b-budg
Aliases: CVE-2016-9189 GHSA-rwr3-c2q8-gm56 PYSEC-2016-8 |
Pillow before 3.3.2 allows context-dependent attackers to obtain sensitive information by using the "crafted image file" approach, related to an "Integer Overflow" issue affecting the Image.core.map_buffer in map.c component. |
Affected by 44 other vulnerabilities. |
|
VCID-en6t-uxtq-bfek
Aliases: BIT-pillow-2021-25289 CVE-2021-25289 GHSA-57h3-9rgr-c24m PYSEC-2021-35 |
An issue was discovered in Pillow before 8.1.1. TiffDecode has a heap-based buffer overflow when decoding crafted YCbCr files because of certain interpretation conflicts with LibTIFF in RGBA mode. NOTE: this issue exists because of an incomplete fix for CVE-2020-35654. |
Affected by 24 other vulnerabilities. |
|
VCID-g46h-p8jk-cuhc
Aliases: GHSA-4fx9-vc88-q2xc GMS-2022-347 |
Infinite loop in Pillow JpegImagePlugin may append an EOF marker to the end of a truncated file, so that the last segment of the data will still be processed by the decoder. If the EOF marker is not detected as such however, this could lead to an infinite loop where JpegImagePlugin keeps trying to end the file. |
Affected by 9 other vulnerabilities. |
|
VCID-gmd5-pbxc-a3gd
Aliases: CVE-2014-3007 GHSA-8m9x-pxwq-j236 PYSEC-2014-87 |
Python Image Library (PIL) 1.1.7 and earlier and Pillow 2.3 might allow remote attackers to execute arbitrary commands via shell metacharacters in unspecified vectors related to CVE-2014-1932, possibly JpegImagePlugin.py. |
Affected by 54 other vulnerabilities. |
|
VCID-gvjw-funa-sqak
Aliases: BIT-pillow-2021-27923 CVE-2021-27923 GHSA-95q3-8gr9-gm8w PYSEC-2021-42 |
Pillow before 8.1.1 allows attackers to cause a denial of service (memory consumption) because the reported size of a contained image is not properly checked for an ICO container, and thus an attempted memory allocation can be very large. |
Affected by 24 other vulnerabilities. Affected by 21 other vulnerabilities. |
|
VCID-h4x7-7fke-mqgp
Aliases: PYSEC-2020-191 |
There is a DoS vulnerability in Pillow before 6.2.2 caused by FpxImagePlugin.py calling the range function on an unvalidated 32-bit integer if the number of bands is large. On Windows running 32-bit Python, this results in an OverflowError or MemoryError due to the 2 GB limit. However, on Linux running 64-bit Python this results in the process being terminated by the OOM killer. |
Affected by 37 other vulnerabilities. |
|
VCID-haum-8zpg-6kgf
Aliases: BIT-pillow-2020-10177 CVE-2020-10177 GHSA-cqhg-xjhh-p8hf PYSEC-2020-76 |
Pillow before 7.1.0 has multiple out-of-bounds reads in libImaging/FliDecode.c. |
Affected by 32 other vulnerabilities. |
|
VCID-hmmq-5772-bycm
Aliases: BIT-pillow-2020-5313 CVE-2020-5313 GHSA-hj69-c76v-86wr PYSEC-2020-84 |
libImaging/FliDecode.c in Pillow before 6.2.2 has an FLI buffer overflow. |
Affected by 37 other vulnerabilities. |
|
VCID-khp6-9hfx-1kge
Aliases: GHSA-jgpv-4h4c-xhw3 GMS-2021-167 |
Uncontrolled Resource Consumption in pillow ### Impact _Pillow before 8.1.1 allows attackers to cause a denial of service (memory consumption) because the reported size of a contained image is not properly checked for a BLP container, and thus an attempted memory allocation can be very large._ ### Patches _An issue was discovered in Pillow before 6.2.0. When reading specially crafted invalid image files, the library can either allocate very large amounts of memory or take an extremely long period of time to process the image._ ### Workarounds _An issue was discovered in Pillow before 6.2.0. When reading specially crafted invalid image files, the library can either allocate very large amounts of memory or take an extremely long period of time to process the image._ ### References https://nvd.nist.gov/vuln/detail/CVE-2021-27921 ### For more information If you have any questions or comments about this advisory: * Open an issue in [example link to repo](http://example.com) * Email us at [example email address](mailto:example@example.com) |
Affected by 24 other vulnerabilities. Affected by 21 other vulnerabilities. |
|
VCID-m3tm-h4q9-9yay
Aliases: BIT-pillow-2020-5311 CVE-2020-5311 GHSA-r7rm-8j6h-r933 PYSEC-2020-82 |
libImaging/SgiRleDecode.c in Pillow before 6.2.2 has an SGI buffer overflow. |
Affected by 37 other vulnerabilities. |
|
VCID-ma2g-2f8d-dqa9
Aliases: CVE-2014-3598 GHSA-j6f7-g425-4gmx PYSEC-2015-15 |
The Jpeg2KImagePlugin plugin in Pillow before 2.5.3 allows remote attackers to cause a denial of service via a crafted image. |
Affected by 52 other vulnerabilities. |
|
VCID-n1hp-atex-ubh4
Aliases: BIT-pillow-2023-44271 CVE-2023-44271 GHSA-8ghj-p4vj-mr35 PYSEC-2023-227 |
An issue was discovered in Pillow before 10.0.0. It is a Denial of Service that uncontrollably allocates memory to process a given task, potentially causing a service to crash by having it run out of memory. This occurs for truetype in ImageFont when textlength in an ImageDraw instance operates on a long text argument. |
Affected by 5 other vulnerabilities. |
|
VCID-n1w5-f5p7-xuhb
Aliases: BIT-pillow-2021-25287 CVE-2021-25287 GHSA-77gc-v2xv-rvvh PYSEC-2021-137 |
An issue was discovered in Pillow before 8.2.0. There is an out-of-bounds read in J2kDecode, in j2ku_graya_la. |
Affected by 14 other vulnerabilities. |
|
VCID-p6r3-puh1-zyg6
Aliases: BIT-pillow-2021-25293 CVE-2021-25293 GHSA-p43w-g3c5-g5mq PYSEC-2021-39 |
An issue was discovered in Pillow before 8.1.1. There is an out-of-bounds read in SGIRleDecode.c. |
Affected by 24 other vulnerabilities. |
|
VCID-ptk9-u246-q7gh
Aliases: CVE-2014-1933 GHSA-r854-96gq-rfg3 PYSEC-2014-23 |
The (1) JpegImagePlugin.py and (2) EpsImagePlugin.py scripts in Python Image Library (PIL) 1.1.7 and earlier and Pillow before 2.3.1 uses the names of temporary files on the command line, which makes it easier for local users to conduct symlink attacks by listing the processes. |
Affected by 54 other vulnerabilities. |
|
VCID-q4bb-qnxe-8bfa
Aliases: BIT-pillow-2022-22817 CVE-2022-22817 GHSA-8vj2-vxx3-667w PYSEC-2022-10 |
PIL.ImageMath.eval in Pillow before 9.0.0 allows evaluation of arbitrary expressions, such as ones that use the Python exec method. |
Affected by 9 other vulnerabilities. Affected by 7 other vulnerabilities. |
|
VCID-qjqr-jyjn-xfh9
Aliases: CVE-2014-9601 GHSA-h5rf-vgqx-wjv2 PYSEC-2015-16 |
Pillow before 2.7.0 allows remote attackers to cause a denial of service via a compressed text chunk in a PNG image that has a large size when it is decompressed. |
Affected by 51 other vulnerabilities. |
|
VCID-rncf-9nf8-wud3
Aliases: BIT-pillow-2021-25290 CVE-2021-25290 GHSA-8xjq-8fcg-g5hw PYSEC-2021-36 |
An issue was discovered in Pillow before 8.1.1. In TiffDecode.c, there is a negative-offset memcpy with an invalid size. |
Affected by 24 other vulnerabilities. |
|
VCID-sns1-ksqr-vbhr
Aliases: BIT-pillow-2020-5312 CVE-2020-5312 GHSA-p49h-hjvm-jg3h PYSEC-2020-83 |
libImaging/PcxDecode.c in Pillow before 6.2.2 has a PCX P mode buffer overflow. |
Affected by 37 other vulnerabilities. |
|
VCID-stft-hsk9-zfdy
Aliases: BIT-pillow-2020-5310 CVE-2020-5310 GHSA-vcqg-3p29-xw73 PYSEC-2020-81 |
libImaging/TiffDecode.c in Pillow before 6.2.2 has a TIFF decoding integer overflow, related to realloc. |
Affected by 37 other vulnerabilities. |
|
VCID-u1en-t8ux-uube
Aliases: CVE-2016-9190 GHSA-w4vg-rf63-f3j3 PYSEC-2016-9 |
Pillow before 3.3.2 allows context-dependent attackers to execute arbitrary code by using the "crafted image file" approach, related to an "Insecure Sign Extension" issue affecting the ImagingNew in Storage.c component. |
Affected by 44 other vulnerabilities. |
|
VCID-ue18-zzau-x7hy
Aliases: BIT-pillow-2021-25288 CVE-2021-25288 GHSA-rwv7-3v45-hg29 PYSEC-2021-138 |
An issue was discovered in Pillow before 8.2.0. There is an out-of-bounds read in J2kDecode, in j2ku_gray_i. |
Affected by 14 other vulnerabilities. |
|
VCID-uf5t-asns-tudp
Aliases: BIT-pillow-2020-10994 CVE-2020-10994 GHSA-vj42-xq3r-hr3r PYSEC-2020-79 |
In libImaging/Jpeg2KDecode.c in Pillow before 7.1.0, there are multiple out-of-bounds reads via a crafted JP2 file. |
Affected by 37 other vulnerabilities. Affected by 32 other vulnerabilities. |
|
VCID-vdzj-kqfy-d3b7
Aliases: CVE-2023-4863 GHSA-j7hp-h8jx-5ppr |
libwebp: OOB write in BuildHuffmanTable Heap buffer overflow in libwebp allow a remote attacker to perform an out of bounds memory write via a crafted HTML page. |
Affected by 2 other vulnerabilities. |
|
VCID-vwbu-ruxm-tbh4
Aliases: BIT-pillow-2021-25291 CVE-2021-25291 GHSA-mvg9-xffr-p774 PYSEC-2021-37 |
An issue was discovered in Pillow before 8.1.1. In TiffDecode.c, there is an out-of-bounds read in TiffreadRGBATile via invalid tile boundaries. |
Affected by 24 other vulnerabilities. Affected by 14 other vulnerabilities. |
|
VCID-vxh1-8rvt-kkak
Aliases: BIT-pillow-2021-25292 CVE-2021-25292 GHSA-9hx2-hgq2-2g4f PYSEC-2021-38 |
An issue was discovered in Pillow before 8.1.1. The PDF parser allows a regular expression DoS (ReDoS) attack via a crafted PDF file because of a catastrophic backtracking regex. |
Affected by 24 other vulnerabilities. |
|
VCID-vyzt-df2u-h3cc
Aliases: BIT-pillow-2021-28678 CVE-2021-28678 GHSA-hjfx-8p6c-g7gx PYSEC-2021-94 |
An issue was discovered in Pillow before 8.2.0. For BLP data, BlpImagePlugin did not properly check that reads (after jumping to file offsets) returned data. This could lead to a DoS where the decoder could be run a large number of times on empty data. |
Affected by 14 other vulnerabilities. |
|
VCID-vz9s-jqpb-2ybf
Aliases: CVE-2014-3589 GHSA-cfmr-38g9-f2h7 PYSEC-2014-10 |
PIL/IcnsImagePlugin.py in Python Imaging Library (PIL) and Pillow before 2.3.2 and 2.5.x before 2.5.2 allows remote attackers to cause a denial of service via a crafted block size. |
Affected by 53 other vulnerabilities. Affected by 53 other vulnerabilities. |
|
VCID-w9uy-fnpm-cbak
Aliases: BIT-pillow-2021-34552 CVE-2021-34552 GHSA-7534-mm45-c74v PYSEC-2021-331 |
Pillow through 8.2.0 and PIL (aka Python Imaging Library) through 1.1.7 allow an attacker to pass controlled parameters directly into a convert function to trigger a buffer overflow in Convert.c. |
Affected by 13 other vulnerabilities. |
|
VCID-x15z-dejc-9ba6
Aliases: BIT-pillow-2020-35653 CVE-2020-35653 GHSA-f5g8-5qq7-938w PYSEC-2021-69 |
In Pillow before 8.1.0, PcxDecode has a buffer over-read when decoding a crafted PCX file because the user-supplied stride value is trusted for buffer calculations. |
Affected by 29 other vulnerabilities. |
|
VCID-xesd-d294-7fcx
Aliases: BIT-pillow-2021-28676 CVE-2021-28676 GHSA-7r7m-5h27-29hp PYSEC-2021-92 |
An issue was discovered in Pillow before 8.2.0. For FLI data, FliDecode did not properly check that the block advance was non-zero, potentially leading to an infinite loop on load. |
Affected by 14 other vulnerabilities. |
|
VCID-xk66-1d31-2qbk
Aliases: PYSEC-2019-40 |
An issue was discovered in Pillow before 6.2.0. When reading specially crafted invalid image files, the library can either allocate very large amounts of memory or take an extremely long period of time to process the image. |
Affected by 43 other vulnerabilities. |
|
VCID-zmd3-henq-r7bd
Aliases: CVE-2016-2533 GHSA-3c5c-7235-994j PYSEC-2016-19 |
Buffer overflow in the ImagingPcdDecode function in PcdDecode.c in Pillow before 3.1.1 and Python Imaging Library (PIL) 1.1.7 and earlier allows remote attackers to cause a denial of service (crash) via a crafted PhotoCD file. |
Affected by 47 other vulnerabilities. |
| Vulnerability | Summary | Aliases |
|---|---|---|
| This package is not known to fix vulnerabilities. | ||