Search for packages
| purl | pkg:pypi/pillow@9.0.1 |
| Vulnerability | Summary | Fixed by |
|---|---|---|
|
VCID-19e1-19hk-duet
Aliases: BIT-pillow-2022-45198 CVE-2022-45198 GHSA-m2vv-5vj5-2hm7 PYSEC-2022-42979 |
Pillow before 9.2.0 performs Improper Handling of Highly Compressed GIF Data (Data Amplification). |
Affected by 7 other vulnerabilities. |
|
VCID-5rv4-k1q9-zue2
Aliases: PYSEC-2023-175 |
Pillow versions before v10.0.1 bundled libwebp binaries in wheels that are vulnerable to CVE-2023-5129 (previously CVE-2023-4863). Pillow v10.0.1 upgrades the bundled libwebp binary to v1.3.2. |
Affected by 2 other vulnerabilities. |
|
VCID-64n5-pugj-vue8
Aliases: CVE-2024-28219 GHSA-44wm-f244-xhp3 |
Pillow buffer overflow vulnerability In _imagingcms.c in Pillow before 10.3.0, a buffer overflow exists because strcpy is used instead of strncpy. |
Affected by 2 other vulnerabilities. |
|
VCID-9ckw-ra54-z3b7
Aliases: CVE-2023-50447 GHSA-3f63-hfp8-52jq |
Arbitrary Code Execution in Pillow Pillow through 10.1.0 allows PIL.ImageMath.eval Arbitrary Code Execution via the environment parameter, a different vulnerability than CVE-2022-22817 (which was about the expression parameter). |
Affected by 1 other vulnerability. |
|
VCID-d7uf-zdbv-sba1
Aliases: GHSA-56pw-mpj4-fxww GMS-2023-3137 |
Duplicate This advisory duplicates another. |
Affected by 2 other vulnerabilities. |
|
VCID-n1hp-atex-ubh4
Aliases: BIT-pillow-2023-44271 CVE-2023-44271 GHSA-8ghj-p4vj-mr35 PYSEC-2023-227 |
An issue was discovered in Pillow before 10.0.0. It is a Denial of Service that uncontrollably allocates memory to process a given task, potentially causing a service to crash by having it run out of memory. This occurs for truetype in ImageFont when textlength in an ImageDraw instance operates on a long text argument. |
Affected by 5 other vulnerabilities. |
|
VCID-vdzj-kqfy-d3b7
Aliases: CVE-2023-4863 GHSA-j7hp-h8jx-5ppr |
libwebp: OOB write in BuildHuffmanTable Heap buffer overflow in libwebp allow a remote attacker to perform an out of bounds memory write via a crafted HTML page. |
Affected by 2 other vulnerabilities. |
| Vulnerability | Summary | Aliases |
|---|---|---|
| VCID-brp2-dtrf-jyfr | Pillow before 9.0.1 allows attackers to delete files because spaces in temporary pathnames are mishandled. |
BIT-pillow-2022-24303
CVE-2022-24303 GHSA-9j59-75qj-795w GMS-2022-348 PYSEC-2022-168 |
| VCID-q4bb-qnxe-8bfa | PIL.ImageMath.eval in Pillow before 9.0.0 allows evaluation of arbitrary expressions, such as ones that use the Python exec method. |
BIT-pillow-2022-22817
CVE-2022-22817 GHSA-8vj2-vxx3-667w PYSEC-2022-10 |