Search for packages
| purl | pkg:pypi/pillow@9.0.0 |
| Vulnerability | Summary | Fixed by |
|---|---|---|
|
VCID-19e1-19hk-duet
Aliases: BIT-pillow-2022-45198 CVE-2022-45198 GHSA-m2vv-5vj5-2hm7 PYSEC-2022-42979 |
Pillow before 9.2.0 performs Improper Handling of Highly Compressed GIF Data (Data Amplification). |
Affected by 7 other vulnerabilities. |
|
VCID-5rv4-k1q9-zue2
Aliases: PYSEC-2023-175 |
Pillow versions before v10.0.1 bundled libwebp binaries in wheels that are vulnerable to CVE-2023-5129 (previously CVE-2023-4863). Pillow v10.0.1 upgrades the bundled libwebp binary to v1.3.2. |
Affected by 2 other vulnerabilities. |
|
VCID-64n5-pugj-vue8
Aliases: CVE-2024-28219 GHSA-44wm-f244-xhp3 |
Pillow buffer overflow vulnerability In _imagingcms.c in Pillow before 10.3.0, a buffer overflow exists because strcpy is used instead of strncpy. |
Affected by 2 other vulnerabilities. |
|
VCID-9ckw-ra54-z3b7
Aliases: CVE-2023-50447 GHSA-3f63-hfp8-52jq |
Arbitrary Code Execution in Pillow Pillow through 10.1.0 allows PIL.ImageMath.eval Arbitrary Code Execution via the environment parameter, a different vulnerability than CVE-2022-22817 (which was about the expression parameter). |
Affected by 1 other vulnerability. |
|
VCID-brp2-dtrf-jyfr
Aliases: BIT-pillow-2022-24303 CVE-2022-24303 GHSA-9j59-75qj-795w GMS-2022-348 PYSEC-2022-168 |
Pillow before 9.0.1 allows attackers to delete files because spaces in temporary pathnames are mishandled. |
Affected by 7 other vulnerabilities. |
|
VCID-d7uf-zdbv-sba1
Aliases: GHSA-56pw-mpj4-fxww GMS-2023-3137 |
Duplicate This advisory duplicates another. |
Affected by 2 other vulnerabilities. |
|
VCID-n1hp-atex-ubh4
Aliases: BIT-pillow-2023-44271 CVE-2023-44271 GHSA-8ghj-p4vj-mr35 PYSEC-2023-227 |
An issue was discovered in Pillow before 10.0.0. It is a Denial of Service that uncontrollably allocates memory to process a given task, potentially causing a service to crash by having it run out of memory. This occurs for truetype in ImageFont when textlength in an ImageDraw instance operates on a long text argument. |
Affected by 5 other vulnerabilities. |
|
VCID-q4bb-qnxe-8bfa
Aliases: BIT-pillow-2022-22817 CVE-2022-22817 GHSA-8vj2-vxx3-667w PYSEC-2022-10 |
PIL.ImageMath.eval in Pillow before 9.0.0 allows evaluation of arbitrary expressions, such as ones that use the Python exec method. |
Affected by 7 other vulnerabilities. |
|
VCID-vdzj-kqfy-d3b7
Aliases: CVE-2023-4863 GHSA-j7hp-h8jx-5ppr |
libwebp: OOB write in BuildHuffmanTable Heap buffer overflow in libwebp allow a remote attacker to perform an out of bounds memory write via a crafted HTML page. |
Affected by 2 other vulnerabilities. |
| Vulnerability | Summary | Aliases |
|---|---|---|
| VCID-df4x-jt3h-17hx | path_getbbox in path.c in Pillow before 9.0.0 has a buffer over-read during initialization of ImagePath.Path. |
BIT-pillow-2022-22816
CVE-2022-22816 GHSA-xrcv-f9gm-v42c PYSEC-2022-9 |
| VCID-dpc3-td9q-dyee | path_getbbox in path.c in Pillow before 9.0.0 improperly initializes ImagePath.Path. |
BIT-pillow-2022-22815
CVE-2022-22815 GHSA-pw3c-h7wp-cvhx PYSEC-2022-8 |
| VCID-g46h-p8jk-cuhc | Infinite loop in Pillow JpegImagePlugin may append an EOF marker to the end of a truncated file, so that the last segment of the data will still be processed by the decoder. If the EOF marker is not detected as such however, this could lead to an infinite loop where JpegImagePlugin keeps trying to end the file. |
GHSA-4fx9-vc88-q2xc
GMS-2022-347 |
| VCID-q4bb-qnxe-8bfa | PIL.ImageMath.eval in Pillow before 9.0.0 allows evaluation of arbitrary expressions, such as ones that use the Python exec method. |
BIT-pillow-2022-22817
CVE-2022-22817 GHSA-8vj2-vxx3-667w PYSEC-2022-10 |