{"url":"http://public2.vulnerablecode.io/api/packages/3032?format=json","purl":"pkg:pypi/pillow@1.6","type":"pypi","namespace":"","name":"pillow","version":"1.6","qualifiers":{},"subpath":"","is_vulnerable":true,"next_non_vulnerable_version":"12.1.1","latest_non_vulnerable_version":"12.2.0","affected_by_vulnerabilities":[{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/9760?format=json","vulnerability_id":"VCID-19e1-19hk-duet","summary":"Pillow before 9.2.0 performs Improper Handling of Highly Compressed GIF Data (Data Amplification).","references":[{"reference_url":"https://api.first.org/data/v1/epss?cve=CVE-2022-45198","reference_id":"","reference_type":"","scores":[{"value":"0.0028","scoring_system":"epss","scoring_elements":"0.51414","published_at":"2026-04-11T12:55:00Z"},{"value":"0.0028","scoring_system":"epss","scoring_elements":"0.5136","published_at":"2026-04-04T12:55:00Z"},{"value":"0.0028","scoring_system":"epss","scoring_elements":"0.51319","published_at":"2026-04-07T12:55:00Z"},{"value":"0.0028","scoring_system":"epss","scoring_elements":"0.51373","published_at":"2026-04-08T12:55:00Z"},{"value":"0.0028","scoring_system":"epss","scoring_elements":"0.51371","published_at":"2026-04-09T12:55:00Z"},{"value":"0.0028","scoring_system":"epss","scoring_elements":"0.5141","published_at":"2026-04-21T12:55:00Z"},{"value":"0.0028","scoring_system":"epss","scoring_elements":"0.5143","published_at":"2026-04-18T12:55:00Z"},{"value":"0.0028","scoring_system":"epss","scoring_elements":"0.51422","published_at":"2026-04-16T12:55:00Z"},{"value":"0.0028","scoring_system":"epss","scoring_elements":"0.51379","published_at":"2026-04-13T12:55:00Z"},{"value":"0.0028","scoring_system":"epss","scoring_elements":"0.51393","published_at":"2026-04-12T12:55:00Z"},{"value":"0.00297","scoring_system":"epss","scoring_elements":"0.53076","published_at":"2026-04-02T12:55:00Z"},{"value":"0.00317","scoring_system":"epss","scoring_elements":"0.5476","published_at":"2026-04-24T12:55:00Z"},{"value":"0.00317","scoring_system":"epss","scoring_elements":"0.5478","published_at":"2026-04-26T12:55:00Z"},{"value":"0.00317","scoring_system":"epss","scoring_elements":"0.54757","published_at":"2026-04-29T12:55:00Z"},{"value":"0.00317","scoring_system":"epss","scoring_elements":"0.54703","published_at":"2026-05-05T12:55:00Z"}],"url":"https://api.first.org/data/v1/epss?cve=CVE-2022-45198"},{"reference_url":"https://bugs.gentoo.org/855683","reference_id":"","reference_type":"","scores":[{"value":"7.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"},{"value":"8.7","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://bugs.gentoo.org/855683"},{"reference_url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-45198","reference_id":"","reference_type":"","scores":[],"url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-45198"},{"reference_url":"https://cwe.mitre.org/data/definitions/409.html","reference_id":"","reference_type":"","scores":[{"value":"7.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"},{"value":"8.7","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://cwe.mitre.org/data/definitions/409.html"},{"reference_url":"https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml","reference_id":"","reference_type":"","scores":[{"value":"5.3","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"}],"url":"https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml"},{"reference_url":"https://github.com/pypa/advisory-database/tree/main/vulns/pillow/PYSEC-2022-42979.yaml","reference_id":"","reference_type":"","scores":[{"value":"7.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"},{"value":"8.7","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/pypa/advisory-database/tree/main/vulns/pillow/PYSEC-2022-42979.yaml"},{"reference_url":"https://github.com/python-pillow/Pillow","reference_id":"","reference_type":"","scores":[{"value":"7.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"},{"value":"8.7","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/python-pillow/Pillow"},{"reference_url":"https://github.com/python-pillow/Pillow/commit/11918eac0628ec8ac0812670d9838361ead2d6a4","reference_id":"","reference_type":"","scores":[{"value":"7.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"},{"value":"8.7","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/python-pillow/Pillow/commit/11918eac0628ec8ac0812670d9838361ead2d6a4"},{"reference_url":"https://github.com/python-pillow/Pillow/pull/6402","reference_id":"","reference_type":"","scores":[{"value":"7.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"},{"value":"8.7","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/python-pillow/Pillow/pull/6402"},{"reference_url":"https://github.com/python-pillow/Pillow/pull/6402/commits/c9f1b35e981075110a23487a8d4a6cbb59a588ea","reference_id":"","reference_type":"","scores":[{"value":"7.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"},{"value":"8.7","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/python-pillow/Pillow/pull/6402/commits/c9f1b35e981075110a23487a8d4a6cbb59a588ea"},{"reference_url":"https://github.com/python-pillow/Pillow/releases/tag/9.2.0","reference_id":"","reference_type":"","scores":[{"value":"7.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"},{"value":"8.7","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/python-pillow/Pillow/releases/tag/9.2.0"},{"reference_url":"https://nvd.nist.gov/vuln/detail/CVE-2022-45198","reference_id":"","reference_type":"","scores":[{"value":"7.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"},{"value":"8.7","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-45198"},{"reference_url":"https://security.gentoo.org/glsa/202211-10","reference_id":"","reference_type":"","scores":[{"value":"7.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"},{"value":"8.7","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://security.gentoo.org/glsa/202211-10"},{"reference_url":"https://github.com/advisories/GHSA-m2vv-5vj5-2hm7","reference_id":"GHSA-m2vv-5vj5-2hm7","reference_type":"","scores":[{"value":"HIGH","scoring_system":"cvssv3.1_qr","scoring_elements":""}],"url":"https://github.com/advisories/GHSA-m2vv-5vj5-2hm7"},{"reference_url":"https://usn.ubuntu.com/5777-1/","reference_id":"USN-5777-1","reference_type":"","scores":[],"url":"https://usn.ubuntu.com/5777-1/"},{"reference_url":"https://usn.ubuntu.com/USN-5777-2/","reference_id":"USN-USN-5777-2","reference_type":"","scores":[],"url":"https://usn.ubuntu.com/USN-5777-2/"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/30049?format=json","purl":"pkg:pypi/pillow@9.2.0","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-4n96-uzyf-tud6"},{"vulnerability":"VCID-5rv4-k1q9-zue2"},{"vulnerability":"VCID-64n5-pugj-vue8"},{"vulnerability":"VCID-9ckw-ra54-z3b7"},{"vulnerability":"VCID-d7uf-zdbv-sba1"},{"vulnerability":"VCID-n1hp-atex-ubh4"},{"vulnerability":"VCID-vdzj-kqfy-d3b7"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:pypi/pillow@9.2.0"}],"aliases":["BIT-pillow-2022-45198","CVE-2022-45198","GHSA-m2vv-5vj5-2hm7","PYSEC-2022-42979"],"risk_score":4.0,"exploitability":"0.5","weighted_severity":"8.0","resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-19e1-19hk-duet"},{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/6583?format=json","vulnerability_id":"VCID-1vt7-c6e3-7qc8","summary":"The package pillow from 0 and before 8.3.2 are vulnerable to Regular Expression Denial of Service (ReDoS) via the getrgb function.","references":[{"reference_url":"https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2021-23437.json","reference_id":"","reference_type":"","scores":[{"value":"7.5","scoring_system":"cvssv3","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"url":"https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2021-23437.json"},{"reference_url":"https://api.first.org/data/v1/epss?cve=CVE-2021-23437","reference_id":"","reference_type":"","scores":[{"value":"0.00226","scoring_system":"epss","scoring_elements":"0.45314","published_at":"2026-04-01T12:55:00Z"},{"value":"0.00226","scoring_system":"epss","scoring_elements":"0.45402","published_at":"2026-04-21T12:55:00Z"},{"value":"0.00226","scoring_system":"epss","scoring_elements":"0.45452","published_at":"2026-04-18T12:55:00Z"},{"value":"0.00226","scoring_system":"epss","scoring_elements":"0.45456","published_at":"2026-04-16T12:55:00Z"},{"value":"0.00226","scoring_system":"epss","scoring_elements":"0.45405","published_at":"2026-04-13T12:55:00Z"},{"value":"0.00226","scoring_system":"epss","scoring_elements":"0.45404","published_at":"2026-04-12T12:55:00Z"},{"value":"0.00226","scoring_system":"epss","scoring_elements":"0.45434","published_at":"2026-04-11T12:55:00Z"},{"value":"0.00226","scoring_system":"epss","scoring_elements":"0.45412","published_at":"2026-04-09T12:55:00Z"},{"value":"0.00226","scoring_system":"epss","scoring_elements":"0.45357","published_at":"2026-04-07T12:55:00Z"},{"value":"0.00226","scoring_system":"epss","scoring_elements":"0.45414","published_at":"2026-04-04T12:55:00Z"},{"value":"0.00226","scoring_system":"epss","scoring_elements":"0.45394","published_at":"2026-04-02T12:55:00Z"},{"value":"0.00226","scoring_system":"epss","scoring_elements":"0.45158","published_at":"2026-05-05T12:55:00Z"},{"value":"0.00226","scoring_system":"epss","scoring_elements":"0.45261","published_at":"2026-04-29T12:55:00Z"},{"value":"0.00226","scoring_system":"epss","scoring_elements":"0.45321","published_at":"2026-04-26T12:55:00Z"},{"value":"0.00226","scoring_system":"epss","scoring_elements":"0.45315","published_at":"2026-04-24T12:55:00Z"}],"url":"https://api.first.org/data/v1/epss?cve=CVE-2021-23437"},{"reference_url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-23437","reference_id":"","reference_type":"","scores":[],"url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-23437"},{"reference_url":"https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml","reference_id":"","reference_type":"","scores":[{"value":"7.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"url":"https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml"},{"reference_url":"https://github.com/advisories/GHSA-98vv-pw6r-q6q4","reference_id":"","reference_type":"","scores":[{"value":"7.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"},{"value":"HIGH","scoring_system":"cvssv3.1_qr","scoring_elements":""},{"value":"8.7","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/advisories/GHSA-98vv-pw6r-q6q4"},{"reference_url":"https://github.com/pypa/advisory-database/tree/main/vulns/pillow/PYSEC-2021-317.yaml","reference_id":"","reference_type":"","scores":[{"value":"7.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"},{"value":"8.7","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/pypa/advisory-database/tree/main/vulns/pillow/PYSEC-2021-317.yaml"},{"reference_url":"https://github.com/python-pillow/Pillow","reference_id":"","reference_type":"","scores":[{"value":"7.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"},{"value":"8.7","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/python-pillow/Pillow"},{"reference_url":"https://github.com/python-pillow/Pillow/commit/9e08eb8f78fdfd2f476e1b20b7cf38683754866b","reference_id":"","reference_type":"","scores":[{"value":"7.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"},{"value":"8.7","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/python-pillow/Pillow/commit/9e08eb8f78fdfd2f476e1b20b7cf38683754866b"},{"reference_url":"https://lists.debian.org/debian-lts-announce/2024/03/msg00021.html","reference_id":"","reference_type":"","scores":[{"value":"7.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"},{"value":"8.7","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://lists.debian.org/debian-lts-announce/2024/03/msg00021.html"},{"reference_url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/RNSG6VFXTAROGF7ACYLMAZNQV4EJ6I2C","reference_id":"","reference_type":"","scores":[{"value":"7.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"},{"value":"8.7","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/RNSG6VFXTAROGF7ACYLMAZNQV4EJ6I2C"},{"reference_url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VKRCL7KKAKOXCVD7M6WC5OKFGL4L3SJT","reference_id":"","reference_type":"","scores":[{"value":"7.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"},{"value":"8.7","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VKRCL7KKAKOXCVD7M6WC5OKFGL4L3SJT"},{"reference_url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/RNSG6VFXTAROGF7ACYLMAZNQV4EJ6I2C","reference_id":"","reference_type":"","scores":[{"value":"7.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"},{"value":"8.7","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/RNSG6VFXTAROGF7ACYLMAZNQV4EJ6I2C"},{"reference_url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/VKRCL7KKAKOXCVD7M6WC5OKFGL4L3SJT","reference_id":"","reference_type":"","scores":[{"value":"7.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"},{"value":"8.7","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/VKRCL7KKAKOXCVD7M6WC5OKFGL4L3SJT"},{"reference_url":"https://pillow.readthedocs.io/en/stable/releasenotes/8.3.2.html","reference_id":"","reference_type":"","scores":[{"value":"7.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"},{"value":"8.7","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://pillow.readthedocs.io/en/stable/releasenotes/8.3.2.html"},{"reference_url":"https://security.gentoo.org/glsa/202211-10","reference_id":"","reference_type":"","scores":[{"value":"7.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"},{"value":"8.7","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://security.gentoo.org/glsa/202211-10"},{"reference_url":"https://snyk.io/vuln/SNYK-PYTHON-PILLOW-1319443","reference_id":"","reference_type":"","scores":[{"value":"7.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"},{"value":"8.7","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://snyk.io/vuln/SNYK-PYTHON-PILLOW-1319443"},{"reference_url":"https://bugzilla.redhat.com/show_bug.cgi?id=2001907","reference_id":"2001907","reference_type":"","scores":[],"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2001907"},{"reference_url":"https://security.archlinux.org/AVG-2366","reference_id":"AVG-2366","reference_type":"","scores":[{"value":"Low","scoring_system":"archlinux","scoring_elements":""}],"url":"https://security.archlinux.org/AVG-2366"},{"reference_url":"https://nvd.nist.gov/vuln/detail/CVE-2021-23437","reference_id":"CVE-2021-23437","reference_type":"","scores":[{"value":"7.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"},{"value":"8.7","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-23437"},{"reference_url":"https://usn.ubuntu.com/5227-1/","reference_id":"USN-5227-1","reference_type":"","scores":[],"url":"https://usn.ubuntu.com/5227-1/"},{"reference_url":"https://usn.ubuntu.com/5227-2/","reference_id":"USN-5227-2","reference_type":"","scores":[],"url":"https://usn.ubuntu.com/5227-2/"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/18551?format=json","purl":"pkg:pypi/pillow@8.3.2","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-19e1-19hk-duet"},{"vulnerability":"VCID-5rv4-k1q9-zue2"},{"vulnerability":"VCID-64n5-pugj-vue8"},{"vulnerability":"VCID-9ckw-ra54-z3b7"},{"vulnerability":"VCID-brp2-dtrf-jyfr"},{"vulnerability":"VCID-d7uf-zdbv-sba1"},{"vulnerability":"VCID-df4x-jt3h-17hx"},{"vulnerability":"VCID-dpc3-td9q-dyee"},{"vulnerability":"VCID-g46h-p8jk-cuhc"},{"vulnerability":"VCID-n1hp-atex-ubh4"},{"vulnerability":"VCID-q4bb-qnxe-8bfa"},{"vulnerability":"VCID-vdzj-kqfy-d3b7"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:pypi/pillow@8.3.2"}],"aliases":["BIT-pillow-2021-23437","CVE-2021-23437","GHSA-98vv-pw6r-q6q4","PYSEC-2021-317","SNYK-PYTHON-PILLOW-1319443"],"risk_score":4.0,"exploitability":"0.5","weighted_severity":"8.0","resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-1vt7-c6e3-7qc8"},{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/5508?format=json","vulnerability_id":"VCID-366h-8f99-r7at","summary":"Buffer overflow in the ImagingFliDecode function in libImaging/FliDecode.c in Pillow before 3.1.1 allows remote attackers to cause a denial of service (crash) via a crafted FLI file.","references":[{"reference_url":"https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2016-0775.json","reference_id":"","reference_type":"","scores":[],"url":"https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2016-0775.json"},{"reference_url":"https://api.first.org/data/v1/epss?cve=CVE-2016-0775","reference_id":"","reference_type":"","scores":[{"value":"0.01069","scoring_system":"epss","scoring_elements":"0.77724","published_at":"2026-04-13T12:55:00Z"},{"value":"0.01069","scoring_system":"epss","scoring_elements":"0.77664","published_at":"2026-04-01T12:55:00Z"},{"value":"0.01069","scoring_system":"epss","scoring_elements":"0.77823","published_at":"2026-05-05T12:55:00Z"},{"value":"0.01069","scoring_system":"epss","scoring_elements":"0.7781","published_at":"2026-04-29T12:55:00Z"},{"value":"0.01069","scoring_system":"epss","scoring_elements":"0.77795","published_at":"2026-04-26T12:55:00Z"},{"value":"0.01069","scoring_system":"epss","scoring_elements":"0.77786","published_at":"2026-04-24T12:55:00Z"},{"value":"0.01069","scoring_system":"epss","scoring_elements":"0.77754","published_at":"2026-04-21T12:55:00Z"},{"value":"0.01069","scoring_system":"epss","scoring_elements":"0.7776","published_at":"2026-04-18T12:55:00Z"},{"value":"0.01069","scoring_system":"epss","scoring_elements":"0.77761","published_at":"2026-04-16T12:55:00Z"},{"value":"0.01069","scoring_system":"epss","scoring_elements":"0.77671","published_at":"2026-04-02T12:55:00Z"},{"value":"0.01069","scoring_system":"epss","scoring_elements":"0.77698","published_at":"2026-04-04T12:55:00Z"},{"value":"0.01069","scoring_system":"epss","scoring_elements":"0.77681","published_at":"2026-04-07T12:55:00Z"},{"value":"0.01069","scoring_system":"epss","scoring_elements":"0.77709","published_at":"2026-04-08T12:55:00Z"},{"value":"0.01069","scoring_system":"epss","scoring_elements":"0.77714","published_at":"2026-04-09T12:55:00Z"},{"value":"0.01069","scoring_system":"epss","scoring_elements":"0.7774","published_at":"2026-04-11T12:55:00Z"}],"url":"https://api.first.org/data/v1/epss?cve=CVE-2016-0775"},{"reference_url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-0740","reference_id":"","reference_type":"","scores":[],"url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-0740"},{"reference_url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-0775","reference_id":"","reference_type":"","scores":[],"url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-0775"},{"reference_url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-2533","reference_id":"","reference_type":"","scores":[],"url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-2533"},{"reference_url":"https://github.com/advisories/GHSA-8xjv-v9xq-m5h9","reference_id":"","reference_type":"","scores":[{"value":"6.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H"},{"value":"HIGH","scoring_system":"cvssv3.1_qr","scoring_elements":""},{"value":"7.1","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/advisories/GHSA-8xjv-v9xq-m5h9"},{"reference_url":"https://github.com/pypa/advisory-database/tree/main/vulns/pillow/PYSEC-2016-6.yaml","reference_id":"","reference_type":"","scores":[{"value":"6.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H"},{"value":"7.1","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/pypa/advisory-database/tree/main/vulns/pillow/PYSEC-2016-6.yaml"},{"reference_url":"https://github.com/python-pillow/Pillow","reference_id":"","reference_type":"","scores":[{"value":"6.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H"},{"value":"7.1","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/python-pillow/Pillow"},{"reference_url":"https://github.com/python-pillow/Pillow/blob/c3cb690fed5d4bf0c45576759de55d054916c165/CHANGES.rst","reference_id":"","reference_type":"","scores":[{"value":"6.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H"},{"value":"7.1","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/python-pillow/Pillow/blob/c3cb690fed5d4bf0c45576759de55d054916c165/CHANGES.rst"},{"reference_url":"https://github.com/python-pillow/Pillow/commit/893a40850c2d5da41537958e40569c029a6e127b","reference_id":"","reference_type":"","scores":[{"value":"6.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H"},{"value":"7.1","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/python-pillow/Pillow/commit/893a40850c2d5da41537958e40569c029a6e127b"},{"reference_url":"https://security.gentoo.org/glsa/201612-52","reference_id":"","reference_type":"","scores":[{"value":"6.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H"},{"value":"7.1","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://security.gentoo.org/glsa/201612-52"},{"reference_url":"http://www.debian.org/security/2016/dsa-3499","reference_id":"","reference_type":"","scores":[{"value":"6.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H"},{"value":"7.1","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"http://www.debian.org/security/2016/dsa-3499"},{"reference_url":"https://bugzilla.redhat.com/show_bug.cgi?id=1301621","reference_id":"1301621","reference_type":"","scores":[],"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1301621"},{"reference_url":"https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=813909","reference_id":"813909","reference_type":"","scores":[],"url":"https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=813909"},{"reference_url":"https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:python:pillow:*:*:*:*:*:*:*:*","reference_id":"cpe:2.3:a:python:pillow:*:*:*:*:*:*:*:*","reference_type":"","scores":[],"url":"https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:python:pillow:*:*:*:*:*:*:*:*"},{"reference_url":"https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:o:debian:debian_linux:7.0:*:*:*:*:*:*:*","reference_id":"cpe:2.3:o:debian:debian_linux:7.0:*:*:*:*:*:*:*","reference_type":"","scores":[],"url":"https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:o:debian:debian_linux:7.0:*:*:*:*:*:*:*"},{"reference_url":"https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*","reference_id":"cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*","reference_type":"","scores":[],"url":"https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*"},{"reference_url":"https://nvd.nist.gov/vuln/detail/CVE-2016-0775","reference_id":"CVE-2016-0775","reference_type":"","scores":[{"value":"4.3","scoring_system":"cvssv2","scoring_elements":"AV:N/AC:M/Au:N/C:N/I:N/A:P"},{"value":"6.5","scoring_system":"cvssv3","scoring_elements":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H"},{"value":"6.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H"},{"value":"7.1","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://nvd.nist.gov/vuln/detail/CVE-2016-0775"},{"reference_url":"https://usn.ubuntu.com/3080-1/","reference_id":"USN-3080-1","reference_type":"","scores":[],"url":"https://usn.ubuntu.com/3080-1/"},{"reference_url":"https://usn.ubuntu.com/3090-1/","reference_id":"USN-3090-1","reference_type":"","scores":[],"url":"https://usn.ubuntu.com/3090-1/"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/4257?format=json","purl":"pkg:pypi/pillow@3.1.1","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-19e1-19hk-duet"},{"vulnerability":"VCID-1vt7-c6e3-7qc8"},{"vulnerability":"VCID-3qb5-8p8w-gkad"},{"vulnerability":"VCID-3uk9-eds5-rkgc"},{"vulnerability":"VCID-53ac-ceq4-qkhf"},{"vulnerability":"VCID-5rv4-k1q9-zue2"},{"vulnerability":"VCID-64n5-pugj-vue8"},{"vulnerability":"VCID-6gyu-fzpg-c3bn"},{"vulnerability":"VCID-8n2b-wvya-53e1"},{"vulnerability":"VCID-9ckw-ra54-z3b7"},{"vulnerability":"VCID-and9-6jty-pyeq"},{"vulnerability":"VCID-aubw-tsmn-ffcq"},{"vulnerability":"VCID-b3au-rcgp-2fag"},{"vulnerability":"VCID-b5a2-83ej-puaw"},{"vulnerability":"VCID-brp2-dtrf-jyfr"},{"vulnerability":"VCID-cas2-jb3y-vyhz"},{"vulnerability":"VCID-d7uf-zdbv-sba1"},{"vulnerability":"VCID-df4x-jt3h-17hx"},{"vulnerability":"VCID-dpc3-td9q-dyee"},{"vulnerability":"VCID-e3gp-zc2b-budg"},{"vulnerability":"VCID-en6t-uxtq-bfek"},{"vulnerability":"VCID-g46h-p8jk-cuhc"},{"vulnerability":"VCID-gvjw-funa-sqak"},{"vulnerability":"VCID-h4x7-7fke-mqgp"},{"vulnerability":"VCID-haum-8zpg-6kgf"},{"vulnerability":"VCID-hmmq-5772-bycm"},{"vulnerability":"VCID-khp6-9hfx-1kge"},{"vulnerability":"VCID-m3tm-h4q9-9yay"},{"vulnerability":"VCID-n1hp-atex-ubh4"},{"vulnerability":"VCID-n1w5-f5p7-xuhb"},{"vulnerability":"VCID-p6r3-puh1-zyg6"},{"vulnerability":"VCID-q4bb-qnxe-8bfa"},{"vulnerability":"VCID-rncf-9nf8-wud3"},{"vulnerability":"VCID-sns1-ksqr-vbhr"},{"vulnerability":"VCID-stft-hsk9-zfdy"},{"vulnerability":"VCID-u1en-t8ux-uube"},{"vulnerability":"VCID-ue18-zzau-x7hy"},{"vulnerability":"VCID-uf5t-asns-tudp"},{"vulnerability":"VCID-vdzj-kqfy-d3b7"},{"vulnerability":"VCID-vwbu-ruxm-tbh4"},{"vulnerability":"VCID-vxh1-8rvt-kkak"},{"vulnerability":"VCID-vyzt-df2u-h3cc"},{"vulnerability":"VCID-w9uy-fnpm-cbak"},{"vulnerability":"VCID-x15z-dejc-9ba6"},{"vulnerability":"VCID-xesd-d294-7fcx"},{"vulnerability":"VCID-xk66-1d31-2qbk"},{"vulnerability":"VCID-yccg-zw89-vqff"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:pypi/pillow@3.1.1"}],"aliases":["CVE-2016-0775","GHSA-8xjv-v9xq-m5h9","PYSEC-2016-6"],"risk_score":4.0,"exploitability":"0.5","weighted_severity":"8.0","resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-366h-8f99-r7at"},{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/6279?format=json","vulnerability_id":"VCID-3qb5-8p8w-gkad","summary":"Pillow before 8.1.1 allows attackers to cause a denial of service (memory consumption) because the reported size of a contained image is not properly checked for a BLP container, and thus an attempted memory allocation can be very large.","references":[{"reference_url":"https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2021-27921.json","reference_id":"","reference_type":"","scores":[{"value":"7.5","scoring_system":"cvssv3","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"url":"https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2021-27921.json"},{"reference_url":"https://api.first.org/data/v1/epss?cve=CVE-2021-27921","reference_id":"","reference_type":"","scores":[{"value":"0.00419","scoring_system":"epss","scoring_elements":"0.61759","published_at":"2026-04-01T12:55:00Z"},{"value":"0.00419","scoring_system":"epss","scoring_elements":"0.61937","published_at":"2026-04-18T12:55:00Z"},{"value":"0.00419","scoring_system":"epss","scoring_elements":"0.61933","published_at":"2026-04-16T12:55:00Z"},{"value":"0.00419","scoring_system":"epss","scoring_elements":"0.61889","published_at":"2026-04-13T12:55:00Z"},{"value":"0.00419","scoring_system":"epss","scoring_elements":"0.61909","published_at":"2026-04-12T12:55:00Z"},{"value":"0.00419","scoring_system":"epss","scoring_elements":"0.61921","published_at":"2026-04-11T12:55:00Z"},{"value":"0.00419","scoring_system":"epss","scoring_elements":"0.619","published_at":"2026-04-09T12:55:00Z"},{"value":"0.00419","scoring_system":"epss","scoring_elements":"0.61885","published_at":"2026-04-08T12:55:00Z"},{"value":"0.00419","scoring_system":"epss","scoring_elements":"0.61835","published_at":"2026-04-07T12:55:00Z"},{"value":"0.00419","scoring_system":"epss","scoring_elements":"0.61864","published_at":"2026-04-04T12:55:00Z"},{"value":"0.00419","scoring_system":"epss","scoring_elements":"0.61833","published_at":"2026-04-02T12:55:00Z"},{"value":"0.00425","scoring_system":"epss","scoring_elements":"0.62268","published_at":"2026-04-24T12:55:00Z"},{"value":"0.00425","scoring_system":"epss","scoring_elements":"0.62278","published_at":"2026-04-29T12:55:00Z"},{"value":"0.00425","scoring_system":"epss","scoring_elements":"0.62285","published_at":"2026-04-26T12:55:00Z"},{"value":"0.00425","scoring_system":"epss","scoring_elements":"0.62258","published_at":"2026-04-21T12:55:00Z"},{"value":"0.00425","scoring_system":"epss","scoring_elements":"0.62224","published_at":"2026-05-05T12:55:00Z"}],"url":"https://api.first.org/data/v1/epss?cve=CVE-2021-27921"},{"reference_url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-27921","reference_id":"","reference_type":"","scores":[],"url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-27921"},{"reference_url":"https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml","reference_id":"","reference_type":"","scores":[{"value":"7.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"url":"https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml"},{"reference_url":"https://github.com/advisories/GHSA-f4w8-cv6p-x6r5","reference_id":"","reference_type":"","scores":[{"value":"HIGH","scoring_system":"cvssv3.1_qr","scoring_elements":""}],"url":"https://github.com/advisories/GHSA-f4w8-cv6p-x6r5"},{"reference_url":"https://github.com/pypa/advisory-database/tree/main/vulns/pillow/PYSEC-2021-40.yaml","reference_id":"","reference_type":"","scores":[{"value":"7.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"},{"value":"8.7","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/pypa/advisory-database/tree/main/vulns/pillow/PYSEC-2021-40.yaml"},{"reference_url":"https://github.com/python-pillow/Pillow","reference_id":"","reference_type":"","scores":[{"value":"7.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"},{"value":"8.7","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/python-pillow/Pillow"},{"reference_url":"https://github.com/python-pillow/Pillow/commit/756fff33128a0b643d10518a26ad04b726dd8973","reference_id":"","reference_type":"","scores":[{"value":"7.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"},{"value":"8.7","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/python-pillow/Pillow/commit/756fff33128a0b643d10518a26ad04b726dd8973"},{"reference_url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/S7G44Z33J4BNI2DPDROHWGVG2U7ZH5JU","reference_id":"","reference_type":"","scores":[{"value":"7.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"},{"value":"8.7","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/S7G44Z33J4BNI2DPDROHWGVG2U7ZH5JU"},{"reference_url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/TQQY6472RX4J2SUJENWDZAWKTJJGP2ML","reference_id":"","reference_type":"","scores":[{"value":"7.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"},{"value":"8.7","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/TQQY6472RX4J2SUJENWDZAWKTJJGP2ML"},{"reference_url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZTSY25UJU7NJUFHH3HWT575LT4TDFWBZ","reference_id":"","reference_type":"","scores":[{"value":"7.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"},{"value":"8.7","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZTSY25UJU7NJUFHH3HWT575LT4TDFWBZ"},{"reference_url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/S7G44Z33J4BNI2DPDROHWGVG2U7ZH5JU","reference_id":"","reference_type":"","scores":[{"value":"7.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"},{"value":"8.7","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/S7G44Z33J4BNI2DPDROHWGVG2U7ZH5JU"},{"reference_url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/S7G44Z33J4BNI2DPDROHWGVG2U7ZH5JU/","reference_id":"","reference_type":"","scores":[],"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/S7G44Z33J4BNI2DPDROHWGVG2U7ZH5JU/"},{"reference_url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/TQQY6472RX4J2SUJENWDZAWKTJJGP2ML","reference_id":"","reference_type":"","scores":[{"value":"7.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"},{"value":"8.7","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/TQQY6472RX4J2SUJENWDZAWKTJJGP2ML"},{"reference_url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/TQQY6472RX4J2SUJENWDZAWKTJJGP2ML/","reference_id":"","reference_type":"","scores":[],"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/TQQY6472RX4J2SUJENWDZAWKTJJGP2ML/"},{"reference_url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZTSY25UJU7NJUFHH3HWT575LT4TDFWBZ","reference_id":"","reference_type":"","scores":[{"value":"7.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"},{"value":"8.7","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZTSY25UJU7NJUFHH3HWT575LT4TDFWBZ"},{"reference_url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZTSY25UJU7NJUFHH3HWT575LT4TDFWBZ/","reference_id":"","reference_type":"","scores":[],"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZTSY25UJU7NJUFHH3HWT575LT4TDFWBZ/"},{"reference_url":"https://nvd.nist.gov/vuln/detail/CVE-2021-27921","reference_id":"","reference_type":"","scores":[{"value":"7.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"},{"value":"8.7","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-27921"},{"reference_url":"https://pillow.readthedocs.io/en/stable/releasenotes/8.1.1.html","reference_id":"","reference_type":"","scores":[{"value":"7.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"},{"value":"8.7","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://pillow.readthedocs.io/en/stable/releasenotes/8.1.1.html"},{"reference_url":"https://pillow.readthedocs.io/en/stable/releasenotes/8.1.2.html","reference_id":"","reference_type":"","scores":[{"value":"7.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"},{"value":"8.7","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://pillow.readthedocs.io/en/stable/releasenotes/8.1.2.html"},{"reference_url":"https://security.gentoo.org/glsa/202107-33","reference_id":"","reference_type":"","scores":[{"value":"7.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"},{"value":"8.7","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://security.gentoo.org/glsa/202107-33"},{"reference_url":"https://bugzilla.redhat.com/show_bug.cgi?id=1935384","reference_id":"1935384","reference_type":"","scores":[],"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1935384"},{"reference_url":"https://security.archlinux.org/AVG-1635","reference_id":"AVG-1635","reference_type":"","scores":[{"value":"Medium","scoring_system":"archlinux","scoring_elements":""}],"url":"https://security.archlinux.org/AVG-1635"},{"reference_url":"https://access.redhat.com/errata/RHSA-2021:3917","reference_id":"RHSA-2021:3917","reference_type":"","scores":[],"url":"https://access.redhat.com/errata/RHSA-2021:3917"},{"reference_url":"https://access.redhat.com/errata/RHSA-2021:4149","reference_id":"RHSA-2021:4149","reference_type":"","scores":[],"url":"https://access.redhat.com/errata/RHSA-2021:4149"},{"reference_url":"https://usn.ubuntu.com/4763-1/","reference_id":"USN-4763-1","reference_type":"","scores":[],"url":"https://usn.ubuntu.com/4763-1/"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/15250?format=json","purl":"pkg:pypi/pillow@8.1.1","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-19e1-19hk-duet"},{"vulnerability":"VCID-1vt7-c6e3-7qc8"},{"vulnerability":"VCID-3qb5-8p8w-gkad"},{"vulnerability":"VCID-3uk9-eds5-rkgc"},{"vulnerability":"VCID-53ac-ceq4-qkhf"},{"vulnerability":"VCID-5rv4-k1q9-zue2"},{"vulnerability":"VCID-64n5-pugj-vue8"},{"vulnerability":"VCID-9ckw-ra54-z3b7"},{"vulnerability":"VCID-aubw-tsmn-ffcq"},{"vulnerability":"VCID-brp2-dtrf-jyfr"},{"vulnerability":"VCID-d7uf-zdbv-sba1"},{"vulnerability":"VCID-df4x-jt3h-17hx"},{"vulnerability":"VCID-dpc3-td9q-dyee"},{"vulnerability":"VCID-g46h-p8jk-cuhc"},{"vulnerability":"VCID-gvjw-funa-sqak"},{"vulnerability":"VCID-n1hp-atex-ubh4"},{"vulnerability":"VCID-n1w5-f5p7-xuhb"},{"vulnerability":"VCID-q4bb-qnxe-8bfa"},{"vulnerability":"VCID-ue18-zzau-x7hy"},{"vulnerability":"VCID-vdzj-kqfy-d3b7"},{"vulnerability":"VCID-vwbu-ruxm-tbh4"},{"vulnerability":"VCID-vyzt-df2u-h3cc"},{"vulnerability":"VCID-w9uy-fnpm-cbak"},{"vulnerability":"VCID-xesd-d294-7fcx"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:pypi/pillow@8.1.1"},{"url":"http://public2.vulnerablecode.io/api/packages/17187?format=json","purl":"pkg:pypi/pillow@8.1.2","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-19e1-19hk-duet"},{"vulnerability":"VCID-1vt7-c6e3-7qc8"},{"vulnerability":"VCID-3uk9-eds5-rkgc"},{"vulnerability":"VCID-5rv4-k1q9-zue2"},{"vulnerability":"VCID-64n5-pugj-vue8"},{"vulnerability":"VCID-9ckw-ra54-z3b7"},{"vulnerability":"VCID-aubw-tsmn-ffcq"},{"vulnerability":"VCID-brp2-dtrf-jyfr"},{"vulnerability":"VCID-d7uf-zdbv-sba1"},{"vulnerability":"VCID-df4x-jt3h-17hx"},{"vulnerability":"VCID-dpc3-td9q-dyee"},{"vulnerability":"VCID-g46h-p8jk-cuhc"},{"vulnerability":"VCID-n1hp-atex-ubh4"},{"vulnerability":"VCID-n1w5-f5p7-xuhb"},{"vulnerability":"VCID-q4bb-qnxe-8bfa"},{"vulnerability":"VCID-ue18-zzau-x7hy"},{"vulnerability":"VCID-vdzj-kqfy-d3b7"},{"vulnerability":"VCID-vwbu-ruxm-tbh4"},{"vulnerability":"VCID-vyzt-df2u-h3cc"},{"vulnerability":"VCID-w9uy-fnpm-cbak"},{"vulnerability":"VCID-xesd-d294-7fcx"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:pypi/pillow@8.1.2"}],"aliases":["BIT-pillow-2021-27921","CVE-2021-27921","GHSA-f4w8-cv6p-x6r5","PYSEC-2021-40"],"risk_score":4.0,"exploitability":"0.5","weighted_severity":"8.0","resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-3qb5-8p8w-gkad"},{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/6463?format=json","vulnerability_id":"VCID-3uk9-eds5-rkgc","summary":"An issue was discovered in Pillow before 8.2.0. PSDImagePlugin.PsdImageFile lacked a sanity check on the number of input layers relative to the size of the data block. This could lead to a DoS on Image.open prior to Image.load.","references":[{"reference_url":"https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2021-28675.json","reference_id":"","reference_type":"","scores":[{"value":"5.5","scoring_system":"cvssv3","scoring_elements":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H"}],"url":"https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2021-28675.json"},{"reference_url":"https://api.first.org/data/v1/epss?cve=CVE-2021-28675","reference_id":"","reference_type":"","scores":[{"value":"0.00115","scoring_system":"epss","scoring_elements":"0.30183","published_at":"2026-04-01T12:55:00Z"},{"value":"0.00115","scoring_system":"epss","scoring_elements":"0.30179","published_at":"2026-04-11T12:55:00Z"},{"value":"0.00115","scoring_system":"epss","scoring_elements":"0.30214","published_at":"2026-04-02T12:55:00Z"},{"value":"0.00115","scoring_system":"epss","scoring_elements":"0.30263","published_at":"2026-04-04T12:55:00Z"},{"value":"0.00115","scoring_system":"epss","scoring_elements":"0.30081","published_at":"2026-04-07T12:55:00Z"},{"value":"0.00115","scoring_system":"epss","scoring_elements":"0.3014","published_at":"2026-04-08T12:55:00Z"},{"value":"0.00115","scoring_system":"epss","scoring_elements":"0.30086","published_at":"2026-04-13T12:55:00Z"},{"value":"0.00115","scoring_system":"epss","scoring_elements":"0.30135","published_at":"2026-04-12T12:55:00Z"},{"value":"0.00115","scoring_system":"epss","scoring_elements":"0.30176","published_at":"2026-04-09T12:55:00Z"},{"value":"0.00115","scoring_system":"epss","scoring_elements":"0.3008","published_at":"2026-04-18T12:55:00Z"},{"value":"0.00115","scoring_system":"epss","scoring_elements":"0.301","published_at":"2026-04-16T12:55:00Z"},{"value":"0.00144","scoring_system":"epss","scoring_elements":"0.34445","published_at":"2026-04-24T12:55:00Z"},{"value":"0.00144","scoring_system":"epss","scoring_elements":"0.3434","published_at":"2026-04-29T12:55:00Z"},{"value":"0.00144","scoring_system":"epss","scoring_elements":"0.34426","published_at":"2026-04-26T12:55:00Z"},{"value":"0.00144","scoring_system":"epss","scoring_elements":"0.34212","published_at":"2026-05-05T12:55:00Z"},{"value":"0.00148","scoring_system":"epss","scoring_elements":"0.35257","published_at":"2026-04-21T12:55:00Z"}],"url":"https://api.first.org/data/v1/epss?cve=CVE-2021-28675"},{"reference_url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-28675","reference_id":"","reference_type":"","scores":[],"url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-28675"},{"reference_url":"https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml","reference_id":"","reference_type":"","scores":[{"value":"7.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"url":"https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml"},{"reference_url":"https://github.com/advisories/GHSA-g6rj-rv7j-xwp4","reference_id":"","reference_type":"","scores":[{"value":"5.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H"},{"value":"HIGH","scoring_system":"cvssv3.1_qr","scoring_elements":""},{"value":"7.1","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/advisories/GHSA-g6rj-rv7j-xwp4"},{"reference_url":"https://github.com/pypa/advisory-database/tree/main/vulns/pillow/PYSEC-2021-139.yaml","reference_id":"","reference_type":"","scores":[{"value":"5.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H"},{"value":"7.1","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/pypa/advisory-database/tree/main/vulns/pillow/PYSEC-2021-139.yaml"},{"reference_url":"https://github.com/python-pillow/Pillow","reference_id":"","reference_type":"","scores":[{"value":"5.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H"},{"value":"7.1","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/python-pillow/Pillow"},{"reference_url":"https://github.com/python-pillow/Pillow/pull/5377/commits/22e9bee4ef225c0edbb9323f94c26cee0c623497","reference_id":"","reference_type":"","scores":[{"value":"5.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H"},{"value":"7.1","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/python-pillow/Pillow/pull/5377/commits/22e9bee4ef225c0edbb9323f94c26cee0c623497"},{"reference_url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/MQHA5HAIBOYI3R6HDWCLAGFTIQP767FL","reference_id":"","reference_type":"","scores":[{"value":"5.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H"},{"value":"7.1","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/MQHA5HAIBOYI3R6HDWCLAGFTIQP767FL"},{"reference_url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/MQHA5HAIBOYI3R6HDWCLAGFTIQP767FL/","reference_id":"","reference_type":"","scores":[],"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/MQHA5HAIBOYI3R6HDWCLAGFTIQP767FL/"},{"reference_url":"https://nvd.nist.gov/vuln/detail/CVE-2021-28675","reference_id":"","reference_type":"","scores":[{"value":"5.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H"},{"value":"7.1","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-28675"},{"reference_url":"https://pillow.readthedocs.io/en/stable/releasenotes/8.2.0.html#cve-2021-28675-fix-dos-in-psdimageplugin","reference_id":"","reference_type":"","scores":[{"value":"5.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H"},{"value":"7.1","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://pillow.readthedocs.io/en/stable/releasenotes/8.2.0.html#cve-2021-28675-fix-dos-in-psdimageplugin"},{"reference_url":"https://security.gentoo.org/glsa/202107-33","reference_id":"","reference_type":"","scores":[{"value":"5.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H"},{"value":"7.1","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://security.gentoo.org/glsa/202107-33"},{"reference_url":"https://bugzilla.redhat.com/show_bug.cgi?id=1958240","reference_id":"1958240","reference_type":"","scores":[],"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1958240"},{"reference_url":"https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=989062","reference_id":"989062","reference_type":"","scores":[],"url":"https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=989062"},{"reference_url":"https://access.redhat.com/errata/RHSA-2021:4149","reference_id":"RHSA-2021:4149","reference_type":"","scores":[],"url":"https://access.redhat.com/errata/RHSA-2021:4149"},{"reference_url":"https://usn.ubuntu.com/4963-1/","reference_id":"USN-4963-1","reference_type":"","scores":[],"url":"https://usn.ubuntu.com/4963-1/"},{"reference_url":"https://usn.ubuntu.com/8135-1/","reference_id":"USN-8135-1","reference_type":"","scores":[],"url":"https://usn.ubuntu.com/8135-1/"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/17188?format=json","purl":"pkg:pypi/pillow@8.2.0","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-19e1-19hk-duet"},{"vulnerability":"VCID-1vt7-c6e3-7qc8"},{"vulnerability":"VCID-5rv4-k1q9-zue2"},{"vulnerability":"VCID-64n5-pugj-vue8"},{"vulnerability":"VCID-9ckw-ra54-z3b7"},{"vulnerability":"VCID-brp2-dtrf-jyfr"},{"vulnerability":"VCID-d7uf-zdbv-sba1"},{"vulnerability":"VCID-df4x-jt3h-17hx"},{"vulnerability":"VCID-dpc3-td9q-dyee"},{"vulnerability":"VCID-g46h-p8jk-cuhc"},{"vulnerability":"VCID-n1hp-atex-ubh4"},{"vulnerability":"VCID-q4bb-qnxe-8bfa"},{"vulnerability":"VCID-vdzj-kqfy-d3b7"},{"vulnerability":"VCID-w9uy-fnpm-cbak"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:pypi/pillow@8.2.0"}],"aliases":["BIT-pillow-2021-28675","CVE-2021-28675","GHSA-g6rj-rv7j-xwp4","PYSEC-2021-139"],"risk_score":4.0,"exploitability":"0.5","weighted_severity":"8.0","resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-3uk9-eds5-rkgc"},{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/6280?format=json","vulnerability_id":"VCID-53ac-ceq4-qkhf","summary":"Pillow before 8.1.1 allows attackers to cause a denial of service (memory consumption) because the reported size of a contained image is not properly checked for an ICNS container, and thus an attempted memory allocation can be very large.","references":[{"reference_url":"https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2021-27922.json","reference_id":"","reference_type":"","scores":[{"value":"7.5","scoring_system":"cvssv3","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"url":"https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2021-27922.json"},{"reference_url":"https://api.first.org/data/v1/epss?cve=CVE-2021-27922","reference_id":"","reference_type":"","scores":[{"value":"0.00145","scoring_system":"epss","scoring_elements":"0.34814","published_at":"2026-04-07T12:55:00Z"},{"value":"0.00145","scoring_system":"epss","scoring_elements":"0.3483","published_at":"2026-04-13T12:55:00Z"},{"value":"0.00145","scoring_system":"epss","scoring_elements":"0.34701","published_at":"2026-04-01T12:55:00Z"},{"value":"0.00145","scoring_system":"epss","scoring_elements":"0.34909","published_at":"2026-04-02T12:55:00Z"},{"value":"0.00145","scoring_system":"epss","scoring_elements":"0.34854","published_at":"2026-04-12T12:55:00Z"},{"value":"0.00145","scoring_system":"epss","scoring_elements":"0.34891","published_at":"2026-04-11T12:55:00Z"},{"value":"0.00145","scoring_system":"epss","scoring_elements":"0.34887","published_at":"2026-04-09T12:55:00Z"},{"value":"0.00145","scoring_system":"epss","scoring_elements":"0.34859","published_at":"2026-04-08T12:55:00Z"},{"value":"0.00145","scoring_system":"epss","scoring_elements":"0.34936","published_at":"2026-04-04T12:55:00Z"},{"value":"0.00145","scoring_system":"epss","scoring_elements":"0.34853","published_at":"2026-04-18T12:55:00Z"},{"value":"0.00145","scoring_system":"epss","scoring_elements":"0.34869","published_at":"2026-04-16T12:55:00Z"},{"value":"0.00315","scoring_system":"epss","scoring_elements":"0.54502","published_at":"2026-05-05T12:55:00Z"},{"value":"0.00315","scoring_system":"epss","scoring_elements":"0.54553","published_at":"2026-04-29T12:55:00Z"},{"value":"0.00315","scoring_system":"epss","scoring_elements":"0.54574","published_at":"2026-04-26T12:55:00Z"},{"value":"0.00315","scoring_system":"epss","scoring_elements":"0.5456","published_at":"2026-04-24T12:55:00Z"},{"value":"0.00315","scoring_system":"epss","scoring_elements":"0.54591","published_at":"2026-04-21T12:55:00Z"}],"url":"https://api.first.org/data/v1/epss?cve=CVE-2021-27922"},{"reference_url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-27922","reference_id":"","reference_type":"","scores":[],"url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-27922"},{"reference_url":"https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml","reference_id":"","reference_type":"","scores":[{"value":"7.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"url":"https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml"},{"reference_url":"https://github.com/advisories/GHSA-3wvg-mj6g-m9cv","reference_id":"","reference_type":"","scores":[{"value":"HIGH","scoring_system":"cvssv3.1_qr","scoring_elements":""}],"url":"https://github.com/advisories/GHSA-3wvg-mj6g-m9cv"},{"reference_url":"https://github.com/pypa/advisory-database/tree/main/vulns/pillow/PYSEC-2021-41.yaml","reference_id":"","reference_type":"","scores":[{"value":"7.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"},{"value":"8.7","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/pypa/advisory-database/tree/main/vulns/pillow/PYSEC-2021-41.yaml"},{"reference_url":"https://github.com/python-pillow/Pillow","reference_id":"","reference_type":"","scores":[{"value":"7.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"},{"value":"8.7","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/python-pillow/Pillow"},{"reference_url":"https://github.com/python-pillow/Pillow/commit/756fff33128a0b643d10518a26ad04b726dd8973","reference_id":"","reference_type":"","scores":[{"value":"7.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"},{"value":"8.7","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/python-pillow/Pillow/commit/756fff33128a0b643d10518a26ad04b726dd8973"},{"reference_url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/S7G44Z33J4BNI2DPDROHWGVG2U7ZH5JU","reference_id":"","reference_type":"","scores":[{"value":"7.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"},{"value":"8.7","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/S7G44Z33J4BNI2DPDROHWGVG2U7ZH5JU"},{"reference_url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/TQQY6472RX4J2SUJENWDZAWKTJJGP2ML","reference_id":"","reference_type":"","scores":[{"value":"7.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"},{"value":"8.7","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/TQQY6472RX4J2SUJENWDZAWKTJJGP2ML"},{"reference_url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZTSY25UJU7NJUFHH3HWT575LT4TDFWBZ","reference_id":"","reference_type":"","scores":[{"value":"7.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"},{"value":"8.7","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZTSY25UJU7NJUFHH3HWT575LT4TDFWBZ"},{"reference_url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/S7G44Z33J4BNI2DPDROHWGVG2U7ZH5JU","reference_id":"","reference_type":"","scores":[{"value":"7.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"},{"value":"8.7","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/S7G44Z33J4BNI2DPDROHWGVG2U7ZH5JU"},{"reference_url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/S7G44Z33J4BNI2DPDROHWGVG2U7ZH5JU/","reference_id":"","reference_type":"","scores":[],"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/S7G44Z33J4BNI2DPDROHWGVG2U7ZH5JU/"},{"reference_url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/TQQY6472RX4J2SUJENWDZAWKTJJGP2ML","reference_id":"","reference_type":"","scores":[{"value":"7.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"},{"value":"8.7","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/TQQY6472RX4J2SUJENWDZAWKTJJGP2ML"},{"reference_url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/TQQY6472RX4J2SUJENWDZAWKTJJGP2ML/","reference_id":"","reference_type":"","scores":[],"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/TQQY6472RX4J2SUJENWDZAWKTJJGP2ML/"},{"reference_url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZTSY25UJU7NJUFHH3HWT575LT4TDFWBZ","reference_id":"","reference_type":"","scores":[{"value":"7.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"},{"value":"8.7","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZTSY25UJU7NJUFHH3HWT575LT4TDFWBZ"},{"reference_url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZTSY25UJU7NJUFHH3HWT575LT4TDFWBZ/","reference_id":"","reference_type":"","scores":[],"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZTSY25UJU7NJUFHH3HWT575LT4TDFWBZ/"},{"reference_url":"https://nvd.nist.gov/vuln/detail/CVE-2021-27922","reference_id":"","reference_type":"","scores":[{"value":"7.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"},{"value":"8.7","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-27922"},{"reference_url":"https://pillow.readthedocs.io/en/stable/releasenotes/8.1.1.html","reference_id":"","reference_type":"","scores":[{"value":"7.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"},{"value":"8.7","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://pillow.readthedocs.io/en/stable/releasenotes/8.1.1.html"},{"reference_url":"https://pillow.readthedocs.io/en/stable/releasenotes/8.1.2.html","reference_id":"","reference_type":"","scores":[{"value":"7.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"},{"value":"8.7","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://pillow.readthedocs.io/en/stable/releasenotes/8.1.2.html"},{"reference_url":"https://security.gentoo.org/glsa/202107-33","reference_id":"","reference_type":"","scores":[{"value":"7.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"},{"value":"8.7","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://security.gentoo.org/glsa/202107-33"},{"reference_url":"https://bugzilla.redhat.com/show_bug.cgi?id=1935396","reference_id":"1935396","reference_type":"","scores":[],"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1935396"},{"reference_url":"https://security.archlinux.org/AVG-1635","reference_id":"AVG-1635","reference_type":"","scores":[{"value":"Medium","scoring_system":"archlinux","scoring_elements":""}],"url":"https://security.archlinux.org/AVG-1635"},{"reference_url":"https://access.redhat.com/errata/RHSA-2021:3917","reference_id":"RHSA-2021:3917","reference_type":"","scores":[],"url":"https://access.redhat.com/errata/RHSA-2021:3917"},{"reference_url":"https://access.redhat.com/errata/RHSA-2021:4149","reference_id":"RHSA-2021:4149","reference_type":"","scores":[],"url":"https://access.redhat.com/errata/RHSA-2021:4149"},{"reference_url":"https://usn.ubuntu.com/4763-1/","reference_id":"USN-4763-1","reference_type":"","scores":[],"url":"https://usn.ubuntu.com/4763-1/"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/15250?format=json","purl":"pkg:pypi/pillow@8.1.1","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-19e1-19hk-duet"},{"vulnerability":"VCID-1vt7-c6e3-7qc8"},{"vulnerability":"VCID-3qb5-8p8w-gkad"},{"vulnerability":"VCID-3uk9-eds5-rkgc"},{"vulnerability":"VCID-53ac-ceq4-qkhf"},{"vulnerability":"VCID-5rv4-k1q9-zue2"},{"vulnerability":"VCID-64n5-pugj-vue8"},{"vulnerability":"VCID-9ckw-ra54-z3b7"},{"vulnerability":"VCID-aubw-tsmn-ffcq"},{"vulnerability":"VCID-brp2-dtrf-jyfr"},{"vulnerability":"VCID-d7uf-zdbv-sba1"},{"vulnerability":"VCID-df4x-jt3h-17hx"},{"vulnerability":"VCID-dpc3-td9q-dyee"},{"vulnerability":"VCID-g46h-p8jk-cuhc"},{"vulnerability":"VCID-gvjw-funa-sqak"},{"vulnerability":"VCID-n1hp-atex-ubh4"},{"vulnerability":"VCID-n1w5-f5p7-xuhb"},{"vulnerability":"VCID-q4bb-qnxe-8bfa"},{"vulnerability":"VCID-ue18-zzau-x7hy"},{"vulnerability":"VCID-vdzj-kqfy-d3b7"},{"vulnerability":"VCID-vwbu-ruxm-tbh4"},{"vulnerability":"VCID-vyzt-df2u-h3cc"},{"vulnerability":"VCID-w9uy-fnpm-cbak"},{"vulnerability":"VCID-xesd-d294-7fcx"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:pypi/pillow@8.1.1"},{"url":"http://public2.vulnerablecode.io/api/packages/17187?format=json","purl":"pkg:pypi/pillow@8.1.2","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-19e1-19hk-duet"},{"vulnerability":"VCID-1vt7-c6e3-7qc8"},{"vulnerability":"VCID-3uk9-eds5-rkgc"},{"vulnerability":"VCID-5rv4-k1q9-zue2"},{"vulnerability":"VCID-64n5-pugj-vue8"},{"vulnerability":"VCID-9ckw-ra54-z3b7"},{"vulnerability":"VCID-aubw-tsmn-ffcq"},{"vulnerability":"VCID-brp2-dtrf-jyfr"},{"vulnerability":"VCID-d7uf-zdbv-sba1"},{"vulnerability":"VCID-df4x-jt3h-17hx"},{"vulnerability":"VCID-dpc3-td9q-dyee"},{"vulnerability":"VCID-g46h-p8jk-cuhc"},{"vulnerability":"VCID-n1hp-atex-ubh4"},{"vulnerability":"VCID-n1w5-f5p7-xuhb"},{"vulnerability":"VCID-q4bb-qnxe-8bfa"},{"vulnerability":"VCID-ue18-zzau-x7hy"},{"vulnerability":"VCID-vdzj-kqfy-d3b7"},{"vulnerability":"VCID-vwbu-ruxm-tbh4"},{"vulnerability":"VCID-vyzt-df2u-h3cc"},{"vulnerability":"VCID-w9uy-fnpm-cbak"},{"vulnerability":"VCID-xesd-d294-7fcx"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:pypi/pillow@8.1.2"}],"aliases":["BIT-pillow-2021-27922","CVE-2021-27922","GHSA-3wvg-mj6g-m9cv","PYSEC-2021-41"],"risk_score":4.0,"exploitability":"0.5","weighted_severity":"8.0","resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-53ac-ceq4-qkhf"},{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/15243?format=json","vulnerability_id":"VCID-5rv4-k1q9-zue2","summary":"Pillow versions before v10.0.1 bundled libwebp binaries in wheels that are vulnerable to CVE-2023-5129 (previously CVE-2023-4863). Pillow v10.0.1 upgrades the bundled libwebp binary to v1.3.2.","references":[{"reference_url":"https://github.com/python-pillow/Pillow/blob/main/CHANGES.rst#1001-2023-09-15","reference_id":"","reference_type":"","scores":[],"url":"https://github.com/python-pillow/Pillow/blob/main/CHANGES.rst#1001-2023-09-15"},{"reference_url":"https://nvd.nist.gov/vuln/detail/CVE-2023-4863","reference_id":"","reference_type":"","scores":[],"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-4863"},{"reference_url":"https://nvd.nist.gov/vuln/detail/CVE-2023-5129","reference_id":"","reference_type":"","scores":[],"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-5129"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/54025?format=json","purl":"pkg:pypi/pillow@10.0.1","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-64n5-pugj-vue8"},{"vulnerability":"VCID-9ckw-ra54-z3b7"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:pypi/pillow@10.0.1"}],"aliases":["PYSEC-2023-175"],"risk_score":null,"exploitability":"0.5","weighted_severity":"0.0","resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-5rv4-k1q9-zue2"},{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/13028?format=json","vulnerability_id":"VCID-64n5-pugj-vue8","summary":"Pillow buffer overflow vulnerability\nIn _imagingcms.c in Pillow before 10.3.0, a buffer overflow exists because strcpy is used instead of strncpy.","references":[{"reference_url":"https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2024-28219.json","reference_id":"","reference_type":"","scores":[{"value":"6.5","scoring_system":"cvssv3","scoring_elements":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:H"}],"url":"https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2024-28219.json"},{"reference_url":"https://api.first.org/data/v1/epss?cve=CVE-2024-28219","reference_id":"","reference_type":"","scores":[{"value":"0.00261","scoring_system":"epss","scoring_elements":"0.49475","published_at":"2026-04-02T12:55:00Z"},{"value":"0.00261","scoring_system":"epss","scoring_elements":"0.49512","published_at":"2026-04-21T12:55:00Z"},{"value":"0.00261","scoring_system":"epss","scoring_elements":"0.49541","published_at":"2026-04-18T12:55:00Z"},{"value":"0.00261","scoring_system":"epss","scoring_elements":"0.49543","published_at":"2026-04-16T12:55:00Z"},{"value":"0.00261","scoring_system":"epss","scoring_elements":"0.49496","published_at":"2026-04-13T12:55:00Z"},{"value":"0.00261","scoring_system":"epss","scoring_elements":"0.49494","published_at":"2026-04-12T12:55:00Z"},{"value":"0.00261","scoring_system":"epss","scoring_elements":"0.49522","published_at":"2026-04-11T12:55:00Z"},{"value":"0.00261","scoring_system":"epss","scoring_elements":"0.49505","published_at":"2026-04-09T12:55:00Z"},{"value":"0.00261","scoring_system":"epss","scoring_elements":"0.49509","published_at":"2026-04-08T12:55:00Z"},{"value":"0.00261","scoring_system":"epss","scoring_elements":"0.49454","published_at":"2026-04-07T12:55:00Z"},{"value":"0.00261","scoring_system":"epss","scoring_elements":"0.49502","published_at":"2026-04-04T12:55:00Z"},{"value":"0.00354","scoring_system":"epss","scoring_elements":"0.57745","published_at":"2026-04-24T12:55:00Z"},{"value":"0.00354","scoring_system":"epss","scoring_elements":"0.57701","published_at":"2026-05-05T12:55:00Z"},{"value":"0.00354","scoring_system":"epss","scoring_elements":"0.57743","published_at":"2026-04-29T12:55:00Z"},{"value":"0.00354","scoring_system":"epss","scoring_elements":"0.57765","published_at":"2026-04-26T12:55:00Z"}],"url":"https://api.first.org/data/v1/epss?cve=CVE-2024-28219"},{"reference_url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-44271","reference_id":"","reference_type":"","scores":[],"url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-44271"},{"reference_url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-50447","reference_id":"","reference_type":"","scores":[],"url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-50447"},{"reference_url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-28219","reference_id":"","reference_type":"","scores":[],"url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-28219"},{"reference_url":"https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml","reference_id":"","reference_type":"","scores":[{"value":"7.3","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H"}],"url":"https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml"},{"reference_url":"https://github.com/python-pillow/Pillow","reference_id":"","reference_type":"","scores":[{"value":"6.7","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H"},{"value":"7.3","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/python-pillow/Pillow"},{"reference_url":"https://github.com/python-pillow/Pillow/commit/2a93aba5cfcf6e241ab4f9392c13e3b74032c061","reference_id":"","reference_type":"","scores":[{"value":"6.7","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H"},{"value":"7.3","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/python-pillow/Pillow/commit/2a93aba5cfcf6e241ab4f9392c13e3b74032c061"},{"reference_url":"https://lists.debian.org/debian-lts-announce/2024/04/msg00008.html","reference_id":"","reference_type":"","scores":[{"value":"6.7","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H"},{"value":"6.7","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AC:H/AV:L/A:H/C:H/I:H/PR:L/S:U/UI:R"},{"value":"7.3","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""},{"value":"Track","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:N/A:N/T:T/P:M/B:A/M:M/D:T/2024-04-03T18:09:55Z/"}],"url":"https://lists.debian.org/debian-lts-announce/2024/04/msg00008.html"},{"reference_url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/4XLPUT3VK4GQ6EVY525TT2QNUIXNRU5M","reference_id":"","reference_type":"","scores":[{"value":"6.7","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H"},{"value":"7.3","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/4XLPUT3VK4GQ6EVY525TT2QNUIXNRU5M"},{"reference_url":"https://nvd.nist.gov/vuln/detail/CVE-2024-28219","reference_id":"","reference_type":"","scores":[{"value":"6.7","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H"},{"value":"7.3","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-28219"},{"reference_url":"https://pillow.readthedocs.io/en/stable/releasenotes/10.3.0.html#security","reference_id":"","reference_type":"","scores":[{"value":"6.7","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H"},{"value":"6.7","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AC:H/AV:L/A:H/C:H/I:H/PR:L/S:U/UI:R"},{"value":"7.3","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""},{"value":"Track","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:N/A:N/T:T/P:M/B:A/M:M/D:T/2024-04-03T18:09:55Z/"}],"url":"https://pillow.readthedocs.io/en/stable/releasenotes/10.3.0.html#security"},{"reference_url":"https://bugzilla.redhat.com/show_bug.cgi?id=2272563","reference_id":"2272563","reference_type":"","scores":[],"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2272563"},{"reference_url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/4XLPUT3VK4GQ6EVY525TT2QNUIXNRU5M/","reference_id":"4XLPUT3VK4GQ6EVY525TT2QNUIXNRU5M","reference_type":"","scores":[{"value":"6.7","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AC:H/AV:L/A:H/C:H/I:H/PR:L/S:U/UI:R"},{"value":"Track","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:N/A:N/T:T/P:M/B:A/M:M/D:T/2024-04-03T18:09:55Z/"}],"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/4XLPUT3VK4GQ6EVY525TT2QNUIXNRU5M/"},{"reference_url":"https://github.com/advisories/GHSA-44wm-f244-xhp3","reference_id":"GHSA-44wm-f244-xhp3","reference_type":"","scores":[{"value":"HIGH","scoring_system":"cvssv3.1_qr","scoring_elements":""}],"url":"https://github.com/advisories/GHSA-44wm-f244-xhp3"},{"reference_url":"https://security.gentoo.org/glsa/202411-07","reference_id":"GLSA-202411-07","reference_type":"","scores":[],"url":"https://security.gentoo.org/glsa/202411-07"},{"reference_url":"https://access.redhat.com/errata/RHSA-2024:3781","reference_id":"RHSA-2024:3781","reference_type":"","scores":[],"url":"https://access.redhat.com/errata/RHSA-2024:3781"},{"reference_url":"https://access.redhat.com/errata/RHSA-2024:4227","reference_id":"RHSA-2024:4227","reference_type":"","scores":[],"url":"https://access.redhat.com/errata/RHSA-2024:4227"},{"reference_url":"https://access.redhat.com/errata/RHSA-2024:5662","reference_id":"RHSA-2024:5662","reference_type":"","scores":[],"url":"https://access.redhat.com/errata/RHSA-2024:5662"},{"reference_url":"https://usn.ubuntu.com/6744-1/","reference_id":"USN-6744-1","reference_type":"","scores":[],"url":"https://usn.ubuntu.com/6744-1/"},{"reference_url":"https://usn.ubuntu.com/6744-2/","reference_id":"USN-6744-2","reference_type":"","scores":[],"url":"https://usn.ubuntu.com/6744-2/"},{"reference_url":"https://usn.ubuntu.com/6744-3/","reference_id":"USN-6744-3","reference_type":"","scores":[],"url":"https://usn.ubuntu.com/6744-3/"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/46441?format=json","purl":"pkg:pypi/pillow@10.3.0","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-67yw-ej31-8ub1"},{"vulnerability":"VCID-ca8h-871t-t3dd"},{"vulnerability":"VCID-ec8u-v4e2-wqgn"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:pypi/pillow@10.3.0"}],"aliases":["CVE-2024-28219","GHSA-44wm-f244-xhp3"],"risk_score":4.0,"exploitability":"0.5","weighted_severity":"8.0","resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-64n5-pugj-vue8"},{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/6244?format=json","vulnerability_id":"VCID-6gyu-fzpg-c3bn","summary":"In Pillow before 8.1.0, TiffDecode has a heap-based buffer overflow when decoding crafted YCbCr files because of certain interpretation conflicts with LibTIFF in RGBA mode.","references":[{"reference_url":"https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2020-35654.json","reference_id":"","reference_type":"","scores":[{"value":"9.8","scoring_system":"cvssv3","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"}],"url":"https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2020-35654.json"},{"reference_url":"https://api.first.org/data/v1/epss?cve=CVE-2020-35654","reference_id":"","reference_type":"","scores":[{"value":"0.00199","scoring_system":"epss","scoring_elements":"0.41703","published_at":"2026-05-05T12:55:00Z"},{"value":"0.00199","scoring_system":"epss","scoring_elements":"0.41842","published_at":"2026-04-29T12:55:00Z"},{"value":"0.00199","scoring_system":"epss","scoring_elements":"0.41926","published_at":"2026-04-26T12:55:00Z"},{"value":"0.00199","scoring_system":"epss","scoring_elements":"0.41932","published_at":"2026-04-24T12:55:00Z"},{"value":"0.00199","scoring_system":"epss","scoring_elements":"0.41993","published_at":"2026-04-21T12:55:00Z"},{"value":"0.00199","scoring_system":"epss","scoring_elements":"0.42089","published_at":"2026-04-16T12:55:00Z"},{"value":"0.00199","scoring_system":"epss","scoring_elements":"0.41988","published_at":"2026-04-01T12:55:00Z"},{"value":"0.00199","scoring_system":"epss","scoring_elements":"0.42038","published_at":"2026-04-13T12:55:00Z"},{"value":"0.00199","scoring_system":"epss","scoring_elements":"0.42063","published_at":"2026-04-18T12:55:00Z"},{"value":"0.00199","scoring_system":"epss","scoring_elements":"0.42101","published_at":"2026-04-11T12:55:00Z"},{"value":"0.00199","scoring_system":"epss","scoring_elements":"0.42078","published_at":"2026-04-09T12:55:00Z"},{"value":"0.00199","scoring_system":"epss","scoring_elements":"0.42066","published_at":"2026-04-08T12:55:00Z"},{"value":"0.00199","scoring_system":"epss","scoring_elements":"0.42014","published_at":"2026-04-07T12:55:00Z"},{"value":"0.00199","scoring_system":"epss","scoring_elements":"0.42077","published_at":"2026-04-04T12:55:00Z"},{"value":"0.00199","scoring_system":"epss","scoring_elements":"0.42049","published_at":"2026-04-02T12:55:00Z"}],"url":"https://api.first.org/data/v1/epss?cve=CVE-2020-35654"},{"reference_url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-35654","reference_id":"","reference_type":"","scores":[],"url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-35654"},{"reference_url":"https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml","reference_id":"","reference_type":"","scores":[{"value":"8.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"}],"url":"https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml"},{"reference_url":"https://github.com/advisories/GHSA-vqcj-wrf2-7v73","reference_id":"","reference_type":"","scores":[{"value":"8.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"},{"value":"HIGH","scoring_system":"cvssv3.1_qr","scoring_elements":""},{"value":"8.6","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/advisories/GHSA-vqcj-wrf2-7v73"},{"reference_url":"https://github.com/pypa/advisory-database/tree/main/vulns/pillow/PYSEC-2021-70.yaml","reference_id":"","reference_type":"","scores":[{"value":"8.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"},{"value":"8.6","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/pypa/advisory-database/tree/main/vulns/pillow/PYSEC-2021-70.yaml"},{"reference_url":"https://github.com/python-pillow/Pillow","reference_id":"","reference_type":"","scores":[{"value":"8.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"},{"value":"8.6","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/python-pillow/Pillow"},{"reference_url":"https://github.com/python-pillow/Pillow/commit/eb8c1206d6b170d4e798a00db7432e023853da5c","reference_id":"","reference_type":"","scores":[{"value":"8.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"},{"value":"8.6","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/python-pillow/Pillow/commit/eb8c1206d6b170d4e798a00db7432e023853da5c"},{"reference_url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6BYVI5G44MRIPERKYDQEL3S3YQCZTVHE","reference_id":"","reference_type":"","scores":[{"value":"8.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"},{"value":"8.6","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6BYVI5G44MRIPERKYDQEL3S3YQCZTVHE"},{"reference_url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6BYVI5G44MRIPERKYDQEL3S3YQCZTVHE/","reference_id":"","reference_type":"","scores":[],"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6BYVI5G44MRIPERKYDQEL3S3YQCZTVHE/"},{"reference_url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/BF553AMNNNBW7SH4IM4MNE4M6GNZQ7YD","reference_id":"","reference_type":"","scores":[{"value":"8.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"},{"value":"8.6","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/BF553AMNNNBW7SH4IM4MNE4M6GNZQ7YD"},{"reference_url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/BF553AMNNNBW7SH4IM4MNE4M6GNZQ7YD/","reference_id":"","reference_type":"","scores":[],"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/BF553AMNNNBW7SH4IM4MNE4M6GNZQ7YD/"},{"reference_url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/TQQY6472RX4J2SUJENWDZAWKTJJGP2ML","reference_id":"","reference_type":"","scores":[{"value":"8.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"},{"value":"8.6","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/TQQY6472RX4J2SUJENWDZAWKTJJGP2ML"},{"reference_url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/TQQY6472RX4J2SUJENWDZAWKTJJGP2ML/","reference_id":"","reference_type":"","scores":[],"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/TQQY6472RX4J2SUJENWDZAWKTJJGP2ML/"},{"reference_url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZTSY25UJU7NJUFHH3HWT575LT4TDFWBZ","reference_id":"","reference_type":"","scores":[{"value":"8.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"},{"value":"8.6","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZTSY25UJU7NJUFHH3HWT575LT4TDFWBZ"},{"reference_url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZTSY25UJU7NJUFHH3HWT575LT4TDFWBZ/","reference_id":"","reference_type":"","scores":[],"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZTSY25UJU7NJUFHH3HWT575LT4TDFWBZ/"},{"reference_url":"https://nvd.nist.gov/vuln/detail/CVE-2020-35654","reference_id":"","reference_type":"","scores":[{"value":"8.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"},{"value":"8.6","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://nvd.nist.gov/vuln/detail/CVE-2020-35654"},{"reference_url":"https://pillow.readthedocs.io/en/stable/releasenotes/index.html","reference_id":"","reference_type":"","scores":[{"value":"8.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"},{"value":"8.6","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://pillow.readthedocs.io/en/stable/releasenotes/index.html"},{"reference_url":"https://bugzilla.redhat.com/show_bug.cgi?id=1915424","reference_id":"1915424","reference_type":"","scores":[],"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1915424"},{"reference_url":"https://security.archlinux.org/ASA-202101-11","reference_id":"ASA-202101-11","reference_type":"","scores":[],"url":"https://security.archlinux.org/ASA-202101-11"},{"reference_url":"https://security.archlinux.org/AVG-1438","reference_id":"AVG-1438","reference_type":"","scores":[{"value":"Medium","scoring_system":"archlinux","scoring_elements":""}],"url":"https://security.archlinux.org/AVG-1438"},{"reference_url":"https://security.gentoo.org/glsa/202101-08","reference_id":"GLSA-202101-08","reference_type":"","scores":[],"url":"https://security.gentoo.org/glsa/202101-08"},{"reference_url":"https://access.redhat.com/errata/RHSA-2021:3917","reference_id":"RHSA-2021:3917","reference_type":"","scores":[],"url":"https://access.redhat.com/errata/RHSA-2021:3917"},{"reference_url":"https://usn.ubuntu.com/4697-1/","reference_id":"USN-4697-1","reference_type":"","scores":[],"url":"https://usn.ubuntu.com/4697-1/"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/14775?format=json","purl":"pkg:pypi/pillow@8.1.0","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-19e1-19hk-duet"},{"vulnerability":"VCID-1vt7-c6e3-7qc8"},{"vulnerability":"VCID-3qb5-8p8w-gkad"},{"vulnerability":"VCID-3uk9-eds5-rkgc"},{"vulnerability":"VCID-53ac-ceq4-qkhf"},{"vulnerability":"VCID-5rv4-k1q9-zue2"},{"vulnerability":"VCID-64n5-pugj-vue8"},{"vulnerability":"VCID-9ckw-ra54-z3b7"},{"vulnerability":"VCID-aubw-tsmn-ffcq"},{"vulnerability":"VCID-brp2-dtrf-jyfr"},{"vulnerability":"VCID-d7uf-zdbv-sba1"},{"vulnerability":"VCID-df4x-jt3h-17hx"},{"vulnerability":"VCID-dpc3-td9q-dyee"},{"vulnerability":"VCID-en6t-uxtq-bfek"},{"vulnerability":"VCID-g46h-p8jk-cuhc"},{"vulnerability":"VCID-gvjw-funa-sqak"},{"vulnerability":"VCID-khp6-9hfx-1kge"},{"vulnerability":"VCID-n1hp-atex-ubh4"},{"vulnerability":"VCID-n1w5-f5p7-xuhb"},{"vulnerability":"VCID-p6r3-puh1-zyg6"},{"vulnerability":"VCID-q4bb-qnxe-8bfa"},{"vulnerability":"VCID-rncf-9nf8-wud3"},{"vulnerability":"VCID-ue18-zzau-x7hy"},{"vulnerability":"VCID-vdzj-kqfy-d3b7"},{"vulnerability":"VCID-vwbu-ruxm-tbh4"},{"vulnerability":"VCID-vxh1-8rvt-kkak"},{"vulnerability":"VCID-vyzt-df2u-h3cc"},{"vulnerability":"VCID-w9uy-fnpm-cbak"},{"vulnerability":"VCID-xesd-d294-7fcx"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:pypi/pillow@8.1.0"}],"aliases":["BIT-pillow-2020-35654","CVE-2020-35654","GHSA-vqcj-wrf2-7v73","PYSEC-2021-70"],"risk_score":4.4,"exploitability":"0.5","weighted_severity":"8.8","resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-6gyu-fzpg-c3bn"},{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/6105?format=json","vulnerability_id":"VCID-8n2b-wvya-53e1","summary":"In libImaging/PcxDecode.c in Pillow before 7.1.0, an out-of-bounds read can occur when reading PCX files where state->shuffle is instructed to read beyond state->buffer.","references":[{"reference_url":"https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2020-10378.json","reference_id":"","reference_type":"","scores":[{"value":"5.9","scoring_system":"cvssv3","scoring_elements":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N"}],"url":"https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2020-10378.json"},{"reference_url":"https://api.first.org/data/v1/epss?cve=CVE-2020-10378","reference_id":"","reference_type":"","scores":[{"value":"0.00319","scoring_system":"epss","scoring_elements":"0.54893","published_at":"2026-05-05T12:55:00Z"},{"value":"0.00319","scoring_system":"epss","scoring_elements":"0.54945","published_at":"2026-04-29T12:55:00Z"},{"value":"0.00319","scoring_system":"epss","scoring_elements":"0.5497","published_at":"2026-04-26T12:55:00Z"},{"value":"0.00319","scoring_system":"epss","scoring_elements":"0.54951","published_at":"2026-04-24T12:55:00Z"},{"value":"0.00319","scoring_system":"epss","scoring_elements":"0.54975","published_at":"2026-04-21T12:55:00Z"},{"value":"0.00319","scoring_system":"epss","scoring_elements":"0.54994","published_at":"2026-04-16T12:55:00Z"},{"value":"0.00319","scoring_system":"epss","scoring_elements":"0.54957","published_at":"2026-04-13T12:55:00Z"},{"value":"0.00319","scoring_system":"epss","scoring_elements":"0.54872","published_at":"2026-04-01T12:55:00Z"},{"value":"0.00319","scoring_system":"epss","scoring_elements":"0.54998","published_at":"2026-04-18T12:55:00Z"},{"value":"0.00319","scoring_system":"epss","scoring_elements":"0.54986","published_at":"2026-04-09T12:55:00Z"},{"value":"0.00319","scoring_system":"epss","scoring_elements":"0.54987","published_at":"2026-04-08T12:55:00Z"},{"value":"0.00319","scoring_system":"epss","scoring_elements":"0.54937","published_at":"2026-04-07T12:55:00Z"},{"value":"0.00319","scoring_system":"epss","scoring_elements":"0.54968","published_at":"2026-04-04T12:55:00Z"},{"value":"0.00319","scoring_system":"epss","scoring_elements":"0.54942","published_at":"2026-04-02T12:55:00Z"},{"value":"0.00319","scoring_system":"epss","scoring_elements":"0.5498","published_at":"2026-04-12T12:55:00Z"}],"url":"https://api.first.org/data/v1/epss?cve=CVE-2020-10378"},{"reference_url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-10378","reference_id":"","reference_type":"","scores":[],"url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-10378"},{"reference_url":"https://github.com/advisories/GHSA-3xv8-3j54-hgrp","reference_id":"","reference_type":"","scores":[{"value":"5.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N"},{"value":"HIGH","scoring_system":"cvssv3.1_qr","scoring_elements":""},{"value":"8.2","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/advisories/GHSA-3xv8-3j54-hgrp"},{"reference_url":"https://github.com/pypa/advisory-database/tree/main/vulns/pillow/PYSEC-2020-77.yaml","reference_id":"","reference_type":"","scores":[{"value":"5.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N"},{"value":"8.2","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/pypa/advisory-database/tree/main/vulns/pillow/PYSEC-2020-77.yaml"},{"reference_url":"https://github.com/pypa/advisory-db/blob/7872b0a91b4d980f749e6d75a81f8cc1af32829f/vulns/pillow/PYSEC-2020-77.yaml","reference_id":"","reference_type":"","scores":[{"value":"5.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N"},{"value":"8.2","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/pypa/advisory-db/blob/7872b0a91b4d980f749e6d75a81f8cc1af32829f/vulns/pillow/PYSEC-2020-77.yaml"},{"reference_url":"https://github.com/python-pillow/Pillow","reference_id":"","reference_type":"","scores":[{"value":"5.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N"},{"value":"8.2","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/python-pillow/Pillow"},{"reference_url":"https://github.com/python-pillow/Pillow/commit/124f4bb591e16212605d0e41c413ed53e242cba2","reference_id":"","reference_type":"","scores":[{"value":"5.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N"},{"value":"8.2","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/python-pillow/Pillow/commit/124f4bb591e16212605d0e41c413ed53e242cba2"},{"reference_url":"https://github.com/python-pillow/Pillow/commit/6a83e4324738bb0452fbe8074a995b1c73f08de7#diff-9478f2787e3ae9668a15123b165c23ac","reference_id":"","reference_type":"","scores":[{"value":"5.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N"},{"value":"8.2","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/python-pillow/Pillow/commit/6a83e4324738bb0452fbe8074a995b1c73f08de7#diff-9478f2787e3ae9668a15123b165c23ac"},{"reference_url":"https://github.com/python-pillow/Pillow/commits/master/src/libImaging","reference_id":"","reference_type":"","scores":[{"value":"5.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N"},{"value":"8.2","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/python-pillow/Pillow/commits/master/src/libImaging"},{"reference_url":"https://github.com/python-pillow/Pillow/issues/4750","reference_id":"","reference_type":"","scores":[{"value":"5.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N"},{"value":"8.2","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/python-pillow/Pillow/issues/4750"},{"reference_url":"https://github.com/python-pillow/Pillow/pull/4538","reference_id":"","reference_type":"","scores":[{"value":"5.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N"},{"value":"8.2","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/python-pillow/Pillow/pull/4538"},{"reference_url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/BEBCPE4F2VHTIT6EZA2YZQZLPVDEBJGD","reference_id":"","reference_type":"","scores":[{"value":"5.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N"},{"value":"8.2","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/BEBCPE4F2VHTIT6EZA2YZQZLPVDEBJGD"},{"reference_url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/BEBCPE4F2VHTIT6EZA2YZQZLPVDEBJGD/","reference_id":"","reference_type":"","scores":[],"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/BEBCPE4F2VHTIT6EZA2YZQZLPVDEBJGD/"},{"reference_url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/HOKHNWV2VS5GESY7IBD237E7C6T3I427","reference_id":"","reference_type":"","scores":[{"value":"5.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N"},{"value":"8.2","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/HOKHNWV2VS5GESY7IBD237E7C6T3I427"},{"reference_url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/HOKHNWV2VS5GESY7IBD237E7C6T3I427/","reference_id":"","reference_type":"","scores":[],"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/HOKHNWV2VS5GESY7IBD237E7C6T3I427/"},{"reference_url":"https://pillow.readthedocs.io/en/stable/releasenotes/6.2.3.html","reference_id":"","reference_type":"","scores":[{"value":"5.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N"},{"value":"8.2","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://pillow.readthedocs.io/en/stable/releasenotes/6.2.3.html"},{"reference_url":"https://pillow.readthedocs.io/en/stable/releasenotes/7.1.0.html","reference_id":"","reference_type":"","scores":[{"value":"5.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N"},{"value":"8.2","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://pillow.readthedocs.io/en/stable/releasenotes/7.1.0.html"},{"reference_url":"https://usn.ubuntu.com/4430-1","reference_id":"","reference_type":"","scores":[{"value":"5.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N"},{"value":"8.2","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://usn.ubuntu.com/4430-1"},{"reference_url":"https://usn.ubuntu.com/4430-1/","reference_id":"","reference_type":"","scores":[],"url":"https://usn.ubuntu.com/4430-1/"},{"reference_url":"https://usn.ubuntu.com/4430-2","reference_id":"","reference_type":"","scores":[{"value":"5.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N"},{"value":"8.2","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://usn.ubuntu.com/4430-2"},{"reference_url":"https://usn.ubuntu.com/4430-2/","reference_id":"","reference_type":"","scores":[],"url":"https://usn.ubuntu.com/4430-2/"},{"reference_url":"https://bugzilla.redhat.com/show_bug.cgi?id=1852832","reference_id":"1852832","reference_type":"","scores":[],"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1852832"},{"reference_url":"https://nvd.nist.gov/vuln/detail/CVE-2020-10378","reference_id":"CVE-2020-10378","reference_type":"","scores":[{"value":"5.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N"},{"value":"8.2","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://nvd.nist.gov/vuln/detail/CVE-2020-10378"},{"reference_url":"https://access.redhat.com/errata/RHSA-2021:0420","reference_id":"RHSA-2021:0420","reference_type":"","scores":[],"url":"https://access.redhat.com/errata/RHSA-2021:0420"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/12775?format=json","purl":"pkg:pypi/pillow@7.1.0","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-19e1-19hk-duet"},{"vulnerability":"VCID-1vt7-c6e3-7qc8"},{"vulnerability":"VCID-3qb5-8p8w-gkad"},{"vulnerability":"VCID-3uk9-eds5-rkgc"},{"vulnerability":"VCID-53ac-ceq4-qkhf"},{"vulnerability":"VCID-5rv4-k1q9-zue2"},{"vulnerability":"VCID-64n5-pugj-vue8"},{"vulnerability":"VCID-6gyu-fzpg-c3bn"},{"vulnerability":"VCID-7bjx-gkf7-cke9"},{"vulnerability":"VCID-9ckw-ra54-z3b7"},{"vulnerability":"VCID-aubw-tsmn-ffcq"},{"vulnerability":"VCID-brp2-dtrf-jyfr"},{"vulnerability":"VCID-d7uf-zdbv-sba1"},{"vulnerability":"VCID-df4x-jt3h-17hx"},{"vulnerability":"VCID-dpc3-td9q-dyee"},{"vulnerability":"VCID-en6t-uxtq-bfek"},{"vulnerability":"VCID-g46h-p8jk-cuhc"},{"vulnerability":"VCID-gvjw-funa-sqak"},{"vulnerability":"VCID-khp6-9hfx-1kge"},{"vulnerability":"VCID-n1hp-atex-ubh4"},{"vulnerability":"VCID-n1w5-f5p7-xuhb"},{"vulnerability":"VCID-p6r3-puh1-zyg6"},{"vulnerability":"VCID-q4bb-qnxe-8bfa"},{"vulnerability":"VCID-rncf-9nf8-wud3"},{"vulnerability":"VCID-ue18-zzau-x7hy"},{"vulnerability":"VCID-vdzj-kqfy-d3b7"},{"vulnerability":"VCID-vwbu-ruxm-tbh4"},{"vulnerability":"VCID-vxh1-8rvt-kkak"},{"vulnerability":"VCID-vyzt-df2u-h3cc"},{"vulnerability":"VCID-w9uy-fnpm-cbak"},{"vulnerability":"VCID-x15z-dejc-9ba6"},{"vulnerability":"VCID-xesd-d294-7fcx"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:pypi/pillow@7.1.0"}],"aliases":["BIT-pillow-2020-10378","CVE-2020-10378","GHSA-3xv8-3j54-hgrp","PYSEC-2020-77"],"risk_score":4.0,"exploitability":"0.5","weighted_severity":"8.0","resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-8n2b-wvya-53e1"},{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/14264?format=json","vulnerability_id":"VCID-9ckw-ra54-z3b7","summary":"Arbitrary Code Execution in Pillow\nPillow through 10.1.0 allows PIL.ImageMath.eval Arbitrary Code Execution via the environment parameter, a different vulnerability than CVE-2022-22817 (which was about the expression parameter).","references":[{"reference_url":"https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2023-50447.json","reference_id":"","reference_type":"","scores":[{"value":"8.1","scoring_system":"cvssv3","scoring_elements":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"}],"url":"https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2023-50447.json"},{"reference_url":"https://api.first.org/data/v1/epss?cve=CVE-2023-50447","reference_id":"","reference_type":"","scores":[{"value":"0.00694","scoring_system":"epss","scoring_elements":"0.71951","published_at":"2026-05-05T12:55:00Z"},{"value":"0.00694","scoring_system":"epss","scoring_elements":"0.71959","published_at":"2026-04-29T12:55:00Z"},{"value":"0.00694","scoring_system":"epss","scoring_elements":"0.71962","published_at":"2026-04-26T12:55:00Z"},{"value":"0.00694","scoring_system":"epss","scoring_elements":"0.71956","published_at":"2026-04-24T12:55:00Z"},{"value":"0.00713","scoring_system":"epss","scoring_elements":"0.72354","published_at":"2026-04-21T12:55:00Z"},{"value":"0.00754","scoring_system":"epss","scoring_elements":"0.7327","published_at":"2026-04-18T12:55:00Z"},{"value":"0.00754","scoring_system":"epss","scoring_elements":"0.73261","published_at":"2026-04-16T12:55:00Z"},{"value":"0.00754","scoring_system":"epss","scoring_elements":"0.73218","published_at":"2026-04-13T12:55:00Z"},{"value":"0.00754","scoring_system":"epss","scoring_elements":"0.73225","published_at":"2026-04-12T12:55:00Z"},{"value":"0.00754","scoring_system":"epss","scoring_elements":"0.73244","published_at":"2026-04-11T12:55:00Z"},{"value":"0.00754","scoring_system":"epss","scoring_elements":"0.73219","published_at":"2026-04-09T12:55:00Z"},{"value":"0.00775","scoring_system":"epss","scoring_elements":"0.73555","published_at":"2026-04-02T12:55:00Z"},{"value":"0.00775","scoring_system":"epss","scoring_elements":"0.7355","published_at":"2026-04-07T12:55:00Z"},{"value":"0.00775","scoring_system":"epss","scoring_elements":"0.73578","published_at":"2026-04-04T12:55:00Z"},{"value":"0.00775","scoring_system":"epss","scoring_elements":"0.73586","published_at":"2026-04-08T12:55:00Z"}],"url":"https://api.first.org/data/v1/epss?cve=CVE-2023-50447"},{"reference_url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-44271","reference_id":"","reference_type":"","scores":[],"url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-44271"},{"reference_url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-50447","reference_id":"","reference_type":"","scores":[],"url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-50447"},{"reference_url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-28219","reference_id":"","reference_type":"","scores":[],"url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-28219"},{"reference_url":"https://devhub.checkmarx.com/cve-details/CVE-2023-50447","reference_id":"","reference_type":"","scores":[{"value":"8.1","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"},{"value":"9.3","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N"},{"value":"CRITICAL","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://devhub.checkmarx.com/cve-details/CVE-2023-50447"},{"reference_url":"https://duartecsantos.github.io/2023-01-02-CVE-2023-50447","reference_id":"","reference_type":"","scores":[{"value":"8.1","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"},{"value":"9.3","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N"},{"value":"CRITICAL","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://duartecsantos.github.io/2023-01-02-CVE-2023-50447"},{"reference_url":"https://duartecsantos.github.io/2024-01-02-CVE-2023-50447","reference_id":"","reference_type":"","scores":[{"value":"8.1","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"},{"value":"9.3","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N"},{"value":"CRITICAL","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://duartecsantos.github.io/2024-01-02-CVE-2023-50447"},{"reference_url":"https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml","reference_id":"","reference_type":"","scores":[{"value":"8.4","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"}],"url":"https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml"},{"reference_url":"https://github.com/python-pillow/Pillow","reference_id":"","reference_type":"","scores":[{"value":"8.1","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"},{"value":"9.3","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N"},{"value":"CRITICAL","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/python-pillow/Pillow"},{"reference_url":"https://github.com/python-pillow/Pillow/commit/45c726fd4daa63236a8f3653530f297dc87b160a","reference_id":"","reference_type":"","scores":[{"value":"8.1","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"},{"value":"9.3","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N"},{"value":"CRITICAL","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/python-pillow/Pillow/commit/45c726fd4daa63236a8f3653530f297dc87b160a"},{"reference_url":"https://github.com/python-pillow/Pillow/releases","reference_id":"","reference_type":"","scores":[{"value":"8.1","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"},{"value":"9.3","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N"},{"value":"CRITICAL","scoring_system":"generic_textual","scoring_elements":""},{"value":"Track","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:N/A:N/T:T/P:M/B:A/M:M/D:T/2024-07-19T03:55:36Z/"}],"url":"https://github.com/python-pillow/Pillow/releases"},{"reference_url":"https://lists.debian.org/debian-lts-announce/2024/01/msg00019.html","reference_id":"","reference_type":"","scores":[{"value":"8.1","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"},{"value":"9.3","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N"},{"value":"CRITICAL","scoring_system":"generic_textual","scoring_elements":""},{"value":"Track","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:N/A:N/T:T/P:M/B:A/M:M/D:T/2024-07-19T03:55:36Z/"}],"url":"https://lists.debian.org/debian-lts-announce/2024/01/msg00019.html"},{"reference_url":"https://nvd.nist.gov/vuln/detail/CVE-2023-50447","reference_id":"","reference_type":"","scores":[{"value":"8.1","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"},{"value":"9.3","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N"},{"value":"CRITICAL","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-50447"},{"reference_url":"https://pillow.readthedocs.io/en/stable/releasenotes/10.2.0.html#security","reference_id":"","reference_type":"","scores":[{"value":"8.1","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"},{"value":"9.3","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N"},{"value":"CRITICAL","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://pillow.readthedocs.io/en/stable/releasenotes/10.2.0.html#security"},{"reference_url":"http://www.openwall.com/lists/oss-security/2024/01/20/1","reference_id":"","reference_type":"","scores":[{"value":"8.1","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"},{"value":"9.3","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N"},{"value":"CRITICAL","scoring_system":"generic_textual","scoring_elements":""},{"value":"Track","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:N/A:N/T:T/P:M/B:A/M:M/D:T/2024-07-19T03:55:36Z/"}],"url":"http://www.openwall.com/lists/oss-security/2024/01/20/1"},{"reference_url":"https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1061172","reference_id":"1061172","reference_type":"","scores":[],"url":"https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1061172"},{"reference_url":"https://duartecsantos.github.io/2024-01-02-CVE-2023-50447/","reference_id":"2024-01-02-CVE-2023-50447","reference_type":"","scores":[{"value":"8.1","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"},{"value":"Track","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:N/A:N/T:T/P:M/B:A/M:M/D:T/2024-07-19T03:55:36Z/"}],"url":"https://duartecsantos.github.io/2024-01-02-CVE-2023-50447/"},{"reference_url":"https://bugzilla.redhat.com/show_bug.cgi?id=2259479","reference_id":"2259479","reference_type":"","scores":[],"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2259479"},{"reference_url":"https://devhub.checkmarx.com/cve-details/CVE-2023-50447/","reference_id":"CVE-2023-50447","reference_type":"","scores":[{"value":"8.1","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"},{"value":"Track","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:N/A:N/T:T/P:M/B:A/M:M/D:T/2024-07-19T03:55:36Z/"}],"url":"https://devhub.checkmarx.com/cve-details/CVE-2023-50447/"},{"reference_url":"https://github.com/advisories/GHSA-3f63-hfp8-52jq","reference_id":"GHSA-3f63-hfp8-52jq","reference_type":"","scores":[{"value":"CRITICAL","scoring_system":"cvssv3.1_qr","scoring_elements":""}],"url":"https://github.com/advisories/GHSA-3f63-hfp8-52jq"},{"reference_url":"https://security.gentoo.org/glsa/202405-12","reference_id":"GLSA-202405-12","reference_type":"","scores":[],"url":"https://security.gentoo.org/glsa/202405-12"},{"reference_url":"https://access.redhat.com/errata/RHSA-2024:0754","reference_id":"RHSA-2024:0754","reference_type":"","scores":[],"url":"https://access.redhat.com/errata/RHSA-2024:0754"},{"reference_url":"https://access.redhat.com/errata/RHSA-2024:0857","reference_id":"RHSA-2024:0857","reference_type":"","scores":[],"url":"https://access.redhat.com/errata/RHSA-2024:0857"},{"reference_url":"https://access.redhat.com/errata/RHSA-2024:0893","reference_id":"RHSA-2024:0893","reference_type":"","scores":[],"url":"https://access.redhat.com/errata/RHSA-2024:0893"},{"reference_url":"https://access.redhat.com/errata/RHSA-2024:1058","reference_id":"RHSA-2024:1058","reference_type":"","scores":[],"url":"https://access.redhat.com/errata/RHSA-2024:1058"},{"reference_url":"https://access.redhat.com/errata/RHSA-2024:1059","reference_id":"RHSA-2024:1059","reference_type":"","scores":[],"url":"https://access.redhat.com/errata/RHSA-2024:1059"},{"reference_url":"https://access.redhat.com/errata/RHSA-2024:1060","reference_id":"RHSA-2024:1060","reference_type":"","scores":[],"url":"https://access.redhat.com/errata/RHSA-2024:1060"},{"reference_url":"https://access.redhat.com/errata/RHSA-2024:3781","reference_id":"RHSA-2024:3781","reference_type":"","scores":[],"url":"https://access.redhat.com/errata/RHSA-2024:3781"},{"reference_url":"https://usn.ubuntu.com/6618-1/","reference_id":"USN-6618-1","reference_type":"","scores":[],"url":"https://usn.ubuntu.com/6618-1/"},{"reference_url":"https://usn.ubuntu.com/8135-1/","reference_id":"USN-8135-1","reference_type":"","scores":[],"url":"https://usn.ubuntu.com/8135-1/"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/50454?format=json","purl":"pkg:pypi/pillow@10.2.0","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-64n5-pugj-vue8"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:pypi/pillow@10.2.0"}],"aliases":["CVE-2023-50447","GHSA-3f63-hfp8-52jq"],"risk_score":4.5,"exploitability":"0.5","weighted_severity":"9.0","resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-9ckw-ra54-z3b7"},{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/6104?format=json","vulnerability_id":"VCID-and9-6jty-pyeq","summary":"In Pillow before 7.1.0, there are two Buffer Overflows in libImaging/TiffDecode.c.","references":[{"reference_url":"https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2020-10379.json","reference_id":"","reference_type":"","scores":[{"value":"7.5","scoring_system":"cvssv3","scoring_elements":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H"}],"url":"https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2020-10379.json"},{"reference_url":"https://api.first.org/data/v1/epss?cve=CVE-2020-10379","reference_id":"","reference_type":"","scores":[{"value":"0.0036","scoring_system":"epss","scoring_elements":"0.58148","published_at":"2026-05-05T12:55:00Z"},{"value":"0.0036","scoring_system":"epss","scoring_elements":"0.58198","published_at":"2026-04-26T12:55:00Z"},{"value":"0.0036","scoring_system":"epss","scoring_elements":"0.58184","published_at":"2026-04-29T12:55:00Z"},{"value":"0.0036","scoring_system":"epss","scoring_elements":"0.58219","published_at":"2026-04-21T12:55:00Z"},{"value":"0.0036","scoring_system":"epss","scoring_elements":"0.58245","published_at":"2026-04-18T12:55:00Z"},{"value":"0.0036","scoring_system":"epss","scoring_elements":"0.58242","published_at":"2026-04-16T12:55:00Z"},{"value":"0.0036","scoring_system":"epss","scoring_elements":"0.58099","published_at":"2026-04-01T12:55:00Z"},{"value":"0.0036","scoring_system":"epss","scoring_elements":"0.58211","published_at":"2026-04-13T12:55:00Z"},{"value":"0.0036","scoring_system":"epss","scoring_elements":"0.5823","published_at":"2026-04-12T12:55:00Z"},{"value":"0.0036","scoring_system":"epss","scoring_elements":"0.58254","published_at":"2026-04-11T12:55:00Z"},{"value":"0.0036","scoring_system":"epss","scoring_elements":"0.58185","published_at":"2026-04-02T12:55:00Z"},{"value":"0.0036","scoring_system":"epss","scoring_elements":"0.58205","published_at":"2026-04-04T12:55:00Z"},{"value":"0.0036","scoring_system":"epss","scoring_elements":"0.58177","published_at":"2026-04-07T12:55:00Z"},{"value":"0.0036","scoring_system":"epss","scoring_elements":"0.58236","published_at":"2026-04-09T12:55:00Z"},{"value":"0.0036","scoring_system":"epss","scoring_elements":"0.58232","published_at":"2026-04-08T12:55:00Z"}],"url":"https://api.first.org/data/v1/epss?cve=CVE-2020-10379"},{"reference_url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-10379","reference_id":"","reference_type":"","scores":[],"url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-10379"},{"reference_url":"https://github.com/advisories/GHSA-8843-m7mw-mxqm","reference_id":"","reference_type":"","scores":[{"value":"7.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"},{"value":"HIGH","scoring_system":"cvssv3.1_qr","scoring_elements":""},{"value":"8.7","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/advisories/GHSA-8843-m7mw-mxqm"},{"reference_url":"https://github.com/pypa/advisory-database/tree/main/vulns/pillow/PYSEC-2020-78.yaml","reference_id":"","reference_type":"","scores":[{"value":"7.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"},{"value":"8.7","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/pypa/advisory-database/tree/main/vulns/pillow/PYSEC-2020-78.yaml"},{"reference_url":"https://github.com/python-pillow/Pillow","reference_id":"","reference_type":"","scores":[{"value":"7.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"},{"value":"8.7","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/python-pillow/Pillow"},{"reference_url":"https://github.com/python-pillow/Pillow/commit/46f4a349b88915787fea3fb91348bb1665831bbb#diff-9478f2787e3ae9668a15123b165c23ac","reference_id":"","reference_type":"","scores":[{"value":"7.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"},{"value":"8.7","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/python-pillow/Pillow/commit/46f4a349b88915787fea3fb91348bb1665831bbb#diff-9478f2787e3ae9668a15123b165c23ac"},{"reference_url":"https://github.com/python-pillow/Pillow/commits/master/src/libImaging","reference_id":"","reference_type":"","scores":[{"value":"7.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"},{"value":"8.7","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/python-pillow/Pillow/commits/master/src/libImaging"},{"reference_url":"https://github.com/python-pillow/Pillow/issues/4750","reference_id":"","reference_type":"","scores":[{"value":"7.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"},{"value":"8.7","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/python-pillow/Pillow/issues/4750"},{"reference_url":"https://github.com/python-pillow/Pillow/pull/4538","reference_id":"","reference_type":"","scores":[{"value":"7.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"},{"value":"8.7","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/python-pillow/Pillow/pull/4538"},{"reference_url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/BEBCPE4F2VHTIT6EZA2YZQZLPVDEBJGD","reference_id":"","reference_type":"","scores":[{"value":"7.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"},{"value":"8.7","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/BEBCPE4F2VHTIT6EZA2YZQZLPVDEBJGD"},{"reference_url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/BEBCPE4F2VHTIT6EZA2YZQZLPVDEBJGD/","reference_id":"","reference_type":"","scores":[],"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/BEBCPE4F2VHTIT6EZA2YZQZLPVDEBJGD/"},{"reference_url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/HOKHNWV2VS5GESY7IBD237E7C6T3I427","reference_id":"","reference_type":"","scores":[{"value":"7.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"},{"value":"8.7","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/HOKHNWV2VS5GESY7IBD237E7C6T3I427"},{"reference_url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/HOKHNWV2VS5GESY7IBD237E7C6T3I427/","reference_id":"","reference_type":"","scores":[],"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/HOKHNWV2VS5GESY7IBD237E7C6T3I427/"},{"reference_url":"https://nvd.nist.gov/vuln/detail/CVE-2020-10379","reference_id":"","reference_type":"","scores":[{"value":"7.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"},{"value":"8.7","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://nvd.nist.gov/vuln/detail/CVE-2020-10379"},{"reference_url":"https://pillow.readthedocs.io/en/stable/releasenotes/6.2.3.html","reference_id":"","reference_type":"","scores":[{"value":"7.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"},{"value":"8.7","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://pillow.readthedocs.io/en/stable/releasenotes/6.2.3.html"},{"reference_url":"https://pillow.readthedocs.io/en/stable/releasenotes/7.1.0.html","reference_id":"","reference_type":"","scores":[{"value":"7.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"},{"value":"8.7","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://pillow.readthedocs.io/en/stable/releasenotes/7.1.0.html"},{"reference_url":"https://snyk.io/vuln/SNYK-PYTHON-PILLOW-574577","reference_id":"","reference_type":"","scores":[{"value":"7.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"},{"value":"8.7","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://snyk.io/vuln/SNYK-PYTHON-PILLOW-574577"},{"reference_url":"https://usn.ubuntu.com/4430-2","reference_id":"","reference_type":"","scores":[{"value":"7.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"},{"value":"8.7","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://usn.ubuntu.com/4430-2"},{"reference_url":"https://usn.ubuntu.com/4430-2/","reference_id":"","reference_type":"","scores":[],"url":"https://usn.ubuntu.com/4430-2/"},{"reference_url":"https://bugzilla.redhat.com/show_bug.cgi?id=1852836","reference_id":"1852836","reference_type":"","scores":[],"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1852836"},{"reference_url":"https://access.redhat.com/errata/RHSA-2021:0420","reference_id":"RHSA-2021:0420","reference_type":"","scores":[],"url":"https://access.redhat.com/errata/RHSA-2021:0420"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/12775?format=json","purl":"pkg:pypi/pillow@7.1.0","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-19e1-19hk-duet"},{"vulnerability":"VCID-1vt7-c6e3-7qc8"},{"vulnerability":"VCID-3qb5-8p8w-gkad"},{"vulnerability":"VCID-3uk9-eds5-rkgc"},{"vulnerability":"VCID-53ac-ceq4-qkhf"},{"vulnerability":"VCID-5rv4-k1q9-zue2"},{"vulnerability":"VCID-64n5-pugj-vue8"},{"vulnerability":"VCID-6gyu-fzpg-c3bn"},{"vulnerability":"VCID-7bjx-gkf7-cke9"},{"vulnerability":"VCID-9ckw-ra54-z3b7"},{"vulnerability":"VCID-aubw-tsmn-ffcq"},{"vulnerability":"VCID-brp2-dtrf-jyfr"},{"vulnerability":"VCID-d7uf-zdbv-sba1"},{"vulnerability":"VCID-df4x-jt3h-17hx"},{"vulnerability":"VCID-dpc3-td9q-dyee"},{"vulnerability":"VCID-en6t-uxtq-bfek"},{"vulnerability":"VCID-g46h-p8jk-cuhc"},{"vulnerability":"VCID-gvjw-funa-sqak"},{"vulnerability":"VCID-khp6-9hfx-1kge"},{"vulnerability":"VCID-n1hp-atex-ubh4"},{"vulnerability":"VCID-n1w5-f5p7-xuhb"},{"vulnerability":"VCID-p6r3-puh1-zyg6"},{"vulnerability":"VCID-q4bb-qnxe-8bfa"},{"vulnerability":"VCID-rncf-9nf8-wud3"},{"vulnerability":"VCID-ue18-zzau-x7hy"},{"vulnerability":"VCID-vdzj-kqfy-d3b7"},{"vulnerability":"VCID-vwbu-ruxm-tbh4"},{"vulnerability":"VCID-vxh1-8rvt-kkak"},{"vulnerability":"VCID-vyzt-df2u-h3cc"},{"vulnerability":"VCID-w9uy-fnpm-cbak"},{"vulnerability":"VCID-x15z-dejc-9ba6"},{"vulnerability":"VCID-xesd-d294-7fcx"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:pypi/pillow@7.1.0"}],"aliases":["BIT-pillow-2020-10379","CVE-2020-10379","GHSA-8843-m7mw-mxqm","PYSEC-2020-78"],"risk_score":4.0,"exploitability":"0.5","weighted_severity":"8.0","resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-and9-6jty-pyeq"},{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/6467?format=json","vulnerability_id":"VCID-aubw-tsmn-ffcq","summary":"An issue was discovered in Pillow before 8.2.0. For EPS data, the readline implementation used in EPSImageFile has to deal with any combination of \\r and \\n as line endings. It used an accidentally quadratic method of accumulating lines while looking for a line ending. A malicious EPS file could use this to perform a DoS of Pillow in the open phase, before an image was accepted for opening.","references":[{"reference_url":"https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2021-28677.json","reference_id":"","reference_type":"","scores":[{"value":"7.5","scoring_system":"cvssv3","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"url":"https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2021-28677.json"},{"reference_url":"https://api.first.org/data/v1/epss?cve=CVE-2021-28677","reference_id":"","reference_type":"","scores":[{"value":"0.00263","scoring_system":"epss","scoring_elements":"0.49715","published_at":"2026-04-12T12:55:00Z"},{"value":"0.00263","scoring_system":"epss","scoring_elements":"0.49743","published_at":"2026-04-11T12:55:00Z"},{"value":"0.00263","scoring_system":"epss","scoring_elements":"0.49731","published_at":"2026-04-08T12:55:00Z"},{"value":"0.00263","scoring_system":"epss","scoring_elements":"0.49676","published_at":"2026-04-07T12:55:00Z"},{"value":"0.00263","scoring_system":"epss","scoring_elements":"0.49726","published_at":"2026-04-24T12:55:00Z"},{"value":"0.00263","scoring_system":"epss","scoring_elements":"0.49698","published_at":"2026-04-02T12:55:00Z"},{"value":"0.00263","scoring_system":"epss","scoring_elements":"0.49667","published_at":"2026-04-01T12:55:00Z"},{"value":"0.00263","scoring_system":"epss","scoring_elements":"0.49605","published_at":"2026-05-05T12:55:00Z"},{"value":"0.00263","scoring_system":"epss","scoring_elements":"0.49691","published_at":"2026-04-29T12:55:00Z"},{"value":"0.00263","scoring_system":"epss","scoring_elements":"0.49735","published_at":"2026-04-26T12:55:00Z"},{"value":"0.00263","scoring_system":"epss","scoring_elements":"0.49763","published_at":"2026-04-18T12:55:00Z"},{"value":"0.00263","scoring_system":"epss","scoring_elements":"0.49716","published_at":"2026-04-13T12:55:00Z"},{"value":"0.00271","scoring_system":"epss","scoring_elements":"0.5057","published_at":"2026-04-21T12:55:00Z"}],"url":"https://api.first.org/data/v1/epss?cve=CVE-2021-28677"},{"reference_url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-28677","reference_id":"","reference_type":"","scores":[],"url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-28677"},{"reference_url":"https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml","reference_id":"","reference_type":"","scores":[{"value":"7.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"url":"https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml"},{"reference_url":"https://github.com/advisories/GHSA-q5hq-fp76-qmrc","reference_id":"","reference_type":"","scores":[{"value":"7.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"},{"value":"HIGH","scoring_system":"cvssv3.1_qr","scoring_elements":""},{"value":"8.7","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/advisories/GHSA-q5hq-fp76-qmrc"},{"reference_url":"https://github.com/pypa/advisory-database/tree/main/vulns/pillow/PYSEC-2021-93.yaml","reference_id":"","reference_type":"","scores":[{"value":"7.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"},{"value":"8.7","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/pypa/advisory-database/tree/main/vulns/pillow/PYSEC-2021-93.yaml"},{"reference_url":"https://github.com/python-pillow/Pillow","reference_id":"","reference_type":"","scores":[{"value":"7.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"},{"value":"8.7","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/python-pillow/Pillow"},{"reference_url":"https://github.com/python-pillow/Pillow/commit/5a5e6db0abf4e7a638fb1b3408c4e495a096cb92","reference_id":"","reference_type":"","scores":[{"value":"7.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"},{"value":"8.7","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/python-pillow/Pillow/commit/5a5e6db0abf4e7a638fb1b3408c4e495a096cb92"},{"reference_url":"https://github.com/python-pillow/Pillow/pull/5377","reference_id":"","reference_type":"","scores":[{"value":"7.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"},{"value":"8.7","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/python-pillow/Pillow/pull/5377"},{"reference_url":"https://lists.debian.org/debian-lts-announce/2021/07/msg00018.html","reference_id":"","reference_type":"","scores":[{"value":"7.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"},{"value":"8.7","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://lists.debian.org/debian-lts-announce/2021/07/msg00018.html"},{"reference_url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/MQHA5HAIBOYI3R6HDWCLAGFTIQP767FL","reference_id":"","reference_type":"","scores":[{"value":"7.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"},{"value":"8.7","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/MQHA5HAIBOYI3R6HDWCLAGFTIQP767FL"},{"reference_url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/MQHA5HAIBOYI3R6HDWCLAGFTIQP767FL/","reference_id":"","reference_type":"","scores":[],"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/MQHA5HAIBOYI3R6HDWCLAGFTIQP767FL/"},{"reference_url":"https://nvd.nist.gov/vuln/detail/CVE-2021-28677","reference_id":"","reference_type":"","scores":[{"value":"7.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"},{"value":"8.7","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-28677"},{"reference_url":"https://pillow.readthedocs.io/en/stable/releasenotes/8.2.0.html#cve-2021-28677-fix-eps-dos-on-open","reference_id":"","reference_type":"","scores":[{"value":"7.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"},{"value":"8.7","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://pillow.readthedocs.io/en/stable/releasenotes/8.2.0.html#cve-2021-28677-fix-eps-dos-on-open"},{"reference_url":"https://security.gentoo.org/glsa/202107-33","reference_id":"","reference_type":"","scores":[{"value":"7.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"},{"value":"8.7","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://security.gentoo.org/glsa/202107-33"},{"reference_url":"https://bugzilla.redhat.com/show_bug.cgi?id=1958257","reference_id":"1958257","reference_type":"","scores":[],"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1958257"},{"reference_url":"https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=989062","reference_id":"989062","reference_type":"","scores":[],"url":"https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=989062"},{"reference_url":"https://access.redhat.com/errata/RHSA-2021:4149","reference_id":"RHSA-2021:4149","reference_type":"","scores":[],"url":"https://access.redhat.com/errata/RHSA-2021:4149"},{"reference_url":"https://usn.ubuntu.com/4963-1/","reference_id":"USN-4963-1","reference_type":"","scores":[],"url":"https://usn.ubuntu.com/4963-1/"},{"reference_url":"https://usn.ubuntu.com/8135-1/","reference_id":"USN-8135-1","reference_type":"","scores":[],"url":"https://usn.ubuntu.com/8135-1/"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/17188?format=json","purl":"pkg:pypi/pillow@8.2.0","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-19e1-19hk-duet"},{"vulnerability":"VCID-1vt7-c6e3-7qc8"},{"vulnerability":"VCID-5rv4-k1q9-zue2"},{"vulnerability":"VCID-64n5-pugj-vue8"},{"vulnerability":"VCID-9ckw-ra54-z3b7"},{"vulnerability":"VCID-brp2-dtrf-jyfr"},{"vulnerability":"VCID-d7uf-zdbv-sba1"},{"vulnerability":"VCID-df4x-jt3h-17hx"},{"vulnerability":"VCID-dpc3-td9q-dyee"},{"vulnerability":"VCID-g46h-p8jk-cuhc"},{"vulnerability":"VCID-n1hp-atex-ubh4"},{"vulnerability":"VCID-q4bb-qnxe-8bfa"},{"vulnerability":"VCID-vdzj-kqfy-d3b7"},{"vulnerability":"VCID-w9uy-fnpm-cbak"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:pypi/pillow@8.2.0"}],"aliases":["BIT-pillow-2021-28677","CVE-2021-28677","GHSA-q5hq-fp76-qmrc","PYSEC-2021-93"],"risk_score":4.0,"exploitability":"0.5","weighted_severity":"8.0","resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-aubw-tsmn-ffcq"},{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/5505?format=json","vulnerability_id":"VCID-avx2-mahw-mqes","summary":"Integer overflow in the ImagingResampleHorizontal function in libImaging/Resample.c in Pillow before 3.1.1 allows remote attackers to have unspecified impact via negative values of the new size, which triggers a heap-based buffer overflow.","references":[{"reference_url":"https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2016-4009.json","reference_id":"","reference_type":"","scores":[],"url":"https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2016-4009.json"},{"reference_url":"https://api.first.org/data/v1/epss?cve=CVE-2016-4009","reference_id":"","reference_type":"","scores":[{"value":"0.05263","scoring_system":"epss","scoring_elements":"0.89963","published_at":"2026-04-04T12:55:00Z"},{"value":"0.05263","scoring_system":"epss","scoring_elements":"0.90033","published_at":"2026-05-05T12:55:00Z"},{"value":"0.05263","scoring_system":"epss","scoring_elements":"0.90021","published_at":"2026-04-29T12:55:00Z"},{"value":"0.05263","scoring_system":"epss","scoring_elements":"0.90003","published_at":"2026-04-21T12:55:00Z"},{"value":"0.05263","scoring_system":"epss","scoring_elements":"0.90006","published_at":"2026-04-18T12:55:00Z"},{"value":"0.05263","scoring_system":"epss","scoring_elements":"0.90005","published_at":"2026-04-16T12:55:00Z"},{"value":"0.05263","scoring_system":"epss","scoring_elements":"0.8999","published_at":"2026-04-13T12:55:00Z"},{"value":"0.05263","scoring_system":"epss","scoring_elements":"0.89997","published_at":"2026-04-12T12:55:00Z"},{"value":"0.05263","scoring_system":"epss","scoring_elements":"0.89998","published_at":"2026-04-11T12:55:00Z"},{"value":"0.05263","scoring_system":"epss","scoring_elements":"0.89991","published_at":"2026-04-09T12:55:00Z"},{"value":"0.05263","scoring_system":"epss","scoring_elements":"0.89986","published_at":"2026-04-08T12:55:00Z"},{"value":"0.05263","scoring_system":"epss","scoring_elements":"0.89948","published_at":"2026-04-01T12:55:00Z"},{"value":"0.05263","scoring_system":"epss","scoring_elements":"0.8997","published_at":"2026-04-07T12:55:00Z"},{"value":"0.05263","scoring_system":"epss","scoring_elements":"0.8995","published_at":"2026-04-02T12:55:00Z"}],"url":"https://api.first.org/data/v1/epss?cve=CVE-2016-4009"},{"reference_url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-4009","reference_id":"","reference_type":"","scores":[],"url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-4009"},{"reference_url":"https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml","reference_id":"","reference_type":"","scores":[{"value":"6.8","scoring_system":"cvssv2","scoring_elements":"AV:N/AC:M/Au:N/C:P/I:P/A:P"}],"url":"https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml"},{"reference_url":"https://github.com/advisories/GHSA-hvr8-466p-75rh","reference_id":"","reference_type":"","scores":[{"value":"9.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},{"value":"CRITICAL","scoring_system":"cvssv3.1_qr","scoring_elements":""},{"value":"9.3","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N"},{"value":"CRITICAL","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/advisories/GHSA-hvr8-466p-75rh"},{"reference_url":"https://github.com/pypa/advisory-database/tree/main/vulns/pillow/PYSEC-2016-7.yaml","reference_id":"","reference_type":"","scores":[{"value":"9.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},{"value":"9.3","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N"},{"value":"CRITICAL","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/pypa/advisory-database/tree/main/vulns/pillow/PYSEC-2016-7.yaml"},{"reference_url":"https://github.com/python-pillow/Pillow","reference_id":"","reference_type":"","scores":[{"value":"9.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},{"value":"9.3","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N"},{"value":"CRITICAL","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/python-pillow/Pillow"},{"reference_url":"https://github.com/python-pillow/Pillow/blob/c3cb690fed5d4bf0c45576759de55d054916c165/CHANGES.rst","reference_id":"","reference_type":"","scores":[{"value":"9.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},{"value":"9.3","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N"},{"value":"CRITICAL","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/python-pillow/Pillow/blob/c3cb690fed5d4bf0c45576759de55d054916c165/CHANGES.rst"},{"reference_url":"https://github.com/python-pillow/Pillow/commit/4e0d9b0b9740d258ade40cce248c93777362ac1e","reference_id":"","reference_type":"","scores":[{"value":"9.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},{"value":"9.3","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N"},{"value":"CRITICAL","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/python-pillow/Pillow/commit/4e0d9b0b9740d258ade40cce248c93777362ac1e"},{"reference_url":"https://github.com/python-pillow/Pillow/pull/1714","reference_id":"","reference_type":"","scores":[{"value":"9.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},{"value":"9.3","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N"},{"value":"CRITICAL","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/python-pillow/Pillow/pull/1714"},{"reference_url":"https://security.gentoo.org/glsa/201612-52","reference_id":"","reference_type":"","scores":[{"value":"9.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},{"value":"9.3","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N"},{"value":"CRITICAL","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://security.gentoo.org/glsa/201612-52"},{"reference_url":"http://www.securityfocus.com/bid/86064","reference_id":"","reference_type":"","scores":[{"value":"9.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},{"value":"9.3","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N"},{"value":"CRITICAL","scoring_system":"generic_textual","scoring_elements":""}],"url":"http://www.securityfocus.com/bid/86064"},{"reference_url":"https://bugzilla.redhat.com/show_bug.cgi?id=1327134","reference_id":"1327134","reference_type":"","scores":[],"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1327134"},{"reference_url":"https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:python:pillow:*:*:*:*:*:*:*:*","reference_id":"cpe:2.3:a:python:pillow:*:*:*:*:*:*:*:*","reference_type":"","scores":[],"url":"https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:python:pillow:*:*:*:*:*:*:*:*"},{"reference_url":"https://nvd.nist.gov/vuln/detail/CVE-2016-4009","reference_id":"CVE-2016-4009","reference_type":"","scores":[{"value":"10.0","scoring_system":"cvssv2","scoring_elements":"AV:N/AC:L/Au:N/C:C/I:C/A:C"},{"value":"9.8","scoring_system":"cvssv3","scoring_elements":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},{"value":"9.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},{"value":"9.3","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N"},{"value":"CRITICAL","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://nvd.nist.gov/vuln/detail/CVE-2016-4009"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/4257?format=json","purl":"pkg:pypi/pillow@3.1.1","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-19e1-19hk-duet"},{"vulnerability":"VCID-1vt7-c6e3-7qc8"},{"vulnerability":"VCID-3qb5-8p8w-gkad"},{"vulnerability":"VCID-3uk9-eds5-rkgc"},{"vulnerability":"VCID-53ac-ceq4-qkhf"},{"vulnerability":"VCID-5rv4-k1q9-zue2"},{"vulnerability":"VCID-64n5-pugj-vue8"},{"vulnerability":"VCID-6gyu-fzpg-c3bn"},{"vulnerability":"VCID-8n2b-wvya-53e1"},{"vulnerability":"VCID-9ckw-ra54-z3b7"},{"vulnerability":"VCID-and9-6jty-pyeq"},{"vulnerability":"VCID-aubw-tsmn-ffcq"},{"vulnerability":"VCID-b3au-rcgp-2fag"},{"vulnerability":"VCID-b5a2-83ej-puaw"},{"vulnerability":"VCID-brp2-dtrf-jyfr"},{"vulnerability":"VCID-cas2-jb3y-vyhz"},{"vulnerability":"VCID-d7uf-zdbv-sba1"},{"vulnerability":"VCID-df4x-jt3h-17hx"},{"vulnerability":"VCID-dpc3-td9q-dyee"},{"vulnerability":"VCID-e3gp-zc2b-budg"},{"vulnerability":"VCID-en6t-uxtq-bfek"},{"vulnerability":"VCID-g46h-p8jk-cuhc"},{"vulnerability":"VCID-gvjw-funa-sqak"},{"vulnerability":"VCID-h4x7-7fke-mqgp"},{"vulnerability":"VCID-haum-8zpg-6kgf"},{"vulnerability":"VCID-hmmq-5772-bycm"},{"vulnerability":"VCID-khp6-9hfx-1kge"},{"vulnerability":"VCID-m3tm-h4q9-9yay"},{"vulnerability":"VCID-n1hp-atex-ubh4"},{"vulnerability":"VCID-n1w5-f5p7-xuhb"},{"vulnerability":"VCID-p6r3-puh1-zyg6"},{"vulnerability":"VCID-q4bb-qnxe-8bfa"},{"vulnerability":"VCID-rncf-9nf8-wud3"},{"vulnerability":"VCID-sns1-ksqr-vbhr"},{"vulnerability":"VCID-stft-hsk9-zfdy"},{"vulnerability":"VCID-u1en-t8ux-uube"},{"vulnerability":"VCID-ue18-zzau-x7hy"},{"vulnerability":"VCID-uf5t-asns-tudp"},{"vulnerability":"VCID-vdzj-kqfy-d3b7"},{"vulnerability":"VCID-vwbu-ruxm-tbh4"},{"vulnerability":"VCID-vxh1-8rvt-kkak"},{"vulnerability":"VCID-vyzt-df2u-h3cc"},{"vulnerability":"VCID-w9uy-fnpm-cbak"},{"vulnerability":"VCID-x15z-dejc-9ba6"},{"vulnerability":"VCID-xesd-d294-7fcx"},{"vulnerability":"VCID-xk66-1d31-2qbk"},{"vulnerability":"VCID-yccg-zw89-vqff"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:pypi/pillow@3.1.1"}],"aliases":["CVE-2016-4009","GHSA-hvr8-466p-75rh","PYSEC-2016-7"],"risk_score":4.5,"exploitability":"0.5","weighted_severity":"9.0","resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-avx2-mahw-mqes"},{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/6001?format=json","vulnerability_id":"VCID-b3au-rcgp-2fag","summary":"There is a DoS vulnerability in Pillow before 6.2.2 caused by FpxImagePlugin.py calling the range function on an unvalidated 32-bit integer if the number of bands is large. On Windows running 32-bit Python, this results in an OverflowError or MemoryError due to the 2 GB limit. However, on Linux running 64-bit Python this results in the process being terminated by the OOM killer.","references":[{"reference_url":"https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2019-19911.json","reference_id":"","reference_type":"","scores":[{"value":"7.5","scoring_system":"cvssv3","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"url":"https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2019-19911.json"},{"reference_url":"https://api.first.org/data/v1/epss?cve=CVE-2019-19911","reference_id":"","reference_type":"","scores":[{"value":"0.00965","scoring_system":"epss","scoring_elements":"0.76648","published_at":"2026-04-29T12:55:00Z"},{"value":"0.00965","scoring_system":"epss","scoring_elements":"0.76635","published_at":"2026-05-05T12:55:00Z"},{"value":"0.00965","scoring_system":"epss","scoring_elements":"0.76506","published_at":"2026-04-01T12:55:00Z"},{"value":"0.00965","scoring_system":"epss","scoring_elements":"0.7663","published_at":"2026-04-24T12:55:00Z"},{"value":"0.00965","scoring_system":"epss","scoring_elements":"0.76606","published_at":"2026-04-16T12:55:00Z"},{"value":"0.00965","scoring_system":"epss","scoring_elements":"0.76609","published_at":"2026-04-18T12:55:00Z"},{"value":"0.00965","scoring_system":"epss","scoring_elements":"0.76564","published_at":"2026-04-13T12:55:00Z"},{"value":"0.00965","scoring_system":"epss","scoring_elements":"0.76511","published_at":"2026-04-02T12:55:00Z"},{"value":"0.00965","scoring_system":"epss","scoring_elements":"0.7654","published_at":"2026-04-04T12:55:00Z"},{"value":"0.00965","scoring_system":"epss","scoring_elements":"0.76522","published_at":"2026-04-07T12:55:00Z"},{"value":"0.00965","scoring_system":"epss","scoring_elements":"0.76554","published_at":"2026-04-08T12:55:00Z"},{"value":"0.00965","scoring_system":"epss","scoring_elements":"0.76565","published_at":"2026-04-09T12:55:00Z"},{"value":"0.00965","scoring_system":"epss","scoring_elements":"0.76592","published_at":"2026-04-11T12:55:00Z"},{"value":"0.00965","scoring_system":"epss","scoring_elements":"0.76571","published_at":"2026-04-12T12:55:00Z"},{"value":"0.00965","scoring_system":"epss","scoring_elements":"0.76597","published_at":"2026-04-21T12:55:00Z"}],"url":"https://api.first.org/data/v1/epss?cve=CVE-2019-19911"},{"reference_url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-19911","reference_id":"","reference_type":"","scores":[],"url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-19911"},{"reference_url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-5312","reference_id":"","reference_type":"","scores":[],"url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-5312"},{"reference_url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-5313","reference_id":"","reference_type":"","scores":[],"url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-5313"},{"reference_url":"https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml","reference_id":"","reference_type":"","scores":[{"value":"7.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"url":"https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml"},{"reference_url":"https://github.com/advisories/GHSA-5gm3-px64-rw72","reference_id":"","reference_type":"","scores":[{"value":"7.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"},{"value":"HIGH","scoring_system":"cvssv3.1_qr","scoring_elements":""},{"value":"8.7","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/advisories/GHSA-5gm3-px64-rw72"},{"reference_url":"https://github.com/pypa/advisory-database/tree/main/vulns/pillow/PYSEC-2020-172.yaml","reference_id":"","reference_type":"","scores":[{"value":"7.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"},{"value":"8.7","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/pypa/advisory-database/tree/main/vulns/pillow/PYSEC-2020-172.yaml"},{"reference_url":"https://github.com/python-pillow/Pillow/blob/master/CHANGES.rst#622-2020-01-02","reference_id":"","reference_type":"","scores":[{"value":"7.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"},{"value":"8.7","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/python-pillow/Pillow/blob/master/CHANGES.rst#622-2020-01-02"},{"reference_url":"https://github.com/python-pillow/Pillow/commit/774e53bb132461d8d5ebefec1162e29ec0ebc63d","reference_id":"","reference_type":"","scores":[{"value":"7.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"},{"value":"8.7","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/python-pillow/Pillow/commit/774e53bb132461d8d5ebefec1162e29ec0ebc63d"},{"reference_url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/3DUMIBUYGJRAVJCTFUWBRLVQKOUTVX5P","reference_id":"","reference_type":"","scores":[{"value":"7.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"},{"value":"8.7","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/3DUMIBUYGJRAVJCTFUWBRLVQKOUTVX5P"},{"reference_url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/3DUMIBUYGJRAVJCTFUWBRLVQKOUTVX5P/","reference_id":"","reference_type":"","scores":[],"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/3DUMIBUYGJRAVJCTFUWBRLVQKOUTVX5P/"},{"reference_url":"https://nvd.nist.gov/vuln/detail/CVE-2019-19911","reference_id":"","reference_type":"","scores":[{"value":"7.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"},{"value":"8.7","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://nvd.nist.gov/vuln/detail/CVE-2019-19911"},{"reference_url":"https://pillow.readthedocs.io/en/stable/releasenotes/6.2.2.html","reference_id":"","reference_type":"","scores":[{"value":"7.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"},{"value":"8.7","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://pillow.readthedocs.io/en/stable/releasenotes/6.2.2.html"},{"reference_url":"https://usn.ubuntu.com/4272-1","reference_id":"","reference_type":"","scores":[{"value":"7.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"},{"value":"8.7","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://usn.ubuntu.com/4272-1"},{"reference_url":"https://usn.ubuntu.com/4272-1/","reference_id":"","reference_type":"","scores":[],"url":"https://usn.ubuntu.com/4272-1/"},{"reference_url":"https://www.debian.org/security/2020/dsa-4631","reference_id":"","reference_type":"","scores":[{"value":"7.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"},{"value":"8.7","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://www.debian.org/security/2020/dsa-4631"},{"reference_url":"https://bugzilla.redhat.com/show_bug.cgi?id=1789540","reference_id":"1789540","reference_type":"","scores":[],"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1789540"},{"reference_url":"https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=948224","reference_id":"948224","reference_type":"","scores":[],"url":"https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=948224"},{"reference_url":"https://access.redhat.com/errata/RHSA-2021:0420","reference_id":"RHSA-2021:0420","reference_type":"","scores":[],"url":"https://access.redhat.com/errata/RHSA-2021:0420"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/9845?format=json","purl":"pkg:pypi/pillow@6.2.2","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-19e1-19hk-duet"},{"vulnerability":"VCID-1vt7-c6e3-7qc8"},{"vulnerability":"VCID-3qb5-8p8w-gkad"},{"vulnerability":"VCID-3uk9-eds5-rkgc"},{"vulnerability":"VCID-53ac-ceq4-qkhf"},{"vulnerability":"VCID-5rv4-k1q9-zue2"},{"vulnerability":"VCID-64n5-pugj-vue8"},{"vulnerability":"VCID-6gyu-fzpg-c3bn"},{"vulnerability":"VCID-7bjx-gkf7-cke9"},{"vulnerability":"VCID-8n2b-wvya-53e1"},{"vulnerability":"VCID-9ckw-ra54-z3b7"},{"vulnerability":"VCID-and9-6jty-pyeq"},{"vulnerability":"VCID-aubw-tsmn-ffcq"},{"vulnerability":"VCID-b5a2-83ej-puaw"},{"vulnerability":"VCID-brp2-dtrf-jyfr"},{"vulnerability":"VCID-d7uf-zdbv-sba1"},{"vulnerability":"VCID-df4x-jt3h-17hx"},{"vulnerability":"VCID-dpc3-td9q-dyee"},{"vulnerability":"VCID-en6t-uxtq-bfek"},{"vulnerability":"VCID-g46h-p8jk-cuhc"},{"vulnerability":"VCID-gvjw-funa-sqak"},{"vulnerability":"VCID-haum-8zpg-6kgf"},{"vulnerability":"VCID-khp6-9hfx-1kge"},{"vulnerability":"VCID-n1hp-atex-ubh4"},{"vulnerability":"VCID-n1w5-f5p7-xuhb"},{"vulnerability":"VCID-p6r3-puh1-zyg6"},{"vulnerability":"VCID-q4bb-qnxe-8bfa"},{"vulnerability":"VCID-rncf-9nf8-wud3"},{"vulnerability":"VCID-ue18-zzau-x7hy"},{"vulnerability":"VCID-uf5t-asns-tudp"},{"vulnerability":"VCID-vdzj-kqfy-d3b7"},{"vulnerability":"VCID-vwbu-ruxm-tbh4"},{"vulnerability":"VCID-vxh1-8rvt-kkak"},{"vulnerability":"VCID-vyzt-df2u-h3cc"},{"vulnerability":"VCID-w9uy-fnpm-cbak"},{"vulnerability":"VCID-x15z-dejc-9ba6"},{"vulnerability":"VCID-xesd-d294-7fcx"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:pypi/pillow@6.2.2"}],"aliases":["CVE-2019-19911","GHSA-5gm3-px64-rw72","PYSEC-2020-172"],"risk_score":4.0,"exploitability":"0.5","weighted_severity":"8.0","resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-b3au-rcgp-2fag"},{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/6107?format=json","vulnerability_id":"VCID-b5a2-83ej-puaw","summary":"In libImaging/SgiRleDecode.c in Pillow through 7.0.0, a number of out-of-bounds reads exist in the parsing of SGI image files, a different issue than CVE-2020-5311.","references":[{"reference_url":"https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2020-11538.json","reference_id":"","reference_type":"","scores":[{"value":"8.1","scoring_system":"cvssv3","scoring_elements":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"}],"url":"https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2020-11538.json"},{"reference_url":"https://api.first.org/data/v1/epss?cve=CVE-2020-11538","reference_id":"","reference_type":"","scores":[{"value":"0.00267","scoring_system":"epss","scoring_elements":"0.50043","published_at":"2026-05-05T12:55:00Z"},{"value":"0.00267","scoring_system":"epss","scoring_elements":"0.50124","published_at":"2026-04-29T12:55:00Z"},{"value":"0.00267","scoring_system":"epss","scoring_elements":"0.50171","published_at":"2026-04-26T12:55:00Z"},{"value":"0.00267","scoring_system":"epss","scoring_elements":"0.50164","published_at":"2026-04-24T12:55:00Z"},{"value":"0.00267","scoring_system":"epss","scoring_elements":"0.50181","published_at":"2026-04-21T12:55:00Z"},{"value":"0.00267","scoring_system":"epss","scoring_elements":"0.50206","published_at":"2026-04-18T12:55:00Z"},{"value":"0.00267","scoring_system":"epss","scoring_elements":"0.50205","published_at":"2026-04-16T12:55:00Z"},{"value":"0.00267","scoring_system":"epss","scoring_elements":"0.5016","published_at":"2026-04-13T12:55:00Z"},{"value":"0.00267","scoring_system":"epss","scoring_elements":"0.50161","published_at":"2026-04-12T12:55:00Z"},{"value":"0.00267","scoring_system":"epss","scoring_elements":"0.50187","published_at":"2026-04-11T12:55:00Z"},{"value":"0.00267","scoring_system":"epss","scoring_elements":"0.5017","published_at":"2026-04-09T12:55:00Z"},{"value":"0.00267","scoring_system":"epss","scoring_elements":"0.50123","published_at":"2026-04-07T12:55:00Z"},{"value":"0.00267","scoring_system":"epss","scoring_elements":"0.50177","published_at":"2026-04-08T12:55:00Z"},{"value":"0.00267","scoring_system":"epss","scoring_elements":"0.50173","published_at":"2026-04-04T12:55:00Z"},{"value":"0.00267","scoring_system":"epss","scoring_elements":"0.50145","published_at":"2026-04-02T12:55:00Z"},{"value":"0.00267","scoring_system":"epss","scoring_elements":"0.50111","published_at":"2026-04-01T12:55:00Z"}],"url":"https://api.first.org/data/v1/epss?cve=CVE-2020-11538"},{"reference_url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-11538","reference_id":"","reference_type":"","scores":[],"url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-11538"},{"reference_url":"https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml","reference_id":"","reference_type":"","scores":[{"value":"8.1","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"}],"url":"https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml"},{"reference_url":"https://github.com/advisories/GHSA-43fq-w8qq-v88h","reference_id":"","reference_type":"","scores":[{"value":"8.1","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"},{"value":"CRITICAL","scoring_system":"cvssv3.1_qr","scoring_elements":""},{"value":"9.2","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N"},{"value":"CRITICAL","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/advisories/GHSA-43fq-w8qq-v88h"},{"reference_url":"https://github.com/pypa/advisory-database/tree/main/vulns/pillow/PYSEC-2020-80.yaml","reference_id":"","reference_type":"","scores":[{"value":"8.1","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"},{"value":"9.2","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N"},{"value":"CRITICAL","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/pypa/advisory-database/tree/main/vulns/pillow/PYSEC-2020-80.yaml"},{"reference_url":"https://github.com/python-pillow/Pillow","reference_id":"","reference_type":"","scores":[{"value":"8.1","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"},{"value":"9.2","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N"},{"value":"CRITICAL","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/python-pillow/Pillow"},{"reference_url":"https://github.com/python-pillow/Pillow/blob/master/docs/releasenotes/7.1.0.rst#security","reference_id":"","reference_type":"","scores":[{"value":"8.1","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"},{"value":"9.2","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N"},{"value":"CRITICAL","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/python-pillow/Pillow/blob/master/docs/releasenotes/7.1.0.rst#security"},{"reference_url":"https://github.com/python-pillow/Pillow/commit/2ef59fdbaeb756bc512ab3f2ad15ac45665b303d","reference_id":"","reference_type":"","scores":[{"value":"8.1","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"},{"value":"9.2","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N"},{"value":"CRITICAL","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/python-pillow/Pillow/commit/2ef59fdbaeb756bc512ab3f2ad15ac45665b303d"},{"reference_url":"https://github.com/python-pillow/Pillow/pull/4504","reference_id":"","reference_type":"","scores":[{"value":"8.1","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"},{"value":"9.2","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N"},{"value":"CRITICAL","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/python-pillow/Pillow/pull/4504"},{"reference_url":"https://github.com/python-pillow/Pillow/pull/4538","reference_id":"","reference_type":"","scores":[{"value":"8.1","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"},{"value":"9.2","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N"},{"value":"CRITICAL","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/python-pillow/Pillow/pull/4538"},{"reference_url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/BEBCPE4F2VHTIT6EZA2YZQZLPVDEBJGD","reference_id":"","reference_type":"","scores":[{"value":"8.1","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"},{"value":"9.2","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N"},{"value":"CRITICAL","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/BEBCPE4F2VHTIT6EZA2YZQZLPVDEBJGD"},{"reference_url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/BEBCPE4F2VHTIT6EZA2YZQZLPVDEBJGD/","reference_id":"","reference_type":"","scores":[],"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/BEBCPE4F2VHTIT6EZA2YZQZLPVDEBJGD/"},{"reference_url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/HOKHNWV2VS5GESY7IBD237E7C6T3I427","reference_id":"","reference_type":"","scores":[{"value":"8.1","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"},{"value":"9.2","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N"},{"value":"CRITICAL","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/HOKHNWV2VS5GESY7IBD237E7C6T3I427"},{"reference_url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/HOKHNWV2VS5GESY7IBD237E7C6T3I427/","reference_id":"","reference_type":"","scores":[],"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/HOKHNWV2VS5GESY7IBD237E7C6T3I427/"},{"reference_url":"https://nvd.nist.gov/vuln/detail/CVE-2020-11538","reference_id":"","reference_type":"","scores":[{"value":"8.1","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"},{"value":"9.2","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N"},{"value":"CRITICAL","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://nvd.nist.gov/vuln/detail/CVE-2020-11538"},{"reference_url":"https://pillow.readthedocs.io/en/stable/releasenotes/7.1.0.html","reference_id":"","reference_type":"","scores":[{"value":"8.1","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"},{"value":"9.2","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N"},{"value":"CRITICAL","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://pillow.readthedocs.io/en/stable/releasenotes/7.1.0.html"},{"reference_url":"https://pillow.readthedocs.io/en/stable/releasenotes/index.html","reference_id":"","reference_type":"","scores":[{"value":"8.1","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"},{"value":"9.2","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N"},{"value":"CRITICAL","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://pillow.readthedocs.io/en/stable/releasenotes/index.html"},{"reference_url":"https://snyk.io/vuln/SNYK-PYTHON-PILLOW-574574","reference_id":"","reference_type":"","scores":[{"value":"8.1","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"},{"value":"9.2","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N"},{"value":"CRITICAL","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://snyk.io/vuln/SNYK-PYTHON-PILLOW-574574"},{"reference_url":"https://usn.ubuntu.com/4430-1","reference_id":"","reference_type":"","scores":[{"value":"8.1","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"},{"value":"9.2","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N"},{"value":"CRITICAL","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://usn.ubuntu.com/4430-1"},{"reference_url":"https://usn.ubuntu.com/4430-1/","reference_id":"","reference_type":"","scores":[],"url":"https://usn.ubuntu.com/4430-1/"},{"reference_url":"https://usn.ubuntu.com/4430-2","reference_id":"","reference_type":"","scores":[{"value":"8.1","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"},{"value":"9.2","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N"},{"value":"CRITICAL","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://usn.ubuntu.com/4430-2"},{"reference_url":"https://usn.ubuntu.com/4430-2/","reference_id":"","reference_type":"","scores":[],"url":"https://usn.ubuntu.com/4430-2/"},{"reference_url":"https://bugzilla.redhat.com/show_bug.cgi?id=1852814","reference_id":"1852814","reference_type":"","scores":[],"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1852814"},{"reference_url":"https://access.redhat.com/errata/RHSA-2020:3185","reference_id":"RHSA-2020:3185","reference_type":"","scores":[],"url":"https://access.redhat.com/errata/RHSA-2020:3185"},{"reference_url":"https://access.redhat.com/errata/RHSA-2020:3299","reference_id":"RHSA-2020:3299","reference_type":"","scores":[],"url":"https://access.redhat.com/errata/RHSA-2020:3299"},{"reference_url":"https://access.redhat.com/errata/RHSA-2020:3302","reference_id":"RHSA-2020:3302","reference_type":"","scores":[],"url":"https://access.redhat.com/errata/RHSA-2020:3302"},{"reference_url":"https://access.redhat.com/errata/RHSA-2021:0420","reference_id":"RHSA-2021:0420","reference_type":"","scores":[],"url":"https://access.redhat.com/errata/RHSA-2021:0420"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/12775?format=json","purl":"pkg:pypi/pillow@7.1.0","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-19e1-19hk-duet"},{"vulnerability":"VCID-1vt7-c6e3-7qc8"},{"vulnerability":"VCID-3qb5-8p8w-gkad"},{"vulnerability":"VCID-3uk9-eds5-rkgc"},{"vulnerability":"VCID-53ac-ceq4-qkhf"},{"vulnerability":"VCID-5rv4-k1q9-zue2"},{"vulnerability":"VCID-64n5-pugj-vue8"},{"vulnerability":"VCID-6gyu-fzpg-c3bn"},{"vulnerability":"VCID-7bjx-gkf7-cke9"},{"vulnerability":"VCID-9ckw-ra54-z3b7"},{"vulnerability":"VCID-aubw-tsmn-ffcq"},{"vulnerability":"VCID-brp2-dtrf-jyfr"},{"vulnerability":"VCID-d7uf-zdbv-sba1"},{"vulnerability":"VCID-df4x-jt3h-17hx"},{"vulnerability":"VCID-dpc3-td9q-dyee"},{"vulnerability":"VCID-en6t-uxtq-bfek"},{"vulnerability":"VCID-g46h-p8jk-cuhc"},{"vulnerability":"VCID-gvjw-funa-sqak"},{"vulnerability":"VCID-khp6-9hfx-1kge"},{"vulnerability":"VCID-n1hp-atex-ubh4"},{"vulnerability":"VCID-n1w5-f5p7-xuhb"},{"vulnerability":"VCID-p6r3-puh1-zyg6"},{"vulnerability":"VCID-q4bb-qnxe-8bfa"},{"vulnerability":"VCID-rncf-9nf8-wud3"},{"vulnerability":"VCID-ue18-zzau-x7hy"},{"vulnerability":"VCID-vdzj-kqfy-d3b7"},{"vulnerability":"VCID-vwbu-ruxm-tbh4"},{"vulnerability":"VCID-vxh1-8rvt-kkak"},{"vulnerability":"VCID-vyzt-df2u-h3cc"},{"vulnerability":"VCID-w9uy-fnpm-cbak"},{"vulnerability":"VCID-x15z-dejc-9ba6"},{"vulnerability":"VCID-xesd-d294-7fcx"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:pypi/pillow@7.1.0"}],"aliases":["BIT-pillow-2020-11538","CVE-2020-11538","GHSA-43fq-w8qq-v88h","PYSEC-2020-80"],"risk_score":4.5,"exploitability":"0.5","weighted_severity":"9.0","resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-b5a2-83ej-puaw"},{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/8707?format=json","vulnerability_id":"VCID-brp2-dtrf-jyfr","summary":"Pillow before 9.0.1 allows attackers to delete files because spaces in temporary pathnames are mishandled.","references":[{"reference_url":"https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2022-24303.json","reference_id":"","reference_type":"","scores":[{"value":"7.4","scoring_system":"cvssv3","scoring_elements":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H"}],"url":"https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2022-24303.json"},{"reference_url":"https://api.first.org/data/v1/epss?cve=CVE-2022-24303","reference_id":"","reference_type":"","scores":[{"value":"0.01428","scoring_system":"epss","scoring_elements":"0.80727","published_at":"2026-05-05T12:55:00Z"},{"value":"0.01428","scoring_system":"epss","scoring_elements":"0.80711","published_at":"2026-04-29T12:55:00Z"},{"value":"0.01428","scoring_system":"epss","scoring_elements":"0.80698","published_at":"2026-04-26T12:55:00Z"},{"value":"0.01428","scoring_system":"epss","scoring_elements":"0.80694","published_at":"2026-04-24T12:55:00Z"},{"value":"0.01428","scoring_system":"epss","scoring_elements":"0.8067","published_at":"2026-04-21T12:55:00Z"},{"value":"0.01428","scoring_system":"epss","scoring_elements":"0.80668","published_at":"2026-04-18T12:55:00Z"},{"value":"0.01428","scoring_system":"epss","scoring_elements":"0.80666","published_at":"2026-04-16T12:55:00Z"},{"value":"0.01428","scoring_system":"epss","scoring_elements":"0.80637","published_at":"2026-04-13T12:55:00Z"},{"value":"0.01428","scoring_system":"epss","scoring_elements":"0.80645","published_at":"2026-04-12T12:55:00Z"},{"value":"0.01428","scoring_system":"epss","scoring_elements":"0.80658","published_at":"2026-04-11T12:55:00Z"},{"value":"0.01428","scoring_system":"epss","scoring_elements":"0.80642","published_at":"2026-04-09T12:55:00Z"},{"value":"0.01428","scoring_system":"epss","scoring_elements":"0.80632","published_at":"2026-04-08T12:55:00Z"},{"value":"0.01428","scoring_system":"epss","scoring_elements":"0.80605","published_at":"2026-04-07T12:55:00Z"},{"value":"0.01428","scoring_system":"epss","scoring_elements":"0.80612","published_at":"2026-04-04T12:55:00Z"},{"value":"0.01428","scoring_system":"epss","scoring_elements":"0.8059","published_at":"2026-04-02T12:55:00Z"}],"url":"https://api.first.org/data/v1/epss?cve=CVE-2022-24303"},{"reference_url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-24303","reference_id":"","reference_type":"","scores":[],"url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-24303"},{"reference_url":"https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml","reference_id":"","reference_type":"","scores":[{"value":"5.9","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N"}],"url":"https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml"},{"reference_url":"https://github.com/advisories/GHSA-9j59-75qj-795w","reference_id":"","reference_type":"","scores":[{"value":"9.1","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H"},{"value":"HIGH","scoring_system":"cvssv3.1_qr","scoring_elements":""},{"value":"8.8","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/advisories/GHSA-9j59-75qj-795w"},{"reference_url":"https://github.com/pypa/advisory-database/tree/main/vulns/pillow/PYSEC-2022-168.yaml","reference_id":"","reference_type":"","scores":[{"value":"9.1","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H"},{"value":"8.8","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/pypa/advisory-database/tree/main/vulns/pillow/PYSEC-2022-168.yaml"},{"reference_url":"https://github.com/python-pillow/Pillow","reference_id":"","reference_type":"","scores":[{"value":"9.1","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H"},{"value":"8.8","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/python-pillow/Pillow"},{"reference_url":"https://github.com/python-pillow/Pillow/blob/e8ab5640774716c5486d3cb05167f74f742ad6ef/CHANGES.rst?plain=1#L1172","reference_id":"","reference_type":"","scores":[{"value":"9.1","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H"},{"value":"8.8","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/python-pillow/Pillow/blob/e8ab5640774716c5486d3cb05167f74f742ad6ef/CHANGES.rst?plain=1#L1172"},{"reference_url":"https://github.com/python-pillow/Pillow/commit/10c4f75aaa383bd9671e923e3b91d391ea12d781","reference_id":"","reference_type":"","scores":[{"value":"9.1","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H"},{"value":"8.8","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/python-pillow/Pillow/commit/10c4f75aaa383bd9671e923e3b91d391ea12d781"},{"reference_url":"https://github.com/python-pillow/Pillow/commit/143032103c9f2d55a0a7960bd3e630cb72549e8a","reference_id":"","reference_type":"","scores":[{"value":"9.1","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H"},{"value":"8.8","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/python-pillow/Pillow/commit/143032103c9f2d55a0a7960bd3e630cb72549e8a"},{"reference_url":"https://github.com/python-pillow/Pillow/commit/427221ef5f19157001bf8b1ad7cfe0b905ca8c26","reference_id":"","reference_type":"","scores":[{"value":"9.1","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H"},{"value":"8.8","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/python-pillow/Pillow/commit/427221ef5f19157001bf8b1ad7cfe0b905ca8c26"},{"reference_url":"https://github.com/python-pillow/Pillow/pull/3450","reference_id":"","reference_type":"","scores":[{"value":"9.1","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H"},{"value":"8.8","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/python-pillow/Pillow/pull/3450"},{"reference_url":"https://github.com/python-pillow/Pillow/pull/6010","reference_id":"","reference_type":"","scores":[{"value":"9.1","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H"},{"value":"8.8","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/python-pillow/Pillow/pull/6010"},{"reference_url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/W4ZUXPKEX72O3E5IHBPVY5ZCPMJ4GHHV","reference_id":"","reference_type":"","scores":[{"value":"9.1","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H"},{"value":"8.8","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/W4ZUXPKEX72O3E5IHBPVY5ZCPMJ4GHHV"},{"reference_url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/XR6UP2XONXOVXI4446VY72R63YRO2YTP","reference_id":"","reference_type":"","scores":[{"value":"9.1","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H"},{"value":"8.8","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/XR6UP2XONXOVXI4446VY72R63YRO2YTP"},{"reference_url":"https://pillow.readthedocs.io/en/stable/releasenotes/9.0.1.html#security","reference_id":"","reference_type":"","scores":[{"value":"9.1","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H"},{"value":"8.8","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://pillow.readthedocs.io/en/stable/releasenotes/9.0.1.html#security"},{"reference_url":"https://security.gentoo.org/glsa/202211-10","reference_id":"","reference_type":"","scores":[{"value":"9.1","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H"},{"value":"8.8","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://security.gentoo.org/glsa/202211-10"},{"reference_url":"https://bugzilla.redhat.com/show_bug.cgi?id=2052682","reference_id":"2052682","reference_type":"","scores":[],"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2052682"},{"reference_url":"https://nvd.nist.gov/vuln/detail/CVE-2022-24303","reference_id":"CVE-2022-24303","reference_type":"","scores":[{"value":"9.1","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H"},{"value":"8.8","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-24303"},{"reference_url":"https://usn.ubuntu.com/5777-1/","reference_id":"USN-5777-1","reference_type":"","scores":[],"url":"https://usn.ubuntu.com/5777-1/"},{"reference_url":"https://usn.ubuntu.com/USN-5777-2/","reference_id":"USN-USN-5777-2","reference_type":"","scores":[],"url":"https://usn.ubuntu.com/USN-5777-2/"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/26287?format=json","purl":"pkg:pypi/pillow@9.0.1","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-19e1-19hk-duet"},{"vulnerability":"VCID-5rv4-k1q9-zue2"},{"vulnerability":"VCID-64n5-pugj-vue8"},{"vulnerability":"VCID-9ckw-ra54-z3b7"},{"vulnerability":"VCID-d7uf-zdbv-sba1"},{"vulnerability":"VCID-n1hp-atex-ubh4"},{"vulnerability":"VCID-vdzj-kqfy-d3b7"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:pypi/pillow@9.0.1"}],"aliases":["BIT-pillow-2022-24303","CVE-2022-24303","GHSA-9j59-75qj-795w","GMS-2022-348","PYSEC-2022-168"],"risk_score":4.1,"exploitability":"0.5","weighted_severity":"8.2","resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-brp2-dtrf-jyfr"},{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/5939?format=json","vulnerability_id":"VCID-cas2-jb3y-vyhz","summary":"An issue was discovered in Pillow before 6.2.0. When reading specially crafted invalid image files, the library can either allocate very large amounts of memory or take an extremely long period of time to process the image.","references":[{"reference_url":"https://access.redhat.com/errata/RHSA-2020:0566","reference_id":"","reference_type":"","scores":[{"value":"7.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"},{"value":"8.7","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://access.redhat.com/errata/RHSA-2020:0566"},{"reference_url":"https://access.redhat.com/errata/RHSA-2020:0578","reference_id":"","reference_type":"","scores":[{"value":"7.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"},{"value":"8.7","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://access.redhat.com/errata/RHSA-2020:0578"},{"reference_url":"https://access.redhat.com/errata/RHSA-2020:0580","reference_id":"","reference_type":"","scores":[{"value":"7.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"},{"value":"8.7","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://access.redhat.com/errata/RHSA-2020:0580"},{"reference_url":"https://access.redhat.com/errata/RHSA-2020:0681","reference_id":"","reference_type":"","scores":[{"value":"7.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"},{"value":"8.7","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://access.redhat.com/errata/RHSA-2020:0681"},{"reference_url":"https://access.redhat.com/errata/RHSA-2020:0683","reference_id":"","reference_type":"","scores":[{"value":"7.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"},{"value":"8.7","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://access.redhat.com/errata/RHSA-2020:0683"},{"reference_url":"https://access.redhat.com/errata/RHSA-2020:0694","reference_id":"","reference_type":"","scores":[{"value":"7.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"},{"value":"8.7","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://access.redhat.com/errata/RHSA-2020:0694"},{"reference_url":"https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2019-16865.json","reference_id":"","reference_type":"","scores":[{"value":"7.5","scoring_system":"cvssv3","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"url":"https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2019-16865.json"},{"reference_url":"https://api.first.org/data/v1/epss?cve=CVE-2019-16865","reference_id":"","reference_type":"","scores":[{"value":"0.03942","scoring_system":"epss","scoring_elements":"0.88387","published_at":"2026-05-05T12:55:00Z"},{"value":"0.03942","scoring_system":"epss","scoring_elements":"0.8829","published_at":"2026-04-01T12:55:00Z"},{"value":"0.03942","scoring_system":"epss","scoring_elements":"0.88298","published_at":"2026-04-02T12:55:00Z"},{"value":"0.03942","scoring_system":"epss","scoring_elements":"0.88313","published_at":"2026-04-04T12:55:00Z"},{"value":"0.03942","scoring_system":"epss","scoring_elements":"0.88317","published_at":"2026-04-07T12:55:00Z"},{"value":"0.03942","scoring_system":"epss","scoring_elements":"0.88336","published_at":"2026-04-08T12:55:00Z"},{"value":"0.03942","scoring_system":"epss","scoring_elements":"0.88343","published_at":"2026-04-09T12:55:00Z"},{"value":"0.03942","scoring_system":"epss","scoring_elements":"0.88353","published_at":"2026-04-11T12:55:00Z"},{"value":"0.03942","scoring_system":"epss","scoring_elements":"0.88345","published_at":"2026-04-13T12:55:00Z"},{"value":"0.03942","scoring_system":"epss","scoring_elements":"0.88358","published_at":"2026-04-16T12:55:00Z"},{"value":"0.03942","scoring_system":"epss","scoring_elements":"0.88355","published_at":"2026-04-18T12:55:00Z"},{"value":"0.03942","scoring_system":"epss","scoring_elements":"0.88354","published_at":"2026-04-21T12:55:00Z"},{"value":"0.03942","scoring_system":"epss","scoring_elements":"0.88371","published_at":"2026-04-24T12:55:00Z"},{"value":"0.03942","scoring_system":"epss","scoring_elements":"0.88375","published_at":"2026-04-26T12:55:00Z"},{"value":"0.03942","scoring_system":"epss","scoring_elements":"0.88376","published_at":"2026-04-29T12:55:00Z"}],"url":"https://api.first.org/data/v1/epss?cve=CVE-2019-16865"},{"reference_url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-16865","reference_id":"","reference_type":"","scores":[],"url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-16865"},{"reference_url":"https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml","reference_id":"","reference_type":"","scores":[{"value":"4","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"}],"url":"https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml"},{"reference_url":"https://github.com/advisories/GHSA-j7mj-748x-7p78","reference_id":"","reference_type":"","scores":[{"value":"7.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"},{"value":"HIGH","scoring_system":"cvssv3.1_qr","scoring_elements":""},{"value":"8.7","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/advisories/GHSA-j7mj-748x-7p78"},{"reference_url":"https://github.com/pypa/advisory-database/tree/main/vulns/pillow/PYSEC-2019-110.yaml","reference_id":"","reference_type":"","scores":[{"value":"7.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"},{"value":"8.7","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/pypa/advisory-database/tree/main/vulns/pillow/PYSEC-2019-110.yaml"},{"reference_url":"https://github.com/python-pillow/Pillow","reference_id":"","reference_type":"","scores":[{"value":"7.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"},{"value":"8.7","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/python-pillow/Pillow"},{"reference_url":"https://github.com/python-pillow/Pillow/commit/ab52630d0644e42a75eb88b78b9a9d7438a6fbeb","reference_id":"","reference_type":"","scores":[{"value":"7.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"},{"value":"8.7","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/python-pillow/Pillow/commit/ab52630d0644e42a75eb88b78b9a9d7438a6fbeb"},{"reference_url":"https://github.com/python-pillow/Pillow/issues/4123","reference_id":"","reference_type":"","scores":[{"value":"7.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"},{"value":"8.7","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/python-pillow/Pillow/issues/4123"},{"reference_url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/EMJBUZQGQ2Q7HXYCQVRLU7OXNC7CAWWU/","reference_id":"","reference_type":"","scores":[],"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/EMJBUZQGQ2Q7HXYCQVRLU7OXNC7CAWWU/"},{"reference_url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LYDXD7EE4YAEVSTNIFZKNVPRVJX5ZOG3/","reference_id":"","reference_type":"","scores":[],"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LYDXD7EE4YAEVSTNIFZKNVPRVJX5ZOG3/"},{"reference_url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/EMJBUZQGQ2Q7HXYCQVRLU7OXNC7CAWWU","reference_id":"","reference_type":"","scores":[{"value":"7.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"},{"value":"8.7","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/EMJBUZQGQ2Q7HXYCQVRLU7OXNC7CAWWU"},{"reference_url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/EMJBUZQGQ2Q7HXYCQVRLU7OXNC7CAWWU/","reference_id":"","reference_type":"","scores":[],"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/EMJBUZQGQ2Q7HXYCQVRLU7OXNC7CAWWU/"},{"reference_url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/LYDXD7EE4YAEVSTNIFZKNVPRVJX5ZOG3","reference_id":"","reference_type":"","scores":[{"value":"7.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"},{"value":"8.7","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/LYDXD7EE4YAEVSTNIFZKNVPRVJX5ZOG3"},{"reference_url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/LYDXD7EE4YAEVSTNIFZKNVPRVJX5ZOG3/","reference_id":"","reference_type":"","scores":[],"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/LYDXD7EE4YAEVSTNIFZKNVPRVJX5ZOG3/"},{"reference_url":"https://nvd.nist.gov/vuln/detail/CVE-2019-16865","reference_id":"","reference_type":"","scores":[{"value":"5.0","scoring_system":"cvssv2","scoring_elements":"AV:N/AC:L/Au:N/C:N/I:N/A:P"},{"value":"7.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"},{"value":"8.7","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://nvd.nist.gov/vuln/detail/CVE-2019-16865"},{"reference_url":"https://pillow.readthedocs.io/en/latest/releasenotes/6.2.0.html","reference_id":"","reference_type":"","scores":[{"value":"7.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"},{"value":"8.7","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://pillow.readthedocs.io/en/latest/releasenotes/6.2.0.html"},{"reference_url":"https://ubuntu.com/security/notices/USN-4272-1","reference_id":"","reference_type":"","scores":[{"value":"7.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"},{"value":"8.7","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://ubuntu.com/security/notices/USN-4272-1"},{"reference_url":"https://usn.ubuntu.com/4272-1","reference_id":"","reference_type":"","scores":[{"value":"7.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"},{"value":"8.7","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://usn.ubuntu.com/4272-1"},{"reference_url":"https://usn.ubuntu.com/4272-1/","reference_id":"","reference_type":"","scores":[],"url":"https://usn.ubuntu.com/4272-1/"},{"reference_url":"https://www.debian.org/security/2020/dsa-4631","reference_id":"","reference_type":"","scores":[{"value":"7.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"},{"value":"8.7","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://www.debian.org/security/2020/dsa-4631"},{"reference_url":"https://bugzilla.redhat.com/show_bug.cgi?id=1774066","reference_id":"1774066","reference_type":"","scores":[],"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1774066"},{"reference_url":"https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:python:pillow:*:*:*:*:*:*:*:*","reference_id":"cpe:2.3:a:python:pillow:*:*:*:*:*:*:*:*","reference_type":"","scores":[],"url":"https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:python:pillow:*:*:*:*:*:*:*:*"},{"reference_url":"https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:o:fedoraproject:fedora:30:*:*:*:*:*:*:*","reference_id":"cpe:2.3:o:fedoraproject:fedora:30:*:*:*:*:*:*:*","reference_type":"","scores":[],"url":"https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:o:fedoraproject:fedora:30:*:*:*:*:*:*:*"},{"reference_url":"https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:o:fedoraproject:fedora:31:*:*:*:*:*:*:*","reference_id":"cpe:2.3:o:fedoraproject:fedora:31:*:*:*:*:*:*:*","reference_type":"","scores":[],"url":"https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:o:fedoraproject:fedora:31:*:*:*:*:*:*:*"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/9387?format=json","purl":"pkg:pypi/pillow@6.2.0","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-19e1-19hk-duet"},{"vulnerability":"VCID-1vt7-c6e3-7qc8"},{"vulnerability":"VCID-3qb5-8p8w-gkad"},{"vulnerability":"VCID-3uk9-eds5-rkgc"},{"vulnerability":"VCID-53ac-ceq4-qkhf"},{"vulnerability":"VCID-5rv4-k1q9-zue2"},{"vulnerability":"VCID-64n5-pugj-vue8"},{"vulnerability":"VCID-6gyu-fzpg-c3bn"},{"vulnerability":"VCID-7bjx-gkf7-cke9"},{"vulnerability":"VCID-8n2b-wvya-53e1"},{"vulnerability":"VCID-9ckw-ra54-z3b7"},{"vulnerability":"VCID-and9-6jty-pyeq"},{"vulnerability":"VCID-aubw-tsmn-ffcq"},{"vulnerability":"VCID-b3au-rcgp-2fag"},{"vulnerability":"VCID-b5a2-83ej-puaw"},{"vulnerability":"VCID-brp2-dtrf-jyfr"},{"vulnerability":"VCID-d7uf-zdbv-sba1"},{"vulnerability":"VCID-df4x-jt3h-17hx"},{"vulnerability":"VCID-dpc3-td9q-dyee"},{"vulnerability":"VCID-en6t-uxtq-bfek"},{"vulnerability":"VCID-g46h-p8jk-cuhc"},{"vulnerability":"VCID-gvjw-funa-sqak"},{"vulnerability":"VCID-h4x7-7fke-mqgp"},{"vulnerability":"VCID-haum-8zpg-6kgf"},{"vulnerability":"VCID-hmmq-5772-bycm"},{"vulnerability":"VCID-khp6-9hfx-1kge"},{"vulnerability":"VCID-m3tm-h4q9-9yay"},{"vulnerability":"VCID-n1hp-atex-ubh4"},{"vulnerability":"VCID-n1w5-f5p7-xuhb"},{"vulnerability":"VCID-p6r3-puh1-zyg6"},{"vulnerability":"VCID-q4bb-qnxe-8bfa"},{"vulnerability":"VCID-rncf-9nf8-wud3"},{"vulnerability":"VCID-sns1-ksqr-vbhr"},{"vulnerability":"VCID-stft-hsk9-zfdy"},{"vulnerability":"VCID-ue18-zzau-x7hy"},{"vulnerability":"VCID-uf5t-asns-tudp"},{"vulnerability":"VCID-vdzj-kqfy-d3b7"},{"vulnerability":"VCID-vwbu-ruxm-tbh4"},{"vulnerability":"VCID-vxh1-8rvt-kkak"},{"vulnerability":"VCID-vyzt-df2u-h3cc"},{"vulnerability":"VCID-w9uy-fnpm-cbak"},{"vulnerability":"VCID-x15z-dejc-9ba6"},{"vulnerability":"VCID-xesd-d294-7fcx"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:pypi/pillow@6.2.0"}],"aliases":["CVE-2019-16865","GHSA-j7mj-748x-7p78","PYSEC-2019-110"],"risk_score":4.0,"exploitability":"0.5","weighted_severity":"8.0","resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-cas2-jb3y-vyhz"},{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/19285?format=json","vulnerability_id":"VCID-d7uf-zdbv-sba1","summary":"Duplicate\nThis advisory duplicates another.","references":[{"reference_url":"https://github.com/pypa/advisory-database/tree/main/vulns/pillow/PYSEC-2023-175.yaml","reference_id":"","reference_type":"","scores":[{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/pypa/advisory-database/tree/main/vulns/pillow/PYSEC-2023-175.yaml"},{"reference_url":"https://github.com/python-pillow/Pillow","reference_id":"","reference_type":"","scores":[{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/python-pillow/Pillow"},{"reference_url":"https://github.com/python-pillow/Pillow/blob/main/CHANGES.rst#1001-2023-09-15","reference_id":"","reference_type":"","scores":[{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/python-pillow/Pillow/blob/main/CHANGES.rst#1001-2023-09-15"},{"reference_url":"https://nvd.nist.gov/vuln/detail/CVE-2023-4863","reference_id":"","reference_type":"","scores":[{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-4863"},{"reference_url":"https://nvd.nist.gov/vuln/detail/CVE-2023-5129","reference_id":"","reference_type":"","scores":[{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-5129"},{"reference_url":"https://github.com/advisories/GHSA-56pw-mpj4-fxww","reference_id":"GHSA-56pw-mpj4-fxww","reference_type":"","scores":[{"value":"HIGH","scoring_system":"cvssv3.1_qr","scoring_elements":""}],"url":"https://github.com/advisories/GHSA-56pw-mpj4-fxww"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/54025?format=json","purl":"pkg:pypi/pillow@10.0.1","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-64n5-pugj-vue8"},{"vulnerability":"VCID-9ckw-ra54-z3b7"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:pypi/pillow@10.0.1"}],"aliases":["GHSA-56pw-mpj4-fxww","GMS-2023-3137"],"risk_score":4.0,"exploitability":"0.5","weighted_severity":"8.0","resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-d7uf-zdbv-sba1"},{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/7545?format=json","vulnerability_id":"VCID-df4x-jt3h-17hx","summary":"path_getbbox in path.c in Pillow before 9.0.0 has a buffer over-read during initialization of ImagePath.Path.","references":[{"reference_url":"https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2022-22816.json","reference_id":"","reference_type":"","scores":[{"value":"6.5","scoring_system":"cvssv3","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L"}],"url":"https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2022-22816.json"},{"reference_url":"https://api.first.org/data/v1/epss?cve=CVE-2022-22816","reference_id":"","reference_type":"","scores":[{"value":"0.00137","scoring_system":"epss","scoring_elements":"0.33108","published_at":"2026-05-05T12:55:00Z"},{"value":"0.00137","scoring_system":"epss","scoring_elements":"0.33219","published_at":"2026-04-29T12:55:00Z"},{"value":"0.00137","scoring_system":"epss","scoring_elements":"0.333","published_at":"2026-04-26T12:55:00Z"},{"value":"0.00137","scoring_system":"epss","scoring_elements":"0.33623","published_at":"2026-04-02T12:55:00Z"},{"value":"0.00137","scoring_system":"epss","scoring_elements":"0.33656","published_at":"2026-04-04T12:55:00Z"},{"value":"0.00137","scoring_system":"epss","scoring_elements":"0.3332","published_at":"2026-04-24T12:55:00Z"},{"value":"0.00137","scoring_system":"epss","scoring_elements":"0.3348","published_at":"2026-04-21T12:55:00Z"},{"value":"0.00137","scoring_system":"epss","scoring_elements":"0.33514","published_at":"2026-04-18T12:55:00Z"},{"value":"0.00137","scoring_system":"epss","scoring_elements":"0.33537","published_at":"2026-04-16T12:55:00Z"},{"value":"0.00137","scoring_system":"epss","scoring_elements":"0.33501","published_at":"2026-04-13T12:55:00Z"},{"value":"0.00137","scoring_system":"epss","scoring_elements":"0.33525","published_at":"2026-04-12T12:55:00Z"},{"value":"0.00137","scoring_system":"epss","scoring_elements":"0.33567","published_at":"2026-04-11T12:55:00Z"},{"value":"0.00137","scoring_system":"epss","scoring_elements":"0.33573","published_at":"2026-04-09T12:55:00Z"},{"value":"0.00137","scoring_system":"epss","scoring_elements":"0.33495","published_at":"2026-04-07T12:55:00Z"},{"value":"0.00137","scoring_system":"epss","scoring_elements":"0.33539","published_at":"2026-04-08T12:55:00Z"}],"url":"https://api.first.org/data/v1/epss?cve=CVE-2022-22816"},{"reference_url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-22815","reference_id":"","reference_type":"","scores":[],"url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-22815"},{"reference_url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-22816","reference_id":"","reference_type":"","scores":[],"url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-22816"},{"reference_url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-22817","reference_id":"","reference_type":"","scores":[],"url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-22817"},{"reference_url":"https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml","reference_id":"","reference_type":"","scores":[{"value":"3.3","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N"}],"url":"https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml"},{"reference_url":"https://github.com/advisories/GHSA-xrcv-f9gm-v42c","reference_id":"","reference_type":"","scores":[{"value":"6.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L"},{"value":"MODERATE","scoring_system":"cvssv3.1_qr","scoring_elements":""},{"value":"6.9","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/advisories/GHSA-xrcv-f9gm-v42c"},{"reference_url":"https://github.com/pypa/advisory-database/tree/main/vulns/pillow/PYSEC-2022-9.yaml","reference_id":"","reference_type":"","scores":[{"value":"6.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L"},{"value":"6.9","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/pypa/advisory-database/tree/main/vulns/pillow/PYSEC-2022-9.yaml"},{"reference_url":"https://github.com/python-pillow/Pillow","reference_id":"","reference_type":"","scores":[{"value":"6.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L"},{"value":"6.9","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/python-pillow/Pillow"},{"reference_url":"https://github.com/python-pillow/Pillow/blob/c5d9223a8b5e9295d15b5a9b1ef1dae44c8499f3/src/path.c#L331","reference_id":"","reference_type":"","scores":[{"value":"6.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L"},{"value":"6.9","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/python-pillow/Pillow/blob/c5d9223a8b5e9295d15b5a9b1ef1dae44c8499f3/src/path.c#L331"},{"reference_url":"https://github.com/python-pillow/Pillow/commit/5543e4e2d409cd9e409bc64cdc77be0af007a31f","reference_id":"","reference_type":"","scores":[{"value":"6.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L"},{"value":"6.9","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/python-pillow/Pillow/commit/5543e4e2d409cd9e409bc64cdc77be0af007a31f"},{"reference_url":"https://github.com/python-pillow/Pillow/pull/5920","reference_id":"","reference_type":"","scores":[{"value":"6.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L"},{"value":"6.9","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/python-pillow/Pillow/pull/5920"},{"reference_url":"https://lists.debian.org/debian-lts-announce/2022/01/msg00018.html","reference_id":"","reference_type":"","scores":[{"value":"6.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L"},{"value":"6.9","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://lists.debian.org/debian-lts-announce/2022/01/msg00018.html"},{"reference_url":"https://pillow.readthedocs.io/en/stable/releasenotes/9.0.0.html#fixed-imagepath-path-array-handling","reference_id":"","reference_type":"","scores":[{"value":"6.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L"},{"value":"6.9","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://pillow.readthedocs.io/en/stable/releasenotes/9.0.0.html#fixed-imagepath-path-array-handling"},{"reference_url":"https://security.gentoo.org/glsa/202211-10","reference_id":"","reference_type":"","scores":[{"value":"6.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L"},{"value":"6.9","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://security.gentoo.org/glsa/202211-10"},{"reference_url":"https://www.debian.org/security/2022/dsa-5053","reference_id":"","reference_type":"","scores":[{"value":"6.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L"},{"value":"6.9","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://www.debian.org/security/2022/dsa-5053"},{"reference_url":"https://bugzilla.redhat.com/show_bug.cgi?id=2042522","reference_id":"2042522","reference_type":"","scores":[],"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2042522"},{"reference_url":"https://nvd.nist.gov/vuln/detail/CVE-2022-22816","reference_id":"CVE-2022-22816","reference_type":"","scores":[{"value":"6.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L"},{"value":"6.9","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-22816"},{"reference_url":"https://access.redhat.com/errata/RHSA-2022:0609","reference_id":"RHSA-2022:0609","reference_type":"","scores":[],"url":"https://access.redhat.com/errata/RHSA-2022:0609"},{"reference_url":"https://access.redhat.com/errata/RHSA-2022:0643","reference_id":"RHSA-2022:0643","reference_type":"","scores":[],"url":"https://access.redhat.com/errata/RHSA-2022:0643"},{"reference_url":"https://access.redhat.com/errata/RHSA-2022:0665","reference_id":"RHSA-2022:0665","reference_type":"","scores":[],"url":"https://access.redhat.com/errata/RHSA-2022:0665"},{"reference_url":"https://access.redhat.com/errata/RHSA-2022:0667","reference_id":"RHSA-2022:0667","reference_type":"","scores":[],"url":"https://access.redhat.com/errata/RHSA-2022:0667"},{"reference_url":"https://access.redhat.com/errata/RHSA-2022:0669","reference_id":"RHSA-2022:0669","reference_type":"","scores":[],"url":"https://access.redhat.com/errata/RHSA-2022:0669"},{"reference_url":"https://usn.ubuntu.com/5227-1/","reference_id":"USN-5227-1","reference_type":"","scores":[],"url":"https://usn.ubuntu.com/5227-1/"},{"reference_url":"https://usn.ubuntu.com/5227-2/","reference_id":"USN-5227-2","reference_type":"","scores":[],"url":"https://usn.ubuntu.com/5227-2/"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/23250?format=json","purl":"pkg:pypi/pillow@9.0.0","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-19e1-19hk-duet"},{"vulnerability":"VCID-5rv4-k1q9-zue2"},{"vulnerability":"VCID-64n5-pugj-vue8"},{"vulnerability":"VCID-9ckw-ra54-z3b7"},{"vulnerability":"VCID-brp2-dtrf-jyfr"},{"vulnerability":"VCID-d7uf-zdbv-sba1"},{"vulnerability":"VCID-n1hp-atex-ubh4"},{"vulnerability":"VCID-q4bb-qnxe-8bfa"},{"vulnerability":"VCID-vdzj-kqfy-d3b7"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:pypi/pillow@9.0.0"}],"aliases":["BIT-pillow-2022-22816","CVE-2022-22816","GHSA-xrcv-f9gm-v42c","PYSEC-2022-9"],"risk_score":3.1,"exploitability":"0.5","weighted_severity":"6.2","resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-df4x-jt3h-17hx"},{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/5504?format=json","vulnerability_id":"VCID-dgds-v95g-pbcv","summary":"Buffer overflow in the ImagingLibTiffDecode function in libImaging/TiffDecode.c in Pillow before 3.1.1 allows remote attackers to overwrite memory via a crafted TIFF file.","references":[{"reference_url":"https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2016-0740.json","reference_id":"","reference_type":"","scores":[],"url":"https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2016-0740.json"},{"reference_url":"https://api.first.org/data/v1/epss?cve=CVE-2016-0740","reference_id":"","reference_type":"","scores":[{"value":"0.00146","scoring_system":"epss","scoring_elements":"0.35005","published_at":"2026-04-18T12:55:00Z"},{"value":"0.00146","scoring_system":"epss","scoring_elements":"0.3502","published_at":"2026-04-16T12:55:00Z"},{"value":"0.00146","scoring_system":"epss","scoring_elements":"0.34493","published_at":"2026-05-05T12:55:00Z"},{"value":"0.00146","scoring_system":"epss","scoring_elements":"0.34621","published_at":"2026-04-29T12:55:00Z"},{"value":"0.00146","scoring_system":"epss","scoring_elements":"0.34712","published_at":"2026-04-26T12:55:00Z"},{"value":"0.00146","scoring_system":"epss","scoring_elements":"0.34732","published_at":"2026-04-24T12:55:00Z"},{"value":"0.00146","scoring_system":"epss","scoring_elements":"0.3496","published_at":"2026-04-21T12:55:00Z"},{"value":"0.00148","scoring_system":"epss","scoring_elements":"0.35325","published_at":"2026-04-04T12:55:00Z"},{"value":"0.00148","scoring_system":"epss","scoring_elements":"0.35221","published_at":"2026-04-13T12:55:00Z"},{"value":"0.00148","scoring_system":"epss","scoring_elements":"0.35245","published_at":"2026-04-12T12:55:00Z"},{"value":"0.00148","scoring_system":"epss","scoring_elements":"0.3528","published_at":"2026-04-11T12:55:00Z"},{"value":"0.00148","scoring_system":"epss","scoring_elements":"0.35277","published_at":"2026-04-09T12:55:00Z"},{"value":"0.00148","scoring_system":"epss","scoring_elements":"0.35096","published_at":"2026-04-01T12:55:00Z"},{"value":"0.00148","scoring_system":"epss","scoring_elements":"0.35252","published_at":"2026-04-08T12:55:00Z"},{"value":"0.00148","scoring_system":"epss","scoring_elements":"0.35207","published_at":"2026-04-07T12:55:00Z"},{"value":"0.00148","scoring_system":"epss","scoring_elements":"0.35296","published_at":"2026-04-02T12:55:00Z"}],"url":"https://api.first.org/data/v1/epss?cve=CVE-2016-0740"},{"reference_url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-0740","reference_id":"","reference_type":"","scores":[],"url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-0740"},{"reference_url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-0775","reference_id":"","reference_type":"","scores":[],"url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-0775"},{"reference_url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-2533","reference_id":"","reference_type":"","scores":[],"url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-2533"},{"reference_url":"https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml","reference_id":"","reference_type":"","scores":[{"value":"5.1","scoring_system":"cvssv2","scoring_elements":"AV:N/AC:H/Au:N/C:P/I:P/A:P"}],"url":"https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml"},{"reference_url":"https://github.com/advisories/GHSA-hggx-3h72-49ww","reference_id":"","reference_type":"","scores":[{"value":"6.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N"},{"value":"MODERATE","scoring_system":"cvssv3.1_qr","scoring_elements":""},{"value":"6.9","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/advisories/GHSA-hggx-3h72-49ww"},{"reference_url":"https://github.com/pypa/advisory-database/tree/main/vulns/pillow/PYSEC-2016-5.yaml","reference_id":"","reference_type":"","scores":[{"value":"6.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N"},{"value":"6.9","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/pypa/advisory-database/tree/main/vulns/pillow/PYSEC-2016-5.yaml"},{"reference_url":"https://github.com/python-pillow/Pillow","reference_id":"","reference_type":"","scores":[{"value":"6.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N"},{"value":"6.9","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/python-pillow/Pillow"},{"reference_url":"https://github.com/python-pillow/Pillow/blob/c3cb690fed5d4bf0c45576759de55d054916c165/CHANGES.rst","reference_id":"","reference_type":"","scores":[{"value":"6.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N"},{"value":"6.9","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/python-pillow/Pillow/blob/c3cb690fed5d4bf0c45576759de55d054916c165/CHANGES.rst"},{"reference_url":"https://github.com/python-pillow/Pillow/commit/6dcbf5bd96b717c58d7b642949da8d323099928e","reference_id":"","reference_type":"","scores":[{"value":"6.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N"},{"value":"6.9","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/python-pillow/Pillow/commit/6dcbf5bd96b717c58d7b642949da8d323099928e"},{"reference_url":"https://security.gentoo.org/glsa/201612-52","reference_id":"","reference_type":"","scores":[{"value":"6.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N"},{"value":"6.9","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://security.gentoo.org/glsa/201612-52"},{"reference_url":"http://www.debian.org/security/2016/dsa-3499","reference_id":"","reference_type":"","scores":[{"value":"6.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N"},{"value":"6.9","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"http://www.debian.org/security/2016/dsa-3499"},{"reference_url":"https://bugzilla.redhat.com/show_bug.cgi?id=1298874","reference_id":"1298874","reference_type":"","scores":[],"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1298874"},{"reference_url":"https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=813905","reference_id":"813905","reference_type":"","scores":[],"url":"https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=813905"},{"reference_url":"https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:python:pillow:*:*:*:*:*:*:*:*","reference_id":"cpe:2.3:a:python:pillow:*:*:*:*:*:*:*:*","reference_type":"","scores":[],"url":"https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:python:pillow:*:*:*:*:*:*:*:*"},{"reference_url":"https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:o:debian:debian_linux:7.0:*:*:*:*:*:*:*","reference_id":"cpe:2.3:o:debian:debian_linux:7.0:*:*:*:*:*:*:*","reference_type":"","scores":[],"url":"https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:o:debian:debian_linux:7.0:*:*:*:*:*:*:*"},{"reference_url":"https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*","reference_id":"cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*","reference_type":"","scores":[],"url":"https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*"},{"reference_url":"https://nvd.nist.gov/vuln/detail/CVE-2016-0740","reference_id":"CVE-2016-0740","reference_type":"","scores":[{"value":"4.3","scoring_system":"cvssv2","scoring_elements":"AV:N/AC:M/Au:N/C:N/I:P/A:N"},{"value":"6.5","scoring_system":"cvssv3","scoring_elements":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N"},{"value":"6.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N"},{"value":"6.9","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://nvd.nist.gov/vuln/detail/CVE-2016-0740"},{"reference_url":"https://usn.ubuntu.com/3090-1/","reference_id":"USN-3090-1","reference_type":"","scores":[],"url":"https://usn.ubuntu.com/3090-1/"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/4257?format=json","purl":"pkg:pypi/pillow@3.1.1","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-19e1-19hk-duet"},{"vulnerability":"VCID-1vt7-c6e3-7qc8"},{"vulnerability":"VCID-3qb5-8p8w-gkad"},{"vulnerability":"VCID-3uk9-eds5-rkgc"},{"vulnerability":"VCID-53ac-ceq4-qkhf"},{"vulnerability":"VCID-5rv4-k1q9-zue2"},{"vulnerability":"VCID-64n5-pugj-vue8"},{"vulnerability":"VCID-6gyu-fzpg-c3bn"},{"vulnerability":"VCID-8n2b-wvya-53e1"},{"vulnerability":"VCID-9ckw-ra54-z3b7"},{"vulnerability":"VCID-and9-6jty-pyeq"},{"vulnerability":"VCID-aubw-tsmn-ffcq"},{"vulnerability":"VCID-b3au-rcgp-2fag"},{"vulnerability":"VCID-b5a2-83ej-puaw"},{"vulnerability":"VCID-brp2-dtrf-jyfr"},{"vulnerability":"VCID-cas2-jb3y-vyhz"},{"vulnerability":"VCID-d7uf-zdbv-sba1"},{"vulnerability":"VCID-df4x-jt3h-17hx"},{"vulnerability":"VCID-dpc3-td9q-dyee"},{"vulnerability":"VCID-e3gp-zc2b-budg"},{"vulnerability":"VCID-en6t-uxtq-bfek"},{"vulnerability":"VCID-g46h-p8jk-cuhc"},{"vulnerability":"VCID-gvjw-funa-sqak"},{"vulnerability":"VCID-h4x7-7fke-mqgp"},{"vulnerability":"VCID-haum-8zpg-6kgf"},{"vulnerability":"VCID-hmmq-5772-bycm"},{"vulnerability":"VCID-khp6-9hfx-1kge"},{"vulnerability":"VCID-m3tm-h4q9-9yay"},{"vulnerability":"VCID-n1hp-atex-ubh4"},{"vulnerability":"VCID-n1w5-f5p7-xuhb"},{"vulnerability":"VCID-p6r3-puh1-zyg6"},{"vulnerability":"VCID-q4bb-qnxe-8bfa"},{"vulnerability":"VCID-rncf-9nf8-wud3"},{"vulnerability":"VCID-sns1-ksqr-vbhr"},{"vulnerability":"VCID-stft-hsk9-zfdy"},{"vulnerability":"VCID-u1en-t8ux-uube"},{"vulnerability":"VCID-ue18-zzau-x7hy"},{"vulnerability":"VCID-uf5t-asns-tudp"},{"vulnerability":"VCID-vdzj-kqfy-d3b7"},{"vulnerability":"VCID-vwbu-ruxm-tbh4"},{"vulnerability":"VCID-vxh1-8rvt-kkak"},{"vulnerability":"VCID-vyzt-df2u-h3cc"},{"vulnerability":"VCID-w9uy-fnpm-cbak"},{"vulnerability":"VCID-x15z-dejc-9ba6"},{"vulnerability":"VCID-xesd-d294-7fcx"},{"vulnerability":"VCID-xk66-1d31-2qbk"},{"vulnerability":"VCID-yccg-zw89-vqff"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:pypi/pillow@3.1.1"}],"aliases":["CVE-2016-0740","GHSA-hggx-3h72-49ww","PYSEC-2016-5"],"risk_score":3.1,"exploitability":"0.5","weighted_severity":"6.2","resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-dgds-v95g-pbcv"},{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/5380?format=json","vulnerability_id":"VCID-dgy9-uh9h-xfft","summary":"The (1) load_djpeg function in JpegImagePlugin.py, (2) Ghostscript function in EpsImagePlugin.py, (3) load function in IptcImagePlugin.py, and (4) _copy function in Image.py in Python Image Library (PIL) 1.1.7 and earlier and Pillow before 2.3.1 do not properly create temporary files, which allow local users to overwrite arbitrary files and obtain sensitive information via a symlink attack on the temporary file.","references":[{"reference_url":"http://lists.opensuse.org/opensuse-updates/2014-05/msg00002.html","reference_id":"","reference_type":"","scores":[{"value":"7.7","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N"},{"value":"8.5","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"http://lists.opensuse.org/opensuse-updates/2014-05/msg00002.html"},{"reference_url":"https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2014-1932.json","reference_id":"","reference_type":"","scores":[],"url":"https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2014-1932.json"},{"reference_url":"https://api.first.org/data/v1/epss?cve=CVE-2014-1932","reference_id":"","reference_type":"","scores":[{"value":"0.00098","scoring_system":"epss","scoring_elements":"0.26872","published_at":"2026-04-26T12:55:00Z"},{"value":"0.00098","scoring_system":"epss","scoring_elements":"0.2688","published_at":"2026-04-24T12:55:00Z"},{"value":"0.00098","scoring_system":"epss","scoring_elements":"0.26928","published_at":"2026-04-21T12:55:00Z"},{"value":"0.00098","scoring_system":"epss","scoring_elements":"0.26989","published_at":"2026-04-16T12:55:00Z"},{"value":"0.00098","scoring_system":"epss","scoring_elements":"0.26981","published_at":"2026-04-13T12:55:00Z"},{"value":"0.00098","scoring_system":"epss","scoring_elements":"0.27172","published_at":"2026-04-04T12:55:00Z"},{"value":"0.00098","scoring_system":"epss","scoring_elements":"0.26964","published_at":"2026-04-18T12:55:00Z"},{"value":"0.00098","scoring_system":"epss","scoring_elements":"0.27033","published_at":"2026-04-08T12:55:00Z"},{"value":"0.00098","scoring_system":"epss","scoring_elements":"0.27037","published_at":"2026-04-12T12:55:00Z"},{"value":"0.00098","scoring_system":"epss","scoring_elements":"0.27078","published_at":"2026-04-09T12:55:00Z"},{"value":"0.00098","scoring_system":"epss","scoring_elements":"0.27082","published_at":"2026-04-11T12:55:00Z"},{"value":"0.00098","scoring_system":"epss","scoring_elements":"0.26659","published_at":"2026-05-05T12:55:00Z"},{"value":"0.00098","scoring_system":"epss","scoring_elements":"0.26808","published_at":"2026-04-29T12:55:00Z"},{"value":"0.00133","scoring_system":"epss","scoring_elements":"0.32904","published_at":"2026-04-01T12:55:00Z"},{"value":"0.00133","scoring_system":"epss","scoring_elements":"0.33034","published_at":"2026-04-02T12:55:00Z"}],"url":"https://api.first.org/data/v1/epss?cve=CVE-2014-1932"},{"reference_url":"https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=737059","reference_id":"","reference_type":"","scores":[{"value":"7.7","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N"},{"value":"8.5","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=737059"},{"reference_url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-1932","reference_id":"","reference_type":"","scores":[],"url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-1932"},{"reference_url":"https://github.com/pypa/advisory-database/tree/main/vulns/pillow/PYSEC-2014-22.yaml","reference_id":"","reference_type":"","scores":[{"value":"7.7","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N"},{"value":"8.5","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/pypa/advisory-database/tree/main/vulns/pillow/PYSEC-2014-22.yaml"},{"reference_url":"https://github.com/python-imaging/Pillow/commit/4e9f367dfd3f04c8f5d23f7f759ec12782e10ee7","reference_id":"","reference_type":"","scores":[{"value":"7.7","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N"},{"value":"8.5","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/python-imaging/Pillow/commit/4e9f367dfd3f04c8f5d23f7f759ec12782e10ee7"},{"reference_url":"https://github.com/python-pillow/Pillow","reference_id":"","reference_type":"","scores":[{"value":"7.7","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N"},{"value":"8.5","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/python-pillow/Pillow"},{"reference_url":"https://nvd.nist.gov/vuln/detail/CVE-2014-1932","reference_id":"","reference_type":"","scores":[{"value":"7.7","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N"},{"value":"8.5","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://nvd.nist.gov/vuln/detail/CVE-2014-1932"},{"reference_url":"https://security.gentoo.org/glsa/201612-52","reference_id":"","reference_type":"","scores":[{"value":"7.7","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N"},{"value":"8.5","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://security.gentoo.org/glsa/201612-52"},{"reference_url":"https://web.archive.org/web/20170103151725/http://www.securityfocus.com/bid/65511","reference_id":"","reference_type":"","scores":[{"value":"7.7","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N"},{"value":"8.5","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://web.archive.org/web/20170103151725/http://www.securityfocus.com/bid/65511"},{"reference_url":"http://www.openwall.com/lists/oss-security/2014/02/11/1","reference_id":"","reference_type":"","scores":[{"value":"7.7","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N"},{"value":"8.5","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"http://www.openwall.com/lists/oss-security/2014/02/11/1"},{"reference_url":"http://www.securityfocus.com/bid/65511","reference_id":"","reference_type":"","scores":[],"url":"http://www.securityfocus.com/bid/65511"},{"reference_url":"http://www.ubuntu.com/usn/USN-2168-1","reference_id":"","reference_type":"","scores":[{"value":"7.7","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N"},{"value":"8.5","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"http://www.ubuntu.com/usn/USN-2168-1"},{"reference_url":"https://bugzilla.redhat.com/show_bug.cgi?id=1063658","reference_id":"1063658","reference_type":"","scores":[],"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1063658"},{"reference_url":"https://github.com/advisories/GHSA-x895-2wrm-hvp7","reference_id":"GHSA-x895-2wrm-hvp7","reference_type":"","scores":[{"value":"HIGH","scoring_system":"cvssv3.1_qr","scoring_elements":""}],"url":"https://github.com/advisories/GHSA-x895-2wrm-hvp7"},{"reference_url":"https://usn.ubuntu.com/2168-1/","reference_id":"USN-2168-1","reference_type":"","scores":[],"url":"https://usn.ubuntu.com/2168-1/"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/3048?format=json","purl":"pkg:pypi/pillow@2.3.1","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-19e1-19hk-duet"},{"vulnerability":"VCID-1vt7-c6e3-7qc8"},{"vulnerability":"VCID-366h-8f99-r7at"},{"vulnerability":"VCID-3qb5-8p8w-gkad"},{"vulnerability":"VCID-3uk9-eds5-rkgc"},{"vulnerability":"VCID-53ac-ceq4-qkhf"},{"vulnerability":"VCID-5rv4-k1q9-zue2"},{"vulnerability":"VCID-64n5-pugj-vue8"},{"vulnerability":"VCID-6gyu-fzpg-c3bn"},{"vulnerability":"VCID-8n2b-wvya-53e1"},{"vulnerability":"VCID-9ckw-ra54-z3b7"},{"vulnerability":"VCID-and9-6jty-pyeq"},{"vulnerability":"VCID-aubw-tsmn-ffcq"},{"vulnerability":"VCID-avx2-mahw-mqes"},{"vulnerability":"VCID-b3au-rcgp-2fag"},{"vulnerability":"VCID-b5a2-83ej-puaw"},{"vulnerability":"VCID-brp2-dtrf-jyfr"},{"vulnerability":"VCID-cas2-jb3y-vyhz"},{"vulnerability":"VCID-d7uf-zdbv-sba1"},{"vulnerability":"VCID-df4x-jt3h-17hx"},{"vulnerability":"VCID-dgds-v95g-pbcv"},{"vulnerability":"VCID-dpc3-td9q-dyee"},{"vulnerability":"VCID-e3gp-zc2b-budg"},{"vulnerability":"VCID-en6t-uxtq-bfek"},{"vulnerability":"VCID-g46h-p8jk-cuhc"},{"vulnerability":"VCID-gmd5-pbxc-a3gd"},{"vulnerability":"VCID-gvjw-funa-sqak"},{"vulnerability":"VCID-h4x7-7fke-mqgp"},{"vulnerability":"VCID-haum-8zpg-6kgf"},{"vulnerability":"VCID-hmmq-5772-bycm"},{"vulnerability":"VCID-khp6-9hfx-1kge"},{"vulnerability":"VCID-m3tm-h4q9-9yay"},{"vulnerability":"VCID-ma2g-2f8d-dqa9"},{"vulnerability":"VCID-n1hp-atex-ubh4"},{"vulnerability":"VCID-n1w5-f5p7-xuhb"},{"vulnerability":"VCID-p6r3-puh1-zyg6"},{"vulnerability":"VCID-q4bb-qnxe-8bfa"},{"vulnerability":"VCID-qjqr-jyjn-xfh9"},{"vulnerability":"VCID-rncf-9nf8-wud3"},{"vulnerability":"VCID-sns1-ksqr-vbhr"},{"vulnerability":"VCID-stft-hsk9-zfdy"},{"vulnerability":"VCID-u1en-t8ux-uube"},{"vulnerability":"VCID-ue18-zzau-x7hy"},{"vulnerability":"VCID-uf5t-asns-tudp"},{"vulnerability":"VCID-vdzj-kqfy-d3b7"},{"vulnerability":"VCID-vwbu-ruxm-tbh4"},{"vulnerability":"VCID-vxh1-8rvt-kkak"},{"vulnerability":"VCID-vyzt-df2u-h3cc"},{"vulnerability":"VCID-vz9s-jqpb-2ybf"},{"vulnerability":"VCID-w9uy-fnpm-cbak"},{"vulnerability":"VCID-x15z-dejc-9ba6"},{"vulnerability":"VCID-xesd-d294-7fcx"},{"vulnerability":"VCID-xk66-1d31-2qbk"},{"vulnerability":"VCID-zmd3-henq-r7bd"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:pypi/pillow@2.3.1"}],"aliases":["CVE-2014-1932","GHSA-x895-2wrm-hvp7","PYSEC-2014-22"],"risk_score":4.0,"exploitability":"0.5","weighted_severity":"8.0","resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-dgy9-uh9h-xfft"},{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/7559?format=json","vulnerability_id":"VCID-dpc3-td9q-dyee","summary":"path_getbbox in path.c in Pillow before 9.0.0 improperly initializes ImagePath.Path.","references":[{"reference_url":"https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2022-22815.json","reference_id":"","reference_type":"","scores":[{"value":"6.5","scoring_system":"cvssv3","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L"}],"url":"https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2022-22815.json"},{"reference_url":"https://api.first.org/data/v1/epss?cve=CVE-2022-22815","reference_id":"","reference_type":"","scores":[{"value":"0.00095","scoring_system":"epss","scoring_elements":"0.26032","published_at":"2026-05-05T12:55:00Z"},{"value":"0.00095","scoring_system":"epss","scoring_elements":"0.2615","published_at":"2026-04-29T12:55:00Z"},{"value":"0.00095","scoring_system":"epss","scoring_elements":"0.26201","published_at":"2026-04-26T12:55:00Z"},{"value":"0.00095","scoring_system":"epss","scoring_elements":"0.26208","published_at":"2026-04-24T12:55:00Z"},{"value":"0.00095","scoring_system":"epss","scoring_elements":"0.26277","published_at":"2026-04-21T12:55:00Z"},{"value":"0.00095","scoring_system":"epss","scoring_elements":"0.26314","published_at":"2026-04-18T12:55:00Z"},{"value":"0.00095","scoring_system":"epss","scoring_elements":"0.26332","published_at":"2026-04-13T12:55:00Z"},{"value":"0.00095","scoring_system":"epss","scoring_elements":"0.2639","published_at":"2026-04-12T12:55:00Z"},{"value":"0.00095","scoring_system":"epss","scoring_elements":"0.2634","published_at":"2026-04-16T12:55:00Z"},{"value":"0.00095","scoring_system":"epss","scoring_elements":"0.26486","published_at":"2026-04-02T12:55:00Z"},{"value":"0.00095","scoring_system":"epss","scoring_elements":"0.26529","published_at":"2026-04-04T12:55:00Z"},{"value":"0.00095","scoring_system":"epss","scoring_elements":"0.2631","published_at":"2026-04-07T12:55:00Z"},{"value":"0.00095","scoring_system":"epss","scoring_elements":"0.26377","published_at":"2026-04-08T12:55:00Z"},{"value":"0.00095","scoring_system":"epss","scoring_elements":"0.26428","published_at":"2026-04-09T12:55:00Z"},{"value":"0.00095","scoring_system":"epss","scoring_elements":"0.26436","published_at":"2026-04-11T12:55:00Z"}],"url":"https://api.first.org/data/v1/epss?cve=CVE-2022-22815"},{"reference_url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-22815","reference_id":"","reference_type":"","scores":[],"url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-22815"},{"reference_url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-22816","reference_id":"","reference_type":"","scores":[],"url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-22816"},{"reference_url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-22817","reference_id":"","reference_type":"","scores":[],"url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-22817"},{"reference_url":"https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml","reference_id":"","reference_type":"","scores":[{"value":"3.3","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N"}],"url":"https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml"},{"reference_url":"https://github.com/advisories/GHSA-pw3c-h7wp-cvhx","reference_id":"","reference_type":"","scores":[{"value":"6.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L"},{"value":"MODERATE","scoring_system":"cvssv3.1_qr","scoring_elements":""},{"value":"6.9","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/advisories/GHSA-pw3c-h7wp-cvhx"},{"reference_url":"https://github.com/pypa/advisory-database/tree/main/vulns/pillow/PYSEC-2022-8.yaml","reference_id":"","reference_type":"","scores":[{"value":"6.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L"},{"value":"6.9","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/pypa/advisory-database/tree/main/vulns/pillow/PYSEC-2022-8.yaml"},{"reference_url":"https://github.com/python-pillow/Pillow","reference_id":"","reference_type":"","scores":[{"value":"6.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L"},{"value":"6.9","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/python-pillow/Pillow"},{"reference_url":"https://github.com/python-pillow/Pillow/blob/c5d9223a8b5e9295d15b5a9b1ef1dae44c8499f3/src/path.c#L331","reference_id":"","reference_type":"","scores":[{"value":"6.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L"},{"value":"6.9","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/python-pillow/Pillow/blob/c5d9223a8b5e9295d15b5a9b1ef1dae44c8499f3/src/path.c#L331"},{"reference_url":"https://github.com/python-pillow/Pillow/blob/e8ab5640774716c5486d3cb05167f74f742ad6ef/CHANGES.rst?plain=1#L1187","reference_id":"","reference_type":"","scores":[{"value":"6.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L"},{"value":"6.9","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/python-pillow/Pillow/blob/e8ab5640774716c5486d3cb05167f74f742ad6ef/CHANGES.rst?plain=1#L1187"},{"reference_url":"https://github.com/python-pillow/Pillow/commit/1e092419b6806495c683043ab3feb6ce264f3b9c","reference_id":"","reference_type":"","scores":[{"value":"6.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L"},{"value":"6.9","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/python-pillow/Pillow/commit/1e092419b6806495c683043ab3feb6ce264f3b9c"},{"reference_url":"https://github.com/python-pillow/Pillow/commit/c48271ab354db49cdbd740bc45e13be4f0f7993c","reference_id":"","reference_type":"","scores":[{"value":"6.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L"},{"value":"6.9","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/python-pillow/Pillow/commit/c48271ab354db49cdbd740bc45e13be4f0f7993c"},{"reference_url":"https://github.com/python-pillow/Pillow/pull/5920","reference_id":"","reference_type":"","scores":[{"value":"6.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L"},{"value":"6.9","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/python-pillow/Pillow/pull/5920"},{"reference_url":"https://lists.debian.org/debian-lts-announce/2022/01/msg00018.html","reference_id":"","reference_type":"","scores":[{"value":"6.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L"},{"value":"6.9","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://lists.debian.org/debian-lts-announce/2022/01/msg00018.html"},{"reference_url":"https://pillow.readthedocs.io/en/stable/releasenotes/9.0.0.html#fixed-imagepath-path-array-handling","reference_id":"","reference_type":"","scores":[{"value":"6.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L"},{"value":"6.9","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://pillow.readthedocs.io/en/stable/releasenotes/9.0.0.html#fixed-imagepath-path-array-handling"},{"reference_url":"https://www.debian.org/security/2022/dsa-5053","reference_id":"","reference_type":"","scores":[{"value":"6.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L"},{"value":"6.9","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://www.debian.org/security/2022/dsa-5053"},{"reference_url":"https://bugzilla.redhat.com/show_bug.cgi?id=2042511","reference_id":"2042511","reference_type":"","scores":[],"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2042511"},{"reference_url":"https://nvd.nist.gov/vuln/detail/CVE-2022-22815","reference_id":"CVE-2022-22815","reference_type":"","scores":[{"value":"6.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L"},{"value":"6.9","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-22815"},{"reference_url":"https://access.redhat.com/errata/RHSA-2022:0643","reference_id":"RHSA-2022:0643","reference_type":"","scores":[],"url":"https://access.redhat.com/errata/RHSA-2022:0643"},{"reference_url":"https://usn.ubuntu.com/5227-1/","reference_id":"USN-5227-1","reference_type":"","scores":[],"url":"https://usn.ubuntu.com/5227-1/"},{"reference_url":"https://usn.ubuntu.com/5227-2/","reference_id":"USN-5227-2","reference_type":"","scores":[],"url":"https://usn.ubuntu.com/5227-2/"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/23250?format=json","purl":"pkg:pypi/pillow@9.0.0","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-19e1-19hk-duet"},{"vulnerability":"VCID-5rv4-k1q9-zue2"},{"vulnerability":"VCID-64n5-pugj-vue8"},{"vulnerability":"VCID-9ckw-ra54-z3b7"},{"vulnerability":"VCID-brp2-dtrf-jyfr"},{"vulnerability":"VCID-d7uf-zdbv-sba1"},{"vulnerability":"VCID-n1hp-atex-ubh4"},{"vulnerability":"VCID-q4bb-qnxe-8bfa"},{"vulnerability":"VCID-vdzj-kqfy-d3b7"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:pypi/pillow@9.0.0"}],"aliases":["BIT-pillow-2022-22815","CVE-2022-22815","GHSA-pw3c-h7wp-cvhx","PYSEC-2022-8"],"risk_score":3.1,"exploitability":"0.5","weighted_severity":"6.2","resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-dpc3-td9q-dyee"},{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/5522?format=json","vulnerability_id":"VCID-e3gp-zc2b-budg","summary":"Pillow before 3.3.2 allows context-dependent attackers to obtain sensitive information by using the \"crafted image file\" approach, related to an \"Integer Overflow\" issue affecting the Image.core.map_buffer in map.c component.","references":[{"reference_url":"http://pillow.readthedocs.io/en/3.4.x/releasenotes/3.3.2.html","reference_id":"","reference_type":"","scores":[{"value":"5.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N"},{"value":"6.9","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"http://pillow.readthedocs.io/en/3.4.x/releasenotes/3.3.2.html"},{"reference_url":"https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2016-9189.json","reference_id":"","reference_type":"","scores":[{"value":"6.5","scoring_system":"cvssv3","scoring_elements":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L"}],"url":"https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2016-9189.json"},{"reference_url":"https://api.first.org/data/v1/epss?cve=CVE-2016-9189","reference_id":"","reference_type":"","scores":[{"value":"0.00358","scoring_system":"epss","scoring_elements":"0.57999","published_at":"2026-04-24T12:55:00Z"},{"value":"0.00358","scoring_system":"epss","scoring_elements":"0.58033","published_at":"2026-04-21T12:55:00Z"},{"value":"0.00358","scoring_system":"epss","scoring_elements":"0.58056","published_at":"2026-04-18T12:55:00Z"},{"value":"0.00358","scoring_system":"epss","scoring_elements":"0.58025","published_at":"2026-04-13T12:55:00Z"},{"value":"0.00358","scoring_system":"epss","scoring_elements":"0.58046","published_at":"2026-04-12T12:55:00Z"},{"value":"0.00358","scoring_system":"epss","scoring_elements":"0.58069","published_at":"2026-04-11T12:55:00Z"},{"value":"0.00358","scoring_system":"epss","scoring_elements":"0.58053","published_at":"2026-04-09T12:55:00Z"},{"value":"0.00358","scoring_system":"epss","scoring_elements":"0.57913","published_at":"2026-04-01T12:55:00Z"},{"value":"0.00358","scoring_system":"epss","scoring_elements":"0.57998","published_at":"2026-04-02T12:55:00Z"},{"value":"0.00358","scoring_system":"epss","scoring_elements":"0.5802","published_at":"2026-04-04T12:55:00Z"},{"value":"0.00358","scoring_system":"epss","scoring_elements":"0.57953","published_at":"2026-05-05T12:55:00Z"},{"value":"0.00358","scoring_system":"epss","scoring_elements":"0.57996","published_at":"2026-04-29T12:55:00Z"},{"value":"0.00358","scoring_system":"epss","scoring_elements":"0.58013","published_at":"2026-04-26T12:55:00Z"},{"value":"0.00358","scoring_system":"epss","scoring_elements":"0.58049","published_at":"2026-04-08T12:55:00Z"},{"value":"0.00358","scoring_system":"epss","scoring_elements":"0.57994","published_at":"2026-04-07T12:55:00Z"}],"url":"https://api.first.org/data/v1/epss?cve=CVE-2016-9189"},{"reference_url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-9189","reference_id":"","reference_type":"","scores":[],"url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-9189"},{"reference_url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-9190","reference_id":"","reference_type":"","scores":[],"url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-9190"},{"reference_url":"https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml","reference_id":"","reference_type":"","scores":[{"value":"4.3","scoring_system":"cvssv2","scoring_elements":"AV:N/AC:M/Au:N/C:P/I:N/A:N"}],"url":"https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml"},{"reference_url":"https://github.com/advisories/GHSA-rwr3-c2q8-gm56","reference_id":"","reference_type":"","scores":[{"value":"5.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N"},{"value":"MODERATE","scoring_system":"cvssv3.1_qr","scoring_elements":""},{"value":"6.9","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/advisories/GHSA-rwr3-c2q8-gm56"},{"reference_url":"https://github.com/pypa/advisory-database/tree/main/vulns/pillow/PYSEC-2016-8.yaml","reference_id":"","reference_type":"","scores":[{"value":"5.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N"},{"value":"6.9","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/pypa/advisory-database/tree/main/vulns/pillow/PYSEC-2016-8.yaml"},{"reference_url":"https://github.com/python-pillow/Pillow","reference_id":"","reference_type":"","scores":[{"value":"5.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N"},{"value":"6.9","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/python-pillow/Pillow"},{"reference_url":"https://github.com/python-pillow/Pillow/issues/2105","reference_id":"","reference_type":"","scores":[{"value":"5.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N"},{"value":"6.9","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/python-pillow/Pillow/issues/2105"},{"reference_url":"https://github.com/python-pillow/Pillow/pull/2146/commits/c50ebe6459a131a1ea8ca531f10da616d3ceaa0f","reference_id":"","reference_type":"","scores":[{"value":"5.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N"},{"value":"6.9","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/python-pillow/Pillow/pull/2146/commits/c50ebe6459a131a1ea8ca531f10da616d3ceaa0f"},{"reference_url":"https://security.gentoo.org/glsa/201612-52","reference_id":"","reference_type":"","scores":[{"value":"5.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N"},{"value":"6.9","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://security.gentoo.org/glsa/201612-52"},{"reference_url":"http://www.debian.org/security/2016/dsa-3710","reference_id":"","reference_type":"","scores":[{"value":"5.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N"},{"value":"6.9","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"http://www.debian.org/security/2016/dsa-3710"},{"reference_url":"http://www.securityfocus.com/bid/94234","reference_id":"","reference_type":"","scores":[{"value":"5.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N"},{"value":"6.9","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"http://www.securityfocus.com/bid/94234"},{"reference_url":"https://bugzilla.redhat.com/show_bug.cgi?id=1382000","reference_id":"1382000","reference_type":"","scores":[],"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1382000"},{"reference_url":"https://nvd.nist.gov/vuln/detail/CVE-2016-9189","reference_id":"CVE-2016-9189","reference_type":"","scores":[{"value":"5.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N"},{"value":"6.9","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://nvd.nist.gov/vuln/detail/CVE-2016-9189"},{"reference_url":"https://usn.ubuntu.com/3229-1/","reference_id":"USN-3229-1","reference_type":"","scores":[],"url":"https://usn.ubuntu.com/3229-1/"},{"reference_url":"https://usn.ubuntu.com/3230-1/","reference_id":"USN-3230-1","reference_type":"","scores":[],"url":"https://usn.ubuntu.com/3230-1/"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/4497?format=json","purl":"pkg:pypi/pillow@3.3.2","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-19e1-19hk-duet"},{"vulnerability":"VCID-1vt7-c6e3-7qc8"},{"vulnerability":"VCID-3qb5-8p8w-gkad"},{"vulnerability":"VCID-3uk9-eds5-rkgc"},{"vulnerability":"VCID-53ac-ceq4-qkhf"},{"vulnerability":"VCID-5rv4-k1q9-zue2"},{"vulnerability":"VCID-64n5-pugj-vue8"},{"vulnerability":"VCID-6gyu-fzpg-c3bn"},{"vulnerability":"VCID-8n2b-wvya-53e1"},{"vulnerability":"VCID-9ckw-ra54-z3b7"},{"vulnerability":"VCID-and9-6jty-pyeq"},{"vulnerability":"VCID-aubw-tsmn-ffcq"},{"vulnerability":"VCID-b3au-rcgp-2fag"},{"vulnerability":"VCID-b5a2-83ej-puaw"},{"vulnerability":"VCID-brp2-dtrf-jyfr"},{"vulnerability":"VCID-cas2-jb3y-vyhz"},{"vulnerability":"VCID-d7uf-zdbv-sba1"},{"vulnerability":"VCID-df4x-jt3h-17hx"},{"vulnerability":"VCID-dpc3-td9q-dyee"},{"vulnerability":"VCID-en6t-uxtq-bfek"},{"vulnerability":"VCID-g46h-p8jk-cuhc"},{"vulnerability":"VCID-gvjw-funa-sqak"},{"vulnerability":"VCID-h4x7-7fke-mqgp"},{"vulnerability":"VCID-haum-8zpg-6kgf"},{"vulnerability":"VCID-hmmq-5772-bycm"},{"vulnerability":"VCID-khp6-9hfx-1kge"},{"vulnerability":"VCID-m3tm-h4q9-9yay"},{"vulnerability":"VCID-n1hp-atex-ubh4"},{"vulnerability":"VCID-n1w5-f5p7-xuhb"},{"vulnerability":"VCID-p6r3-puh1-zyg6"},{"vulnerability":"VCID-q4bb-qnxe-8bfa"},{"vulnerability":"VCID-rncf-9nf8-wud3"},{"vulnerability":"VCID-sns1-ksqr-vbhr"},{"vulnerability":"VCID-stft-hsk9-zfdy"},{"vulnerability":"VCID-ue18-zzau-x7hy"},{"vulnerability":"VCID-uf5t-asns-tudp"},{"vulnerability":"VCID-vdzj-kqfy-d3b7"},{"vulnerability":"VCID-vwbu-ruxm-tbh4"},{"vulnerability":"VCID-vxh1-8rvt-kkak"},{"vulnerability":"VCID-vyzt-df2u-h3cc"},{"vulnerability":"VCID-w9uy-fnpm-cbak"},{"vulnerability":"VCID-x15z-dejc-9ba6"},{"vulnerability":"VCID-xesd-d294-7fcx"},{"vulnerability":"VCID-xk66-1d31-2qbk"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:pypi/pillow@3.3.2"}],"aliases":["CVE-2016-9189","GHSA-rwr3-c2q8-gm56","PYSEC-2016-8"],"risk_score":3.1,"exploitability":"0.5","weighted_severity":"6.2","resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-e3gp-zc2b-budg"},{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/6292?format=json","vulnerability_id":"VCID-en6t-uxtq-bfek","summary":"An issue was discovered in Pillow before 8.1.1. TiffDecode has a heap-based buffer overflow when decoding crafted YCbCr files because of certain interpretation conflicts with LibTIFF in RGBA mode. NOTE: this issue exists because of an incomplete fix for CVE-2020-35654.","references":[{"reference_url":"https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2021-25289.json","reference_id":"","reference_type":"","scores":[{"value":"9.8","scoring_system":"cvssv3","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"}],"url":"https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2021-25289.json"},{"reference_url":"https://api.first.org/data/v1/epss?cve=CVE-2021-25289","reference_id":"","reference_type":"","scores":[{"value":"0.00206","scoring_system":"epss","scoring_elements":"0.42926","published_at":"2026-04-01T12:55:00Z"},{"value":"0.00206","scoring_system":"epss","scoring_elements":"0.43036","published_at":"2026-04-18T12:55:00Z"},{"value":"0.00206","scoring_system":"epss","scoring_elements":"0.43048","published_at":"2026-04-16T12:55:00Z"},{"value":"0.00206","scoring_system":"epss","scoring_elements":"0.42988","published_at":"2026-04-13T12:55:00Z"},{"value":"0.00206","scoring_system":"epss","scoring_elements":"0.43005","published_at":"2026-04-12T12:55:00Z"},{"value":"0.00206","scoring_system":"epss","scoring_elements":"0.4304","published_at":"2026-04-11T12:55:00Z"},{"value":"0.00206","scoring_system":"epss","scoring_elements":"0.43017","published_at":"2026-04-09T12:55:00Z"},{"value":"0.00206","scoring_system":"epss","scoring_elements":"0.43004","published_at":"2026-04-08T12:55:00Z"},{"value":"0.00206","scoring_system":"epss","scoring_elements":"0.42954","published_at":"2026-04-07T12:55:00Z"},{"value":"0.00206","scoring_system":"epss","scoring_elements":"0.43018","published_at":"2026-04-04T12:55:00Z"},{"value":"0.00206","scoring_system":"epss","scoring_elements":"0.4299","published_at":"2026-04-02T12:55:00Z"},{"value":"0.00762","scoring_system":"epss","scoring_elements":"0.73401","published_at":"2026-04-21T12:55:00Z"},{"value":"0.0083","scoring_system":"epss","scoring_elements":"0.7461","published_at":"2026-05-05T12:55:00Z"},{"value":"0.0083","scoring_system":"epss","scoring_elements":"0.74607","published_at":"2026-04-29T12:55:00Z"},{"value":"0.0083","scoring_system":"epss","scoring_elements":"0.74606","published_at":"2026-04-26T12:55:00Z"},{"value":"0.0083","scoring_system":"epss","scoring_elements":"0.746","published_at":"2026-04-24T12:55:00Z"}],"url":"https://api.first.org/data/v1/epss?cve=CVE-2021-25289"},{"reference_url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-25289","reference_id":"","reference_type":"","scores":[],"url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-25289"},{"reference_url":"https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml","reference_id":"","reference_type":"","scores":[{"value":"9.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"}],"url":"https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml"},{"reference_url":"https://github.com/advisories/GHSA-57h3-9rgr-c24m","reference_id":"","reference_type":"","scores":[{"value":"9.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},{"value":"CRITICAL","scoring_system":"cvssv3.1_qr","scoring_elements":""},{"value":"9.3","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N"},{"value":"CRITICAL","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/advisories/GHSA-57h3-9rgr-c24m"},{"reference_url":"https://github.com/pypa/advisory-database/tree/main/vulns/pillow/PYSEC-2021-35.yaml","reference_id":"","reference_type":"","scores":[{"value":"9.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},{"value":"9.3","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N"},{"value":"CRITICAL","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/pypa/advisory-database/tree/main/vulns/pillow/PYSEC-2021-35.yaml"},{"reference_url":"https://github.com/python-pillow/Pillow","reference_id":"","reference_type":"","scores":[{"value":"9.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},{"value":"9.3","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N"},{"value":"CRITICAL","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/python-pillow/Pillow"},{"reference_url":"https://github.com/python-pillow/Pillow/commit/3fee28eb9479bf7d59e0fa08068f9cc4a6e2f04c","reference_id":"","reference_type":"","scores":[{"value":"9.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},{"value":"9.3","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N"},{"value":"CRITICAL","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/python-pillow/Pillow/commit/3fee28eb9479bf7d59e0fa08068f9cc4a6e2f04c"},{"reference_url":"https://github.com/python-pillow/Pillow/commit/cbfdde7b1f2295059a20a539ee9960f0bec7b299","reference_id":"","reference_type":"","scores":[{"value":"9.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},{"value":"9.3","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N"},{"value":"CRITICAL","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/python-pillow/Pillow/commit/cbfdde7b1f2295059a20a539ee9960f0bec7b299"},{"reference_url":"https://nvd.nist.gov/vuln/detail/CVE-2021-25289","reference_id":"","reference_type":"","scores":[{"value":"9.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},{"value":"9.3","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N"},{"value":"CRITICAL","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-25289"},{"reference_url":"https://pillow.readthedocs.io/en/stable/releasenotes/8.1.1.html","reference_id":"","reference_type":"","scores":[{"value":"9.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},{"value":"9.3","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N"},{"value":"CRITICAL","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://pillow.readthedocs.io/en/stable/releasenotes/8.1.1.html"},{"reference_url":"https://security.gentoo.org/glsa/202107-33","reference_id":"","reference_type":"","scores":[{"value":"9.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},{"value":"9.3","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N"},{"value":"CRITICAL","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://security.gentoo.org/glsa/202107-33"},{"reference_url":"https://bugzilla.redhat.com/show_bug.cgi?id=1934680","reference_id":"1934680","reference_type":"","scores":[],"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1934680"},{"reference_url":"https://security.archlinux.org/AVG-1635","reference_id":"AVG-1635","reference_type":"","scores":[{"value":"Medium","scoring_system":"archlinux","scoring_elements":""}],"url":"https://security.archlinux.org/AVG-1635"},{"reference_url":"https://access.redhat.com/errata/RHSA-2021:3917","reference_id":"RHSA-2021:3917","reference_type":"","scores":[],"url":"https://access.redhat.com/errata/RHSA-2021:3917"},{"reference_url":"https://usn.ubuntu.com/4763-1/","reference_id":"USN-4763-1","reference_type":"","scores":[],"url":"https://usn.ubuntu.com/4763-1/"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/15250?format=json","purl":"pkg:pypi/pillow@8.1.1","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-19e1-19hk-duet"},{"vulnerability":"VCID-1vt7-c6e3-7qc8"},{"vulnerability":"VCID-3qb5-8p8w-gkad"},{"vulnerability":"VCID-3uk9-eds5-rkgc"},{"vulnerability":"VCID-53ac-ceq4-qkhf"},{"vulnerability":"VCID-5rv4-k1q9-zue2"},{"vulnerability":"VCID-64n5-pugj-vue8"},{"vulnerability":"VCID-9ckw-ra54-z3b7"},{"vulnerability":"VCID-aubw-tsmn-ffcq"},{"vulnerability":"VCID-brp2-dtrf-jyfr"},{"vulnerability":"VCID-d7uf-zdbv-sba1"},{"vulnerability":"VCID-df4x-jt3h-17hx"},{"vulnerability":"VCID-dpc3-td9q-dyee"},{"vulnerability":"VCID-g46h-p8jk-cuhc"},{"vulnerability":"VCID-gvjw-funa-sqak"},{"vulnerability":"VCID-n1hp-atex-ubh4"},{"vulnerability":"VCID-n1w5-f5p7-xuhb"},{"vulnerability":"VCID-q4bb-qnxe-8bfa"},{"vulnerability":"VCID-ue18-zzau-x7hy"},{"vulnerability":"VCID-vdzj-kqfy-d3b7"},{"vulnerability":"VCID-vwbu-ruxm-tbh4"},{"vulnerability":"VCID-vyzt-df2u-h3cc"},{"vulnerability":"VCID-w9uy-fnpm-cbak"},{"vulnerability":"VCID-xesd-d294-7fcx"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:pypi/pillow@8.1.1"}],"aliases":["BIT-pillow-2021-25289","CVE-2021-25289","GHSA-57h3-9rgr-c24m","PYSEC-2021-35"],"risk_score":4.5,"exploitability":"0.5","weighted_severity":"9.0","resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-en6t-uxtq-bfek"},{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/13258?format=json","vulnerability_id":"VCID-g46h-p8jk-cuhc","summary":"Infinite loop in Pillow\nJpegImagePlugin may append an EOF marker to the end of a truncated file, so that the last segment of the data will still be processed by the decoder.\n\nIf the EOF marker is not detected as such however, this could lead to an infinite loop where JpegImagePlugin keeps trying to end the file.","references":[{"reference_url":"https://github.com/python-pillow/Pillow","reference_id":"","reference_type":"","scores":[{"value":"LOW","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/python-pillow/Pillow"},{"reference_url":"https://github.com/python-pillow/Pillow/commit/baae9ec4b67c68e3adaf1208cf54e8de5e38a6fd","reference_id":"","reference_type":"","scores":[{"value":"LOW","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/python-pillow/Pillow/commit/baae9ec4b67c68e3adaf1208cf54e8de5e38a6fd"},{"reference_url":"https://pillow.readthedocs.io/en/stable/releasenotes/9.0.0.html#ensure-jpegimageplugin-stops-at-the-end-of-a-truncated-file","reference_id":"","reference_type":"","scores":[{"value":"LOW","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://pillow.readthedocs.io/en/stable/releasenotes/9.0.0.html#ensure-jpegimageplugin-stops-at-the-end-of-a-truncated-file"},{"reference_url":"https://github.com/advisories/GHSA-4fx9-vc88-q2xc","reference_id":"GHSA-4fx9-vc88-q2xc","reference_type":"","scores":[{"value":"LOW","scoring_system":"cvssv3.1_qr","scoring_elements":""}],"url":"https://github.com/advisories/GHSA-4fx9-vc88-q2xc"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/23250?format=json","purl":"pkg:pypi/pillow@9.0.0","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-19e1-19hk-duet"},{"vulnerability":"VCID-5rv4-k1q9-zue2"},{"vulnerability":"VCID-64n5-pugj-vue8"},{"vulnerability":"VCID-9ckw-ra54-z3b7"},{"vulnerability":"VCID-brp2-dtrf-jyfr"},{"vulnerability":"VCID-d7uf-zdbv-sba1"},{"vulnerability":"VCID-n1hp-atex-ubh4"},{"vulnerability":"VCID-q4bb-qnxe-8bfa"},{"vulnerability":"VCID-vdzj-kqfy-d3b7"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:pypi/pillow@9.0.0"}],"aliases":["GHSA-4fx9-vc88-q2xc","GMS-2022-347"],"risk_score":1.4,"exploitability":"0.5","weighted_severity":"2.7","resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-g46h-p8jk-cuhc"},{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/5384?format=json","vulnerability_id":"VCID-gmd5-pbxc-a3gd","summary":"Python Image Library (PIL) 1.1.7 and earlier and Pillow 2.3 might allow remote attackers to execute arbitrary commands via shell metacharacters in unspecified vectors related to CVE-2014-1932, possibly JpegImagePlugin.py.","references":[{"reference_url":"http://people.canonical.com/~ubuntu-security/cve/2014/CVE-2014-1932.html","reference_id":"","reference_type":"","scores":[{"value":"9.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},{"value":"9.3","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N"},{"value":"CRITICAL","scoring_system":"generic_textual","scoring_elements":""}],"url":"http://people.canonical.com/~ubuntu-security/cve/2014/CVE-2014-1932.html"},{"reference_url":"https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2014-3007.json","reference_id":"","reference_type":"","scores":[],"url":"https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2014-3007.json"},{"reference_url":"https://api.first.org/data/v1/epss?cve=CVE-2014-3007","reference_id":"","reference_type":"","scores":[{"value":"0.03008","scoring_system":"epss","scoring_elements":"0.86647","published_at":"2026-05-05T12:55:00Z"},{"value":"0.03008","scoring_system":"epss","scoring_elements":"0.86538","published_at":"2026-04-02T12:55:00Z"},{"value":"0.03008","scoring_system":"epss","scoring_elements":"0.86556","published_at":"2026-04-07T12:55:00Z"},{"value":"0.03008","scoring_system":"epss","scoring_elements":"0.86575","published_at":"2026-04-08T12:55:00Z"},{"value":"0.03008","scoring_system":"epss","scoring_elements":"0.86585","published_at":"2026-04-09T12:55:00Z"},{"value":"0.03008","scoring_system":"epss","scoring_elements":"0.866","published_at":"2026-04-11T12:55:00Z"},{"value":"0.03008","scoring_system":"epss","scoring_elements":"0.86597","published_at":"2026-04-12T12:55:00Z"},{"value":"0.03008","scoring_system":"epss","scoring_elements":"0.8659","published_at":"2026-04-13T12:55:00Z"},{"value":"0.03008","scoring_system":"epss","scoring_elements":"0.86604","published_at":"2026-04-16T12:55:00Z"},{"value":"0.03008","scoring_system":"epss","scoring_elements":"0.86609","published_at":"2026-04-18T12:55:00Z"},{"value":"0.03008","scoring_system":"epss","scoring_elements":"0.86601","published_at":"2026-04-21T12:55:00Z"},{"value":"0.03008","scoring_system":"epss","scoring_elements":"0.86619","published_at":"2026-04-24T12:55:00Z"},{"value":"0.03008","scoring_system":"epss","scoring_elements":"0.86627","published_at":"2026-04-26T12:55:00Z"},{"value":"0.03008","scoring_system":"epss","scoring_elements":"0.86626","published_at":"2026-04-29T12:55:00Z"},{"value":"0.03008","scoring_system":"epss","scoring_elements":"0.86527","published_at":"2026-04-01T12:55:00Z"}],"url":"https://api.first.org/data/v1/epss?cve=CVE-2014-3007"},{"reference_url":"https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=737059","reference_id":"","reference_type":"","scores":[{"value":"9.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},{"value":"9.3","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N"},{"value":"CRITICAL","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=737059"},{"reference_url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3007","reference_id":"","reference_type":"","scores":[],"url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3007"},{"reference_url":"https://github.com/pypa/advisory-database/tree/main/vulns/pillow/PYSEC-2014-87.yaml","reference_id":"","reference_type":"","scores":[{"value":"9.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},{"value":"9.3","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N"},{"value":"CRITICAL","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/pypa/advisory-database/tree/main/vulns/pillow/PYSEC-2014-87.yaml"},{"reference_url":"https://github.com/python-pillow/Pillow","reference_id":"","reference_type":"","scores":[{"value":"9.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},{"value":"9.3","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N"},{"value":"CRITICAL","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/python-pillow/Pillow"},{"reference_url":"https://nvd.nist.gov/vuln/detail/CVE-2014-3007","reference_id":"","reference_type":"","scores":[{"value":"9.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},{"value":"9.3","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N"},{"value":"CRITICAL","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://nvd.nist.gov/vuln/detail/CVE-2014-3007"},{"reference_url":"https://bugzilla.redhat.com/show_bug.cgi?id=1094101","reference_id":"1094101","reference_type":"","scores":[],"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1094101"},{"reference_url":"https://github.com/advisories/GHSA-8m9x-pxwq-j236","reference_id":"GHSA-8m9x-pxwq-j236","reference_type":"","scores":[{"value":"CRITICAL","scoring_system":"cvssv3.1_qr","scoring_elements":""}],"url":"https://github.com/advisories/GHSA-8m9x-pxwq-j236"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/3061?format=json","purl":"pkg:pypi/pillow@2.5.0","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-19e1-19hk-duet"},{"vulnerability":"VCID-1vt7-c6e3-7qc8"},{"vulnerability":"VCID-366h-8f99-r7at"},{"vulnerability":"VCID-3qb5-8p8w-gkad"},{"vulnerability":"VCID-3uk9-eds5-rkgc"},{"vulnerability":"VCID-53ac-ceq4-qkhf"},{"vulnerability":"VCID-5rv4-k1q9-zue2"},{"vulnerability":"VCID-64n5-pugj-vue8"},{"vulnerability":"VCID-6gyu-fzpg-c3bn"},{"vulnerability":"VCID-8n2b-wvya-53e1"},{"vulnerability":"VCID-9ckw-ra54-z3b7"},{"vulnerability":"VCID-and9-6jty-pyeq"},{"vulnerability":"VCID-aubw-tsmn-ffcq"},{"vulnerability":"VCID-avx2-mahw-mqes"},{"vulnerability":"VCID-b3au-rcgp-2fag"},{"vulnerability":"VCID-b5a2-83ej-puaw"},{"vulnerability":"VCID-brp2-dtrf-jyfr"},{"vulnerability":"VCID-cas2-jb3y-vyhz"},{"vulnerability":"VCID-d7uf-zdbv-sba1"},{"vulnerability":"VCID-df4x-jt3h-17hx"},{"vulnerability":"VCID-dgds-v95g-pbcv"},{"vulnerability":"VCID-dpc3-td9q-dyee"},{"vulnerability":"VCID-e3gp-zc2b-budg"},{"vulnerability":"VCID-en6t-uxtq-bfek"},{"vulnerability":"VCID-g46h-p8jk-cuhc"},{"vulnerability":"VCID-gvjw-funa-sqak"},{"vulnerability":"VCID-h4x7-7fke-mqgp"},{"vulnerability":"VCID-haum-8zpg-6kgf"},{"vulnerability":"VCID-hmmq-5772-bycm"},{"vulnerability":"VCID-khp6-9hfx-1kge"},{"vulnerability":"VCID-m3tm-h4q9-9yay"},{"vulnerability":"VCID-ma2g-2f8d-dqa9"},{"vulnerability":"VCID-n1hp-atex-ubh4"},{"vulnerability":"VCID-n1w5-f5p7-xuhb"},{"vulnerability":"VCID-p6r3-puh1-zyg6"},{"vulnerability":"VCID-q4bb-qnxe-8bfa"},{"vulnerability":"VCID-qjqr-jyjn-xfh9"},{"vulnerability":"VCID-rncf-9nf8-wud3"},{"vulnerability":"VCID-sns1-ksqr-vbhr"},{"vulnerability":"VCID-stft-hsk9-zfdy"},{"vulnerability":"VCID-u1en-t8ux-uube"},{"vulnerability":"VCID-ue18-zzau-x7hy"},{"vulnerability":"VCID-uf5t-asns-tudp"},{"vulnerability":"VCID-vdzj-kqfy-d3b7"},{"vulnerability":"VCID-vwbu-ruxm-tbh4"},{"vulnerability":"VCID-vxh1-8rvt-kkak"},{"vulnerability":"VCID-vyzt-df2u-h3cc"},{"vulnerability":"VCID-vz9s-jqpb-2ybf"},{"vulnerability":"VCID-w9uy-fnpm-cbak"},{"vulnerability":"VCID-x15z-dejc-9ba6"},{"vulnerability":"VCID-xesd-d294-7fcx"},{"vulnerability":"VCID-xk66-1d31-2qbk"},{"vulnerability":"VCID-yccg-zw89-vqff"},{"vulnerability":"VCID-zmd3-henq-r7bd"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:pypi/pillow@2.5.0"}],"aliases":["CVE-2014-3007","GHSA-8m9x-pxwq-j236","PYSEC-2014-87"],"risk_score":4.5,"exploitability":"0.5","weighted_severity":"9.0","resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-gmd5-pbxc-a3gd"},{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/6281?format=json","vulnerability_id":"VCID-gvjw-funa-sqak","summary":"Pillow before 8.1.1 allows attackers to cause a denial of service (memory consumption) because the reported size of a contained image is not properly checked for an ICO container, and thus an attempted memory allocation can be very large.","references":[{"reference_url":"https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2021-27923.json","reference_id":"","reference_type":"","scores":[{"value":"7.5","scoring_system":"cvssv3","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"url":"https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2021-27923.json"},{"reference_url":"https://api.first.org/data/v1/epss?cve=CVE-2021-27923","reference_id":"","reference_type":"","scores":[{"value":"0.00419","scoring_system":"epss","scoring_elements":"0.61759","published_at":"2026-04-01T12:55:00Z"},{"value":"0.00419","scoring_system":"epss","scoring_elements":"0.619","published_at":"2026-04-09T12:55:00Z"},{"value":"0.00419","scoring_system":"epss","scoring_elements":"0.61833","published_at":"2026-04-02T12:55:00Z"},{"value":"0.00419","scoring_system":"epss","scoring_elements":"0.61864","published_at":"2026-04-04T12:55:00Z"},{"value":"0.00419","scoring_system":"epss","scoring_elements":"0.61835","published_at":"2026-04-07T12:55:00Z"},{"value":"0.00419","scoring_system":"epss","scoring_elements":"0.61909","published_at":"2026-04-12T12:55:00Z"},{"value":"0.00419","scoring_system":"epss","scoring_elements":"0.61921","published_at":"2026-04-11T12:55:00Z"},{"value":"0.00419","scoring_system":"epss","scoring_elements":"0.61885","published_at":"2026-04-08T12:55:00Z"},{"value":"0.00419","scoring_system":"epss","scoring_elements":"0.61937","published_at":"2026-04-18T12:55:00Z"},{"value":"0.00419","scoring_system":"epss","scoring_elements":"0.61933","published_at":"2026-04-16T12:55:00Z"},{"value":"0.00419","scoring_system":"epss","scoring_elements":"0.61889","published_at":"2026-04-13T12:55:00Z"},{"value":"0.00425","scoring_system":"epss","scoring_elements":"0.62224","published_at":"2026-05-05T12:55:00Z"},{"value":"0.00425","scoring_system":"epss","scoring_elements":"0.62278","published_at":"2026-04-29T12:55:00Z"},{"value":"0.00425","scoring_system":"epss","scoring_elements":"0.62285","published_at":"2026-04-26T12:55:00Z"},{"value":"0.00425","scoring_system":"epss","scoring_elements":"0.62268","published_at":"2026-04-24T12:55:00Z"},{"value":"0.00425","scoring_system":"epss","scoring_elements":"0.62258","published_at":"2026-04-21T12:55:00Z"}],"url":"https://api.first.org/data/v1/epss?cve=CVE-2021-27923"},{"reference_url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-27923","reference_id":"","reference_type":"","scores":[],"url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-27923"},{"reference_url":"https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml","reference_id":"","reference_type":"","scores":[{"value":"7.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"url":"https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml"},{"reference_url":"https://github.com/advisories/GHSA-95q3-8gr9-gm8w","reference_id":"","reference_type":"","scores":[{"value":"7.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"},{"value":"HIGH","scoring_system":"cvssv3.1_qr","scoring_elements":""},{"value":"8.7","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/advisories/GHSA-95q3-8gr9-gm8w"},{"reference_url":"https://github.com/pypa/advisory-database/tree/main/vulns/pillow/PYSEC-2021-42.yaml","reference_id":"","reference_type":"","scores":[{"value":"7.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"},{"value":"8.7","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/pypa/advisory-database/tree/main/vulns/pillow/PYSEC-2021-42.yaml"},{"reference_url":"https://github.com/python-pillow/Pillow","reference_id":"","reference_type":"","scores":[{"value":"7.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"},{"value":"8.7","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/python-pillow/Pillow"},{"reference_url":"https://github.com/python-pillow/Pillow/commit/756fff33128a0b643d10518a26ad04b726dd8973","reference_id":"","reference_type":"","scores":[{"value":"7.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"},{"value":"8.7","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/python-pillow/Pillow/commit/756fff33128a0b643d10518a26ad04b726dd8973"},{"reference_url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/S7G44Z33J4BNI2DPDROHWGVG2U7ZH5JU","reference_id":"","reference_type":"","scores":[{"value":"7.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"},{"value":"8.7","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/S7G44Z33J4BNI2DPDROHWGVG2U7ZH5JU"},{"reference_url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/TQQY6472RX4J2SUJENWDZAWKTJJGP2ML","reference_id":"","reference_type":"","scores":[{"value":"7.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"},{"value":"8.7","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/TQQY6472RX4J2SUJENWDZAWKTJJGP2ML"},{"reference_url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZTSY25UJU7NJUFHH3HWT575LT4TDFWBZ","reference_id":"","reference_type":"","scores":[{"value":"7.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"},{"value":"8.7","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZTSY25UJU7NJUFHH3HWT575LT4TDFWBZ"},{"reference_url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/S7G44Z33J4BNI2DPDROHWGVG2U7ZH5JU","reference_id":"","reference_type":"","scores":[{"value":"7.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"},{"value":"8.7","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/S7G44Z33J4BNI2DPDROHWGVG2U7ZH5JU"},{"reference_url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/S7G44Z33J4BNI2DPDROHWGVG2U7ZH5JU/","reference_id":"","reference_type":"","scores":[],"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/S7G44Z33J4BNI2DPDROHWGVG2U7ZH5JU/"},{"reference_url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/TQQY6472RX4J2SUJENWDZAWKTJJGP2ML","reference_id":"","reference_type":"","scores":[{"value":"7.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"},{"value":"8.7","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/TQQY6472RX4J2SUJENWDZAWKTJJGP2ML"},{"reference_url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/TQQY6472RX4J2SUJENWDZAWKTJJGP2ML/","reference_id":"","reference_type":"","scores":[],"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/TQQY6472RX4J2SUJENWDZAWKTJJGP2ML/"},{"reference_url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZTSY25UJU7NJUFHH3HWT575LT4TDFWBZ","reference_id":"","reference_type":"","scores":[{"value":"7.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"},{"value":"8.7","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZTSY25UJU7NJUFHH3HWT575LT4TDFWBZ"},{"reference_url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZTSY25UJU7NJUFHH3HWT575LT4TDFWBZ/","reference_id":"","reference_type":"","scores":[],"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZTSY25UJU7NJUFHH3HWT575LT4TDFWBZ/"},{"reference_url":"https://nvd.nist.gov/vuln/detail/CVE-2021-27923","reference_id":"","reference_type":"","scores":[{"value":"7.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"},{"value":"8.7","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-27923"},{"reference_url":"https://pillow.readthedocs.io/en/stable/releasenotes/8.1.1.html","reference_id":"","reference_type":"","scores":[{"value":"7.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"},{"value":"8.7","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://pillow.readthedocs.io/en/stable/releasenotes/8.1.1.html"},{"reference_url":"https://pillow.readthedocs.io/en/stable/releasenotes/8.1.2.html","reference_id":"","reference_type":"","scores":[{"value":"7.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"},{"value":"8.7","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://pillow.readthedocs.io/en/stable/releasenotes/8.1.2.html"},{"reference_url":"https://security.gentoo.org/glsa/202107-33","reference_id":"","reference_type":"","scores":[{"value":"7.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"},{"value":"8.7","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://security.gentoo.org/glsa/202107-33"},{"reference_url":"https://bugzilla.redhat.com/show_bug.cgi?id=1935401","reference_id":"1935401","reference_type":"","scores":[],"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1935401"},{"reference_url":"https://security.archlinux.org/AVG-1635","reference_id":"AVG-1635","reference_type":"","scores":[{"value":"Medium","scoring_system":"archlinux","scoring_elements":""}],"url":"https://security.archlinux.org/AVG-1635"},{"reference_url":"https://access.redhat.com/errata/RHSA-2021:3917","reference_id":"RHSA-2021:3917","reference_type":"","scores":[],"url":"https://access.redhat.com/errata/RHSA-2021:3917"},{"reference_url":"https://access.redhat.com/errata/RHSA-2021:4149","reference_id":"RHSA-2021:4149","reference_type":"","scores":[],"url":"https://access.redhat.com/errata/RHSA-2021:4149"},{"reference_url":"https://usn.ubuntu.com/4763-1/","reference_id":"USN-4763-1","reference_type":"","scores":[],"url":"https://usn.ubuntu.com/4763-1/"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/15250?format=json","purl":"pkg:pypi/pillow@8.1.1","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-19e1-19hk-duet"},{"vulnerability":"VCID-1vt7-c6e3-7qc8"},{"vulnerability":"VCID-3qb5-8p8w-gkad"},{"vulnerability":"VCID-3uk9-eds5-rkgc"},{"vulnerability":"VCID-53ac-ceq4-qkhf"},{"vulnerability":"VCID-5rv4-k1q9-zue2"},{"vulnerability":"VCID-64n5-pugj-vue8"},{"vulnerability":"VCID-9ckw-ra54-z3b7"},{"vulnerability":"VCID-aubw-tsmn-ffcq"},{"vulnerability":"VCID-brp2-dtrf-jyfr"},{"vulnerability":"VCID-d7uf-zdbv-sba1"},{"vulnerability":"VCID-df4x-jt3h-17hx"},{"vulnerability":"VCID-dpc3-td9q-dyee"},{"vulnerability":"VCID-g46h-p8jk-cuhc"},{"vulnerability":"VCID-gvjw-funa-sqak"},{"vulnerability":"VCID-n1hp-atex-ubh4"},{"vulnerability":"VCID-n1w5-f5p7-xuhb"},{"vulnerability":"VCID-q4bb-qnxe-8bfa"},{"vulnerability":"VCID-ue18-zzau-x7hy"},{"vulnerability":"VCID-vdzj-kqfy-d3b7"},{"vulnerability":"VCID-vwbu-ruxm-tbh4"},{"vulnerability":"VCID-vyzt-df2u-h3cc"},{"vulnerability":"VCID-w9uy-fnpm-cbak"},{"vulnerability":"VCID-xesd-d294-7fcx"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:pypi/pillow@8.1.1"},{"url":"http://public2.vulnerablecode.io/api/packages/17187?format=json","purl":"pkg:pypi/pillow@8.1.2","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-19e1-19hk-duet"},{"vulnerability":"VCID-1vt7-c6e3-7qc8"},{"vulnerability":"VCID-3uk9-eds5-rkgc"},{"vulnerability":"VCID-5rv4-k1q9-zue2"},{"vulnerability":"VCID-64n5-pugj-vue8"},{"vulnerability":"VCID-9ckw-ra54-z3b7"},{"vulnerability":"VCID-aubw-tsmn-ffcq"},{"vulnerability":"VCID-brp2-dtrf-jyfr"},{"vulnerability":"VCID-d7uf-zdbv-sba1"},{"vulnerability":"VCID-df4x-jt3h-17hx"},{"vulnerability":"VCID-dpc3-td9q-dyee"},{"vulnerability":"VCID-g46h-p8jk-cuhc"},{"vulnerability":"VCID-n1hp-atex-ubh4"},{"vulnerability":"VCID-n1w5-f5p7-xuhb"},{"vulnerability":"VCID-q4bb-qnxe-8bfa"},{"vulnerability":"VCID-ue18-zzau-x7hy"},{"vulnerability":"VCID-vdzj-kqfy-d3b7"},{"vulnerability":"VCID-vwbu-ruxm-tbh4"},{"vulnerability":"VCID-vyzt-df2u-h3cc"},{"vulnerability":"VCID-w9uy-fnpm-cbak"},{"vulnerability":"VCID-xesd-d294-7fcx"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:pypi/pillow@8.1.2"}],"aliases":["BIT-pillow-2021-27923","CVE-2021-27923","GHSA-95q3-8gr9-gm8w","PYSEC-2021-42"],"risk_score":4.0,"exploitability":"0.5","weighted_severity":"8.0","resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-gvjw-funa-sqak"},{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/90764?format=json","vulnerability_id":"VCID-h4x7-7fke-mqgp","summary":"There is a DoS vulnerability in Pillow before 6.2.2 caused by FpxImagePlugin.py calling the range function on an unvalidated 32-bit integer if the number of bands is large. On Windows running 32-bit Python, this results in an OverflowError or MemoryError due to the 2 GB limit. However, on Linux running 64-bit Python this results in the process being terminated by the OOM killer.","references":[{"reference_url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/3DUMIBUYGJRAVJCTFUWBRLVQKOUTVX5P/","reference_id":"","reference_type":"","scores":[],"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/3DUMIBUYGJRAVJCTFUWBRLVQKOUTVX5P/"},{"reference_url":"https://pillow.readthedocs.io/en/stable/releasenotes/6.2.2.html","reference_id":"","reference_type":"","scores":[],"url":"https://pillow.readthedocs.io/en/stable/releasenotes/6.2.2.html"},{"reference_url":"https://usn.ubuntu.com/4272-1/","reference_id":"","reference_type":"","scores":[],"url":"https://usn.ubuntu.com/4272-1/"},{"reference_url":"https://www.debian.org/security/2020/dsa-4631","reference_id":"","reference_type":"","scores":[],"url":"https://www.debian.org/security/2020/dsa-4631"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/9845?format=json","purl":"pkg:pypi/pillow@6.2.2","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-19e1-19hk-duet"},{"vulnerability":"VCID-1vt7-c6e3-7qc8"},{"vulnerability":"VCID-3qb5-8p8w-gkad"},{"vulnerability":"VCID-3uk9-eds5-rkgc"},{"vulnerability":"VCID-53ac-ceq4-qkhf"},{"vulnerability":"VCID-5rv4-k1q9-zue2"},{"vulnerability":"VCID-64n5-pugj-vue8"},{"vulnerability":"VCID-6gyu-fzpg-c3bn"},{"vulnerability":"VCID-7bjx-gkf7-cke9"},{"vulnerability":"VCID-8n2b-wvya-53e1"},{"vulnerability":"VCID-9ckw-ra54-z3b7"},{"vulnerability":"VCID-and9-6jty-pyeq"},{"vulnerability":"VCID-aubw-tsmn-ffcq"},{"vulnerability":"VCID-b5a2-83ej-puaw"},{"vulnerability":"VCID-brp2-dtrf-jyfr"},{"vulnerability":"VCID-d7uf-zdbv-sba1"},{"vulnerability":"VCID-df4x-jt3h-17hx"},{"vulnerability":"VCID-dpc3-td9q-dyee"},{"vulnerability":"VCID-en6t-uxtq-bfek"},{"vulnerability":"VCID-g46h-p8jk-cuhc"},{"vulnerability":"VCID-gvjw-funa-sqak"},{"vulnerability":"VCID-haum-8zpg-6kgf"},{"vulnerability":"VCID-khp6-9hfx-1kge"},{"vulnerability":"VCID-n1hp-atex-ubh4"},{"vulnerability":"VCID-n1w5-f5p7-xuhb"},{"vulnerability":"VCID-p6r3-puh1-zyg6"},{"vulnerability":"VCID-q4bb-qnxe-8bfa"},{"vulnerability":"VCID-rncf-9nf8-wud3"},{"vulnerability":"VCID-ue18-zzau-x7hy"},{"vulnerability":"VCID-uf5t-asns-tudp"},{"vulnerability":"VCID-vdzj-kqfy-d3b7"},{"vulnerability":"VCID-vwbu-ruxm-tbh4"},{"vulnerability":"VCID-vxh1-8rvt-kkak"},{"vulnerability":"VCID-vyzt-df2u-h3cc"},{"vulnerability":"VCID-w9uy-fnpm-cbak"},{"vulnerability":"VCID-x15z-dejc-9ba6"},{"vulnerability":"VCID-xesd-d294-7fcx"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:pypi/pillow@6.2.2"}],"aliases":["PYSEC-2020-191"],"risk_score":null,"exploitability":"0.5","weighted_severity":"0.0","resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-h4x7-7fke-mqgp"},{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/6106?format=json","vulnerability_id":"VCID-haum-8zpg-6kgf","summary":"Pillow before 7.1.0 has multiple out-of-bounds reads in libImaging/FliDecode.c.","references":[{"reference_url":"https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2020-10177.json","reference_id":"","reference_type":"","scores":[{"value":"5.9","scoring_system":"cvssv3","scoring_elements":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N"}],"url":"https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2020-10177.json"},{"reference_url":"https://api.first.org/data/v1/epss?cve=CVE-2020-10177","reference_id":"","reference_type":"","scores":[{"value":"0.00319","scoring_system":"epss","scoring_elements":"0.54914","published_at":"2026-05-05T12:55:00Z"},{"value":"0.00319","scoring_system":"epss","scoring_elements":"0.54966","published_at":"2026-04-29T12:55:00Z"},{"value":"0.00319","scoring_system":"epss","scoring_elements":"0.54991","published_at":"2026-04-26T12:55:00Z"},{"value":"0.00319","scoring_system":"epss","scoring_elements":"0.54972","published_at":"2026-04-24T12:55:00Z"},{"value":"0.00319","scoring_system":"epss","scoring_elements":"0.54996","published_at":"2026-04-21T12:55:00Z"},{"value":"0.00319","scoring_system":"epss","scoring_elements":"0.55018","published_at":"2026-04-18T12:55:00Z"},{"value":"0.00319","scoring_system":"epss","scoring_elements":"0.55015","published_at":"2026-04-16T12:55:00Z"},{"value":"0.00319","scoring_system":"epss","scoring_elements":"0.54978","published_at":"2026-04-13T12:55:00Z"},{"value":"0.00319","scoring_system":"epss","scoring_elements":"0.55","published_at":"2026-04-12T12:55:00Z"},{"value":"0.00319","scoring_system":"epss","scoring_elements":"0.55019","published_at":"2026-04-11T12:55:00Z"},{"value":"0.00319","scoring_system":"epss","scoring_elements":"0.55007","published_at":"2026-04-09T12:55:00Z"},{"value":"0.00319","scoring_system":"epss","scoring_elements":"0.54958","published_at":"2026-04-07T12:55:00Z"},{"value":"0.00319","scoring_system":"epss","scoring_elements":"0.54988","published_at":"2026-04-04T12:55:00Z"},{"value":"0.00319","scoring_system":"epss","scoring_elements":"0.54962","published_at":"2026-04-02T12:55:00Z"},{"value":"0.00319","scoring_system":"epss","scoring_elements":"0.54892","published_at":"2026-04-01T12:55:00Z"}],"url":"https://api.first.org/data/v1/epss?cve=CVE-2020-10177"},{"reference_url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-10177","reference_id":"","reference_type":"","scores":[],"url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-10177"},{"reference_url":"https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml","reference_id":"","reference_type":"","scores":[{"value":"5.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N"}],"url":"https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml"},{"reference_url":"https://github.com/advisories/GHSA-cqhg-xjhh-p8hf","reference_id":"","reference_type":"","scores":[{"value":"5.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N"},{"value":"HIGH","scoring_system":"cvssv3.1_qr","scoring_elements":""},{"value":"7.1","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/advisories/GHSA-cqhg-xjhh-p8hf"},{"reference_url":"https://github.com/pypa/advisory-database/tree/main/vulns/pillow/PYSEC-2020-76.yaml","reference_id":"","reference_type":"","scores":[{"value":"5.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N"},{"value":"7.1","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/pypa/advisory-database/tree/main/vulns/pillow/PYSEC-2020-76.yaml"},{"reference_url":"https://github.com/python-pillow/Pillow","reference_id":"","reference_type":"","scores":[{"value":"5.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N"},{"value":"7.1","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/python-pillow/Pillow"},{"reference_url":"https://github.com/python-pillow/Pillow/commit/00c6dd72d9ed0124cec81040b4bab0979a200fe2","reference_id":"","reference_type":"","scores":[{"value":"5.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N"},{"value":"7.1","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/python-pillow/Pillow/commit/00c6dd72d9ed0124cec81040b4bab0979a200fe2"},{"reference_url":"https://github.com/python-pillow/Pillow/commit/088ce4df981b70fbec140ee54417bcb49a7dffca","reference_id":"","reference_type":"","scores":[{"value":"5.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N"},{"value":"7.1","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/python-pillow/Pillow/commit/088ce4df981b70fbec140ee54417bcb49a7dffca"},{"reference_url":"https://github.com/python-pillow/Pillow/commit/11ef7ca53a7d0af4bc52666c29199deffa5fc1bd","reference_id":"","reference_type":"","scores":[{"value":"5.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N"},{"value":"7.1","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/python-pillow/Pillow/commit/11ef7ca53a7d0af4bc52666c29199deffa5fc1bd"},{"reference_url":"https://github.com/python-pillow/Pillow/commit/19ff42bd683486a8a308743c76972ef6a6482e9b","reference_id":"","reference_type":"","scores":[{"value":"5.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N"},{"value":"7.1","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/python-pillow/Pillow/commit/19ff42bd683486a8a308743c76972ef6a6482e9b"},{"reference_url":"https://github.com/python-pillow/Pillow/commit/5b490fc413dfab2d52de46a58905c25d9badb650","reference_id":"","reference_type":"","scores":[{"value":"5.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N"},{"value":"7.1","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/python-pillow/Pillow/commit/5b490fc413dfab2d52de46a58905c25d9badb650"},{"reference_url":"https://github.com/python-pillow/Pillow/commit/8d4f3c0c5f2fecf175aeb895e9c2d6d06d85bdc9","reference_id":"","reference_type":"","scores":[{"value":"5.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N"},{"value":"7.1","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/python-pillow/Pillow/commit/8d4f3c0c5f2fecf175aeb895e9c2d6d06d85bdc9"},{"reference_url":"https://github.com/python-pillow/Pillow/commit/b4e439d6d7fd986cd6b4c7f9ca18830d79dacd44","reference_id":"","reference_type":"","scores":[{"value":"5.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N"},{"value":"7.1","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/python-pillow/Pillow/commit/b4e439d6d7fd986cd6b4c7f9ca18830d79dacd44"},{"reference_url":"https://github.com/python-pillow/Pillow/commit/c5edc361fd6450f805a6a444723b0f68190b1d0c","reference_id":"","reference_type":"","scores":[{"value":"5.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N"},{"value":"7.1","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/python-pillow/Pillow/commit/c5edc361fd6450f805a6a444723b0f68190b1d0c"},{"reference_url":"https://github.com/python-pillow/Pillow/commit/c66d8aa75436f334f686fe32bca8e414bcdd18e6","reference_id":"","reference_type":"","scores":[{"value":"5.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N"},{"value":"7.1","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/python-pillow/Pillow/commit/c66d8aa75436f334f686fe32bca8e414bcdd18e6"},{"reference_url":"https://github.com/python-pillow/Pillow/commit/c88b0204d7c930e3bd72626ae6ea078571cc0ea7","reference_id":"","reference_type":"","scores":[{"value":"5.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N"},{"value":"7.1","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/python-pillow/Pillow/commit/c88b0204d7c930e3bd72626ae6ea078571cc0ea7"},{"reference_url":"https://github.com/python-pillow/Pillow/commit/f6926a041b4b544fd2ced3752542afb6c8c19405","reference_id":"","reference_type":"","scores":[{"value":"5.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N"},{"value":"7.1","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/python-pillow/Pillow/commit/f6926a041b4b544fd2ced3752542afb6c8c19405"},{"reference_url":"https://github.com/python-pillow/Pillow/commits/master/src/libImaging","reference_id":"","reference_type":"","scores":[{"value":"5.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N"},{"value":"7.1","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/python-pillow/Pillow/commits/master/src/libImaging"},{"reference_url":"https://github.com/python-pillow/Pillow/issues/4750","reference_id":"","reference_type":"","scores":[{"value":"5.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N"},{"value":"7.1","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/python-pillow/Pillow/issues/4750"},{"reference_url":"https://github.com/python-pillow/Pillow/pull/4503","reference_id":"","reference_type":"","scores":[{"value":"5.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N"},{"value":"7.1","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/python-pillow/Pillow/pull/4503"},{"reference_url":"https://github.com/python-pillow/Pillow/pull/4538","reference_id":"","reference_type":"","scores":[{"value":"5.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N"},{"value":"7.1","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/python-pillow/Pillow/pull/4538"},{"reference_url":"https://lists.debian.org/debian-lts-announce/2020/08/msg00012.html","reference_id":"","reference_type":"","scores":[{"value":"5.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N"},{"value":"7.1","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://lists.debian.org/debian-lts-announce/2020/08/msg00012.html"},{"reference_url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/BEBCPE4F2VHTIT6EZA2YZQZLPVDEBJGD","reference_id":"","reference_type":"","scores":[{"value":"5.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N"},{"value":"7.1","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/BEBCPE4F2VHTIT6EZA2YZQZLPVDEBJGD"},{"reference_url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/BEBCPE4F2VHTIT6EZA2YZQZLPVDEBJGD/","reference_id":"","reference_type":"","scores":[],"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/BEBCPE4F2VHTIT6EZA2YZQZLPVDEBJGD/"},{"reference_url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/HOKHNWV2VS5GESY7IBD237E7C6T3I427","reference_id":"","reference_type":"","scores":[{"value":"5.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N"},{"value":"7.1","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/HOKHNWV2VS5GESY7IBD237E7C6T3I427"},{"reference_url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/HOKHNWV2VS5GESY7IBD237E7C6T3I427/","reference_id":"","reference_type":"","scores":[],"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/HOKHNWV2VS5GESY7IBD237E7C6T3I427/"},{"reference_url":"https://nvd.nist.gov/vuln/detail/CVE-2020-10177","reference_id":"","reference_type":"","scores":[{"value":"5.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N"},{"value":"7.1","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://nvd.nist.gov/vuln/detail/CVE-2020-10177"},{"reference_url":"https://pillow.readthedocs.io/en/stable/releasenotes/6.2.3.html","reference_id":"","reference_type":"","scores":[{"value":"5.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N"},{"value":"7.1","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://pillow.readthedocs.io/en/stable/releasenotes/6.2.3.html"},{"reference_url":"https://pillow.readthedocs.io/en/stable/releasenotes/7.1.0.html","reference_id":"","reference_type":"","scores":[{"value":"5.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N"},{"value":"7.1","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://pillow.readthedocs.io/en/stable/releasenotes/7.1.0.html"},{"reference_url":"https://snyk.io/vuln/SNYK-PYTHON-PILLOW-574573","reference_id":"","reference_type":"","scores":[{"value":"5.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N"},{"value":"7.1","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://snyk.io/vuln/SNYK-PYTHON-PILLOW-574573"},{"reference_url":"https://usn.ubuntu.com/4430-1","reference_id":"","reference_type":"","scores":[{"value":"5.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N"},{"value":"7.1","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://usn.ubuntu.com/4430-1"},{"reference_url":"https://usn.ubuntu.com/4430-1/","reference_id":"","reference_type":"","scores":[],"url":"https://usn.ubuntu.com/4430-1/"},{"reference_url":"https://usn.ubuntu.com/4430-2","reference_id":"","reference_type":"","scores":[{"value":"5.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N"},{"value":"7.1","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://usn.ubuntu.com/4430-2"},{"reference_url":"https://usn.ubuntu.com/4430-2/","reference_id":"","reference_type":"","scores":[],"url":"https://usn.ubuntu.com/4430-2/"},{"reference_url":"https://bugzilla.redhat.com/show_bug.cgi?id=1852824","reference_id":"1852824","reference_type":"","scores":[],"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1852824"},{"reference_url":"https://access.redhat.com/errata/RHSA-2021:0420","reference_id":"RHSA-2021:0420","reference_type":"","scores":[],"url":"https://access.redhat.com/errata/RHSA-2021:0420"},{"reference_url":"https://usn.ubuntu.com/4697-2/","reference_id":"USN-4697-2","reference_type":"","scores":[],"url":"https://usn.ubuntu.com/4697-2/"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/12775?format=json","purl":"pkg:pypi/pillow@7.1.0","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-19e1-19hk-duet"},{"vulnerability":"VCID-1vt7-c6e3-7qc8"},{"vulnerability":"VCID-3qb5-8p8w-gkad"},{"vulnerability":"VCID-3uk9-eds5-rkgc"},{"vulnerability":"VCID-53ac-ceq4-qkhf"},{"vulnerability":"VCID-5rv4-k1q9-zue2"},{"vulnerability":"VCID-64n5-pugj-vue8"},{"vulnerability":"VCID-6gyu-fzpg-c3bn"},{"vulnerability":"VCID-7bjx-gkf7-cke9"},{"vulnerability":"VCID-9ckw-ra54-z3b7"},{"vulnerability":"VCID-aubw-tsmn-ffcq"},{"vulnerability":"VCID-brp2-dtrf-jyfr"},{"vulnerability":"VCID-d7uf-zdbv-sba1"},{"vulnerability":"VCID-df4x-jt3h-17hx"},{"vulnerability":"VCID-dpc3-td9q-dyee"},{"vulnerability":"VCID-en6t-uxtq-bfek"},{"vulnerability":"VCID-g46h-p8jk-cuhc"},{"vulnerability":"VCID-gvjw-funa-sqak"},{"vulnerability":"VCID-khp6-9hfx-1kge"},{"vulnerability":"VCID-n1hp-atex-ubh4"},{"vulnerability":"VCID-n1w5-f5p7-xuhb"},{"vulnerability":"VCID-p6r3-puh1-zyg6"},{"vulnerability":"VCID-q4bb-qnxe-8bfa"},{"vulnerability":"VCID-rncf-9nf8-wud3"},{"vulnerability":"VCID-ue18-zzau-x7hy"},{"vulnerability":"VCID-vdzj-kqfy-d3b7"},{"vulnerability":"VCID-vwbu-ruxm-tbh4"},{"vulnerability":"VCID-vxh1-8rvt-kkak"},{"vulnerability":"VCID-vyzt-df2u-h3cc"},{"vulnerability":"VCID-w9uy-fnpm-cbak"},{"vulnerability":"VCID-x15z-dejc-9ba6"},{"vulnerability":"VCID-xesd-d294-7fcx"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:pypi/pillow@7.1.0"}],"aliases":["BIT-pillow-2020-10177","CVE-2020-10177","GHSA-cqhg-xjhh-p8hf","PYSEC-2020-76"],"risk_score":4.0,"exploitability":"0.5","weighted_severity":"8.0","resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-haum-8zpg-6kgf"},{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/6000?format=json","vulnerability_id":"VCID-hmmq-5772-bycm","summary":"libImaging/FliDecode.c in Pillow before 6.2.2 has an FLI buffer overflow.","references":[{"reference_url":"https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2020-5313.json","reference_id":"","reference_type":"","scores":[{"value":"8.2","scoring_system":"cvssv3","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H"}],"url":"https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2020-5313.json"},{"reference_url":"https://api.first.org/data/v1/epss?cve=CVE-2020-5313","reference_id":"","reference_type":"","scores":[{"value":"0.00551","scoring_system":"epss","scoring_elements":"0.6804","published_at":"2026-05-05T12:55:00Z"},{"value":"0.00551","scoring_system":"epss","scoring_elements":"0.68066","published_at":"2026-04-29T12:55:00Z"},{"value":"0.00551","scoring_system":"epss","scoring_elements":"0.6806","published_at":"2026-04-26T12:55:00Z"},{"value":"0.00551","scoring_system":"epss","scoring_elements":"0.68051","published_at":"2026-04-24T12:55:00Z"},{"value":"0.00551","scoring_system":"epss","scoring_elements":"0.68008","published_at":"2026-04-21T12:55:00Z"},{"value":"0.00551","scoring_system":"epss","scoring_elements":"0.68026","published_at":"2026-04-18T12:55:00Z"},{"value":"0.00551","scoring_system":"epss","scoring_elements":"0.68013","published_at":"2026-04-16T12:55:00Z"},{"value":"0.00551","scoring_system":"epss","scoring_elements":"0.67976","published_at":"2026-04-13T12:55:00Z"},{"value":"0.00551","scoring_system":"epss","scoring_elements":"0.6801","published_at":"2026-04-12T12:55:00Z"},{"value":"0.00551","scoring_system":"epss","scoring_elements":"0.68024","published_at":"2026-04-11T12:55:00Z"},{"value":"0.00551","scoring_system":"epss","scoring_elements":"0.68","published_at":"2026-04-09T12:55:00Z"},{"value":"0.00551","scoring_system":"epss","scoring_elements":"0.67936","published_at":"2026-04-07T12:55:00Z"},{"value":"0.00551","scoring_system":"epss","scoring_elements":"0.67957","published_at":"2026-04-04T12:55:00Z"},{"value":"0.00551","scoring_system":"epss","scoring_elements":"0.67987","published_at":"2026-04-08T12:55:00Z"},{"value":"0.00551","scoring_system":"epss","scoring_elements":"0.67915","published_at":"2026-04-01T12:55:00Z"},{"value":"0.00551","scoring_system":"epss","scoring_elements":"0.67938","published_at":"2026-04-02T12:55:00Z"}],"url":"https://api.first.org/data/v1/epss?cve=CVE-2020-5313"},{"reference_url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-19911","reference_id":"","reference_type":"","scores":[],"url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-19911"},{"reference_url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-5312","reference_id":"","reference_type":"","scores":[],"url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-5312"},{"reference_url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-5313","reference_id":"","reference_type":"","scores":[],"url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-5313"},{"reference_url":"https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml","reference_id":"","reference_type":"","scores":[{"value":"8.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"}],"url":"https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml"},{"reference_url":"https://github.com/advisories/GHSA-hj69-c76v-86wr","reference_id":"","reference_type":"","scores":[{"value":"7.1","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H"},{"value":"HIGH","scoring_system":"cvssv3.1_qr","scoring_elements":""},{"value":"8.3","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/advisories/GHSA-hj69-c76v-86wr"},{"reference_url":"https://github.com/pypa/advisory-database/tree/main/vulns/pillow/PYSEC-2020-84.yaml","reference_id":"","reference_type":"","scores":[{"value":"7.1","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H"},{"value":"8.3","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/pypa/advisory-database/tree/main/vulns/pillow/PYSEC-2020-84.yaml"},{"reference_url":"https://github.com/python-pillow/Pillow","reference_id":"","reference_type":"","scores":[{"value":"7.1","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H"},{"value":"8.3","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/python-pillow/Pillow"},{"reference_url":"https://github.com/python-pillow/Pillow/blob/master/CHANGES.rst#622-2020-01-02","reference_id":"","reference_type":"","scores":[{"value":"7.1","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H"},{"value":"8.3","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/python-pillow/Pillow/blob/master/CHANGES.rst#622-2020-01-02"},{"reference_url":"https://github.com/python-pillow/Pillow/commit/a09acd0decd8a87ccce939d5ff65dab59e7d365b","reference_id":"","reference_type":"","scores":[{"value":"7.1","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H"},{"value":"8.3","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/python-pillow/Pillow/commit/a09acd0decd8a87ccce939d5ff65dab59e7d365b"},{"reference_url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/2MMU3WT2X64GS5WHDPKKC2WZA7UIIQ3A","reference_id":"","reference_type":"","scores":[{"value":"7.1","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H"},{"value":"8.3","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/2MMU3WT2X64GS5WHDPKKC2WZA7UIIQ3A"},{"reference_url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/2MMU3WT2X64GS5WHDPKKC2WZA7UIIQ3A/","reference_id":"","reference_type":"","scores":[],"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/2MMU3WT2X64GS5WHDPKKC2WZA7UIIQ3A/"},{"reference_url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/3DUMIBUYGJRAVJCTFUWBRLVQKOUTVX5P","reference_id":"","reference_type":"","scores":[{"value":"7.1","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H"},{"value":"8.3","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/3DUMIBUYGJRAVJCTFUWBRLVQKOUTVX5P"},{"reference_url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/3DUMIBUYGJRAVJCTFUWBRLVQKOUTVX5P/","reference_id":"","reference_type":"","scores":[],"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/3DUMIBUYGJRAVJCTFUWBRLVQKOUTVX5P/"},{"reference_url":"https://nvd.nist.gov/vuln/detail/CVE-2020-5313","reference_id":"","reference_type":"","scores":[{"value":"7.1","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H"},{"value":"8.3","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://nvd.nist.gov/vuln/detail/CVE-2020-5313"},{"reference_url":"https://pillow.readthedocs.io/en/stable/releasenotes/6.2.2.html","reference_id":"","reference_type":"","scores":[{"value":"7.1","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H"},{"value":"8.3","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://pillow.readthedocs.io/en/stable/releasenotes/6.2.2.html"},{"reference_url":"https://usn.ubuntu.com/4272-1","reference_id":"","reference_type":"","scores":[{"value":"7.1","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H"},{"value":"8.3","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://usn.ubuntu.com/4272-1"},{"reference_url":"https://usn.ubuntu.com/4272-1/","reference_id":"","reference_type":"","scores":[],"url":"https://usn.ubuntu.com/4272-1/"},{"reference_url":"https://www.debian.org/security/2020/dsa-4631","reference_id":"","reference_type":"","scores":[{"value":"7.1","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H"},{"value":"8.3","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://www.debian.org/security/2020/dsa-4631"},{"reference_url":"https://bugzilla.redhat.com/show_bug.cgi?id=1789532","reference_id":"1789532","reference_type":"","scores":[],"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1789532"},{"reference_url":"https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=948224","reference_id":"948224","reference_type":"","scores":[],"url":"https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=948224"},{"reference_url":"https://access.redhat.com/errata/RHSA-2020:3185","reference_id":"RHSA-2020:3185","reference_type":"","scores":[],"url":"https://access.redhat.com/errata/RHSA-2020:3185"},{"reference_url":"https://access.redhat.com/errata/RHSA-2020:3887","reference_id":"RHSA-2020:3887","reference_type":"","scores":[],"url":"https://access.redhat.com/errata/RHSA-2020:3887"},{"reference_url":"https://access.redhat.com/errata/RHSA-2021:0420","reference_id":"RHSA-2021:0420","reference_type":"","scores":[],"url":"https://access.redhat.com/errata/RHSA-2021:0420"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/9845?format=json","purl":"pkg:pypi/pillow@6.2.2","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-19e1-19hk-duet"},{"vulnerability":"VCID-1vt7-c6e3-7qc8"},{"vulnerability":"VCID-3qb5-8p8w-gkad"},{"vulnerability":"VCID-3uk9-eds5-rkgc"},{"vulnerability":"VCID-53ac-ceq4-qkhf"},{"vulnerability":"VCID-5rv4-k1q9-zue2"},{"vulnerability":"VCID-64n5-pugj-vue8"},{"vulnerability":"VCID-6gyu-fzpg-c3bn"},{"vulnerability":"VCID-7bjx-gkf7-cke9"},{"vulnerability":"VCID-8n2b-wvya-53e1"},{"vulnerability":"VCID-9ckw-ra54-z3b7"},{"vulnerability":"VCID-and9-6jty-pyeq"},{"vulnerability":"VCID-aubw-tsmn-ffcq"},{"vulnerability":"VCID-b5a2-83ej-puaw"},{"vulnerability":"VCID-brp2-dtrf-jyfr"},{"vulnerability":"VCID-d7uf-zdbv-sba1"},{"vulnerability":"VCID-df4x-jt3h-17hx"},{"vulnerability":"VCID-dpc3-td9q-dyee"},{"vulnerability":"VCID-en6t-uxtq-bfek"},{"vulnerability":"VCID-g46h-p8jk-cuhc"},{"vulnerability":"VCID-gvjw-funa-sqak"},{"vulnerability":"VCID-haum-8zpg-6kgf"},{"vulnerability":"VCID-khp6-9hfx-1kge"},{"vulnerability":"VCID-n1hp-atex-ubh4"},{"vulnerability":"VCID-n1w5-f5p7-xuhb"},{"vulnerability":"VCID-p6r3-puh1-zyg6"},{"vulnerability":"VCID-q4bb-qnxe-8bfa"},{"vulnerability":"VCID-rncf-9nf8-wud3"},{"vulnerability":"VCID-ue18-zzau-x7hy"},{"vulnerability":"VCID-uf5t-asns-tudp"},{"vulnerability":"VCID-vdzj-kqfy-d3b7"},{"vulnerability":"VCID-vwbu-ruxm-tbh4"},{"vulnerability":"VCID-vxh1-8rvt-kkak"},{"vulnerability":"VCID-vyzt-df2u-h3cc"},{"vulnerability":"VCID-w9uy-fnpm-cbak"},{"vulnerability":"VCID-x15z-dejc-9ba6"},{"vulnerability":"VCID-xesd-d294-7fcx"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:pypi/pillow@6.2.2"}],"aliases":["BIT-pillow-2020-5313","CVE-2020-5313","GHSA-hj69-c76v-86wr","PYSEC-2020-84"],"risk_score":4.0,"exploitability":"0.5","weighted_severity":"8.0","resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-hmmq-5772-bycm"},{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/34951?format=json","vulnerability_id":"VCID-khp6-9hfx-1kge","summary":"Uncontrolled Resource Consumption in pillow\n### Impact\n_Pillow before 8.1.1 allows attackers to cause a denial of service (memory consumption) because the reported size of a contained image is not properly checked for a BLP container, and thus an attempted memory allocation can be very large._\n\n### Patches\n_An issue was discovered in Pillow before 6.2.0. When reading specially crafted invalid image files, the library can either allocate very large amounts of memory or take an extremely long period of time to process the image._\n\n### Workarounds\n_An issue was discovered in Pillow before 6.2.0. When reading specially crafted invalid image files, the library can either allocate very large amounts of memory or take an extremely long period of time to process the image._\n\n### References\nhttps://nvd.nist.gov/vuln/detail/CVE-2021-27921\n\n### For more information\nIf you have any questions or comments about this advisory:\n* Open an issue in [example link to repo](http://example.com)\n* Email us at [example email address](mailto:example@example.com)","references":[{"reference_url":"https://github.com/calix2/pyVulApp/security/advisories/GHSA-jgpv-4h4c-xhw3","reference_id":"","reference_type":"","scores":[{"value":"7.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"},{"value":"MODERATE","scoring_system":"cvssv3.1_qr","scoring_elements":""},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/calix2/pyVulApp/security/advisories/GHSA-jgpv-4h4c-xhw3"},{"reference_url":"https://github.com/advisories/GHSA-jgpv-4h4c-xhw3","reference_id":"GHSA-jgpv-4h4c-xhw3","reference_type":"","scores":[{"value":"MODERATE","scoring_system":"cvssv3.1_qr","scoring_elements":""}],"url":"https://github.com/advisories/GHSA-jgpv-4h4c-xhw3"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/15250?format=json","purl":"pkg:pypi/pillow@8.1.1","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-19e1-19hk-duet"},{"vulnerability":"VCID-1vt7-c6e3-7qc8"},{"vulnerability":"VCID-3qb5-8p8w-gkad"},{"vulnerability":"VCID-3uk9-eds5-rkgc"},{"vulnerability":"VCID-53ac-ceq4-qkhf"},{"vulnerability":"VCID-5rv4-k1q9-zue2"},{"vulnerability":"VCID-64n5-pugj-vue8"},{"vulnerability":"VCID-9ckw-ra54-z3b7"},{"vulnerability":"VCID-aubw-tsmn-ffcq"},{"vulnerability":"VCID-brp2-dtrf-jyfr"},{"vulnerability":"VCID-d7uf-zdbv-sba1"},{"vulnerability":"VCID-df4x-jt3h-17hx"},{"vulnerability":"VCID-dpc3-td9q-dyee"},{"vulnerability":"VCID-g46h-p8jk-cuhc"},{"vulnerability":"VCID-gvjw-funa-sqak"},{"vulnerability":"VCID-n1hp-atex-ubh4"},{"vulnerability":"VCID-n1w5-f5p7-xuhb"},{"vulnerability":"VCID-q4bb-qnxe-8bfa"},{"vulnerability":"VCID-ue18-zzau-x7hy"},{"vulnerability":"VCID-vdzj-kqfy-d3b7"},{"vulnerability":"VCID-vwbu-ruxm-tbh4"},{"vulnerability":"VCID-vyzt-df2u-h3cc"},{"vulnerability":"VCID-w9uy-fnpm-cbak"},{"vulnerability":"VCID-xesd-d294-7fcx"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:pypi/pillow@8.1.1"},{"url":"http://public2.vulnerablecode.io/api/packages/17187?format=json","purl":"pkg:pypi/pillow@8.1.2","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-19e1-19hk-duet"},{"vulnerability":"VCID-1vt7-c6e3-7qc8"},{"vulnerability":"VCID-3uk9-eds5-rkgc"},{"vulnerability":"VCID-5rv4-k1q9-zue2"},{"vulnerability":"VCID-64n5-pugj-vue8"},{"vulnerability":"VCID-9ckw-ra54-z3b7"},{"vulnerability":"VCID-aubw-tsmn-ffcq"},{"vulnerability":"VCID-brp2-dtrf-jyfr"},{"vulnerability":"VCID-d7uf-zdbv-sba1"},{"vulnerability":"VCID-df4x-jt3h-17hx"},{"vulnerability":"VCID-dpc3-td9q-dyee"},{"vulnerability":"VCID-g46h-p8jk-cuhc"},{"vulnerability":"VCID-n1hp-atex-ubh4"},{"vulnerability":"VCID-n1w5-f5p7-xuhb"},{"vulnerability":"VCID-q4bb-qnxe-8bfa"},{"vulnerability":"VCID-ue18-zzau-x7hy"},{"vulnerability":"VCID-vdzj-kqfy-d3b7"},{"vulnerability":"VCID-vwbu-ruxm-tbh4"},{"vulnerability":"VCID-vyzt-df2u-h3cc"},{"vulnerability":"VCID-w9uy-fnpm-cbak"},{"vulnerability":"VCID-xesd-d294-7fcx"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:pypi/pillow@8.1.2"}],"aliases":["GHSA-jgpv-4h4c-xhw3","GMS-2021-167"],"risk_score":3.4,"exploitability":"0.5","weighted_severity":"6.8","resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-khp6-9hfx-1kge"},{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/5997?format=json","vulnerability_id":"VCID-m3tm-h4q9-9yay","summary":"libImaging/SgiRleDecode.c in Pillow before 6.2.2 has an SGI buffer overflow.","references":[{"reference_url":"https://access.redhat.com/errata/RHSA-2020:0566","reference_id":"","reference_type":"","scores":[{"value":"9.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},{"value":"9.3","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N"},{"value":"CRITICAL","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://access.redhat.com/errata/RHSA-2020:0566"},{"reference_url":"https://access.redhat.com/errata/RHSA-2020:0580","reference_id":"","reference_type":"","scores":[{"value":"9.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},{"value":"9.3","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N"},{"value":"CRITICAL","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://access.redhat.com/errata/RHSA-2020:0580"},{"reference_url":"https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2020-5311.json","reference_id":"","reference_type":"","scores":[{"value":"9.8","scoring_system":"cvssv3","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"}],"url":"https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2020-5311.json"},{"reference_url":"https://api.first.org/data/v1/epss?cve=CVE-2020-5311","reference_id":"","reference_type":"","scores":[{"value":"0.01304","scoring_system":"epss","scoring_elements":"0.7978","published_at":"2026-04-16T12:55:00Z"},{"value":"0.01304","scoring_system":"epss","scoring_elements":"0.79753","published_at":"2026-04-13T12:55:00Z"},{"value":"0.01304","scoring_system":"epss","scoring_elements":"0.7976","published_at":"2026-04-12T12:55:00Z"},{"value":"0.01304","scoring_system":"epss","scoring_elements":"0.79776","published_at":"2026-04-11T12:55:00Z"},{"value":"0.01304","scoring_system":"epss","scoring_elements":"0.79754","published_at":"2026-04-09T12:55:00Z"},{"value":"0.01304","scoring_system":"epss","scoring_elements":"0.79705","published_at":"2026-04-01T12:55:00Z"},{"value":"0.01304","scoring_system":"epss","scoring_elements":"0.79718","published_at":"2026-04-07T12:55:00Z"},{"value":"0.01304","scoring_system":"epss","scoring_elements":"0.79733","published_at":"2026-04-04T12:55:00Z"},{"value":"0.01304","scoring_system":"epss","scoring_elements":"0.79712","published_at":"2026-04-02T12:55:00Z"},{"value":"0.01304","scoring_system":"epss","scoring_elements":"0.79747","published_at":"2026-04-08T12:55:00Z"},{"value":"0.01304","scoring_system":"epss","scoring_elements":"0.79852","published_at":"2026-05-05T12:55:00Z"},{"value":"0.01304","scoring_system":"epss","scoring_elements":"0.79837","published_at":"2026-04-29T12:55:00Z"},{"value":"0.01304","scoring_system":"epss","scoring_elements":"0.79822","published_at":"2026-04-26T12:55:00Z"},{"value":"0.01304","scoring_system":"epss","scoring_elements":"0.79815","published_at":"2026-04-24T12:55:00Z"},{"value":"0.01304","scoring_system":"epss","scoring_elements":"0.79785","published_at":"2026-04-21T12:55:00Z"},{"value":"0.01304","scoring_system":"epss","scoring_elements":"0.79781","published_at":"2026-04-18T12:55:00Z"}],"url":"https://api.first.org/data/v1/epss?cve=CVE-2020-5311"},{"reference_url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-5311","reference_id":"","reference_type":"","scores":[],"url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-5311"},{"reference_url":"https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml","reference_id":"","reference_type":"","scores":[{"value":"8.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"}],"url":"https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml"},{"reference_url":"https://github.com/advisories/GHSA-r7rm-8j6h-r933","reference_id":"","reference_type":"","scores":[{"value":"9.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},{"value":"CRITICAL","scoring_system":"cvssv3.1_qr","scoring_elements":""},{"value":"9.3","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N"},{"value":"CRITICAL","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/advisories/GHSA-r7rm-8j6h-r933"},{"reference_url":"https://github.com/pypa/advisory-database/tree/main/vulns/pillow/PYSEC-2020-82.yaml","reference_id":"","reference_type":"","scores":[{"value":"9.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},{"value":"9.3","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N"},{"value":"CRITICAL","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/pypa/advisory-database/tree/main/vulns/pillow/PYSEC-2020-82.yaml"},{"reference_url":"https://github.com/python-pillow/Pillow","reference_id":"","reference_type":"","scores":[{"value":"9.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},{"value":"9.3","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N"},{"value":"CRITICAL","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/python-pillow/Pillow"},{"reference_url":"https://github.com/python-pillow/Pillow/commit/a79b65c47c7dc6fe623aadf09aa6192fc54548f3","reference_id":"","reference_type":"","scores":[{"value":"9.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},{"value":"9.3","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N"},{"value":"CRITICAL","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/python-pillow/Pillow/commit/a79b65c47c7dc6fe623aadf09aa6192fc54548f3"},{"reference_url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/2MMU3WT2X64GS5WHDPKKC2WZA7UIIQ3A","reference_id":"","reference_type":"","scores":[{"value":"9.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},{"value":"9.3","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N"},{"value":"CRITICAL","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/2MMU3WT2X64GS5WHDPKKC2WZA7UIIQ3A"},{"reference_url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/2MMU3WT2X64GS5WHDPKKC2WZA7UIIQ3A/","reference_id":"","reference_type":"","scores":[],"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/2MMU3WT2X64GS5WHDPKKC2WZA7UIIQ3A/"},{"reference_url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/3DUMIBUYGJRAVJCTFUWBRLVQKOUTVX5P","reference_id":"","reference_type":"","scores":[{"value":"9.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},{"value":"9.3","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N"},{"value":"CRITICAL","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/3DUMIBUYGJRAVJCTFUWBRLVQKOUTVX5P"},{"reference_url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/3DUMIBUYGJRAVJCTFUWBRLVQKOUTVX5P/","reference_id":"","reference_type":"","scores":[],"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/3DUMIBUYGJRAVJCTFUWBRLVQKOUTVX5P/"},{"reference_url":"https://nvd.nist.gov/vuln/detail/CVE-2020-5311","reference_id":"","reference_type":"","scores":[{"value":"9.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},{"value":"9.3","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N"},{"value":"CRITICAL","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://nvd.nist.gov/vuln/detail/CVE-2020-5311"},{"reference_url":"https://pillow.readthedocs.io/en/stable/releasenotes/6.2.2.html","reference_id":"","reference_type":"","scores":[{"value":"9.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},{"value":"9.3","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N"},{"value":"CRITICAL","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://pillow.readthedocs.io/en/stable/releasenotes/6.2.2.html"},{"reference_url":"https://usn.ubuntu.com/4272-1","reference_id":"","reference_type":"","scores":[{"value":"9.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},{"value":"9.3","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N"},{"value":"CRITICAL","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://usn.ubuntu.com/4272-1"},{"reference_url":"https://usn.ubuntu.com/4272-1/","reference_id":"","reference_type":"","scores":[],"url":"https://usn.ubuntu.com/4272-1/"},{"reference_url":"https://www.debian.org/security/2020/dsa-4631","reference_id":"","reference_type":"","scores":[{"value":"9.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},{"value":"9.3","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N"},{"value":"CRITICAL","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://www.debian.org/security/2020/dsa-4631"},{"reference_url":"https://bugzilla.redhat.com/show_bug.cgi?id=1789535","reference_id":"1789535","reference_type":"","scores":[],"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1789535"},{"reference_url":"https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=948224","reference_id":"948224","reference_type":"","scores":[],"url":"https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=948224"},{"reference_url":"https://access.redhat.com/errata/RHSA-2021:0420","reference_id":"RHSA-2021:0420","reference_type":"","scores":[],"url":"https://access.redhat.com/errata/RHSA-2021:0420"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/9845?format=json","purl":"pkg:pypi/pillow@6.2.2","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-19e1-19hk-duet"},{"vulnerability":"VCID-1vt7-c6e3-7qc8"},{"vulnerability":"VCID-3qb5-8p8w-gkad"},{"vulnerability":"VCID-3uk9-eds5-rkgc"},{"vulnerability":"VCID-53ac-ceq4-qkhf"},{"vulnerability":"VCID-5rv4-k1q9-zue2"},{"vulnerability":"VCID-64n5-pugj-vue8"},{"vulnerability":"VCID-6gyu-fzpg-c3bn"},{"vulnerability":"VCID-7bjx-gkf7-cke9"},{"vulnerability":"VCID-8n2b-wvya-53e1"},{"vulnerability":"VCID-9ckw-ra54-z3b7"},{"vulnerability":"VCID-and9-6jty-pyeq"},{"vulnerability":"VCID-aubw-tsmn-ffcq"},{"vulnerability":"VCID-b5a2-83ej-puaw"},{"vulnerability":"VCID-brp2-dtrf-jyfr"},{"vulnerability":"VCID-d7uf-zdbv-sba1"},{"vulnerability":"VCID-df4x-jt3h-17hx"},{"vulnerability":"VCID-dpc3-td9q-dyee"},{"vulnerability":"VCID-en6t-uxtq-bfek"},{"vulnerability":"VCID-g46h-p8jk-cuhc"},{"vulnerability":"VCID-gvjw-funa-sqak"},{"vulnerability":"VCID-haum-8zpg-6kgf"},{"vulnerability":"VCID-khp6-9hfx-1kge"},{"vulnerability":"VCID-n1hp-atex-ubh4"},{"vulnerability":"VCID-n1w5-f5p7-xuhb"},{"vulnerability":"VCID-p6r3-puh1-zyg6"},{"vulnerability":"VCID-q4bb-qnxe-8bfa"},{"vulnerability":"VCID-rncf-9nf8-wud3"},{"vulnerability":"VCID-ue18-zzau-x7hy"},{"vulnerability":"VCID-uf5t-asns-tudp"},{"vulnerability":"VCID-vdzj-kqfy-d3b7"},{"vulnerability":"VCID-vwbu-ruxm-tbh4"},{"vulnerability":"VCID-vxh1-8rvt-kkak"},{"vulnerability":"VCID-vyzt-df2u-h3cc"},{"vulnerability":"VCID-w9uy-fnpm-cbak"},{"vulnerability":"VCID-x15z-dejc-9ba6"},{"vulnerability":"VCID-xesd-d294-7fcx"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:pypi/pillow@6.2.2"}],"aliases":["BIT-pillow-2020-5311","CVE-2020-5311","GHSA-r7rm-8j6h-r933","PYSEC-2020-82"],"risk_score":4.5,"exploitability":"0.5","weighted_severity":"9.0","resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-m3tm-h4q9-9yay"},{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/5473?format=json","vulnerability_id":"VCID-ma2g-2f8d-dqa9","summary":"The Jpeg2KImagePlugin plugin in Pillow before 2.5.3 allows remote attackers to cause a denial of service via a crafted image.","references":[{"reference_url":"http://lists.opensuse.org/opensuse-updates/2015-04/msg00056.html","reference_id":"","reference_type":"","scores":[{"value":"7.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"},{"value":"8.7","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"http://lists.opensuse.org/opensuse-updates/2015-04/msg00056.html"},{"reference_url":"https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2014-3598.json","reference_id":"","reference_type":"","scores":[],"url":"https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2014-3598.json"},{"reference_url":"https://api.first.org/data/v1/epss?cve=CVE-2014-3598","reference_id":"","reference_type":"","scores":[{"value":"0.00403","scoring_system":"epss","scoring_elements":"0.60794","published_at":"2026-04-07T12:55:00Z"},{"value":"0.00403","scoring_system":"epss","scoring_elements":"0.6088","published_at":"2026-04-26T12:55:00Z"},{"value":"0.00403","scoring_system":"epss","scoring_elements":"0.60859","published_at":"2026-04-09T12:55:00Z"},{"value":"0.00403","scoring_system":"epss","scoring_elements":"0.60728","published_at":"2026-04-01T12:55:00Z"},{"value":"0.00403","scoring_system":"epss","scoring_elements":"0.608","published_at":"2026-04-02T12:55:00Z"},{"value":"0.00403","scoring_system":"epss","scoring_elements":"0.6083","published_at":"2026-04-04T12:55:00Z"},{"value":"0.00403","scoring_system":"epss","scoring_elements":"0.60843","published_at":"2026-04-08T12:55:00Z"},{"value":"0.00403","scoring_system":"epss","scoring_elements":"0.60823","published_at":"2026-05-05T12:55:00Z"},{"value":"0.00403","scoring_system":"epss","scoring_elements":"0.60873","published_at":"2026-04-29T12:55:00Z"},{"value":"0.00403","scoring_system":"epss","scoring_elements":"0.60878","published_at":"2026-04-21T12:55:00Z"},{"value":"0.00403","scoring_system":"epss","scoring_elements":"0.60894","published_at":"2026-04-18T12:55:00Z"},{"value":"0.00403","scoring_system":"epss","scoring_elements":"0.6089","published_at":"2026-04-16T12:55:00Z"},{"value":"0.00403","scoring_system":"epss","scoring_elements":"0.60848","published_at":"2026-04-13T12:55:00Z"},{"value":"0.00403","scoring_system":"epss","scoring_elements":"0.60867","published_at":"2026-04-24T12:55:00Z"}],"url":"https://api.first.org/data/v1/epss?cve=CVE-2014-3598"},{"reference_url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3598","reference_id":"","reference_type":"","scores":[],"url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3598"},{"reference_url":"https://github.com/pypa/advisory-database/tree/main/vulns/pillow/PYSEC-2015-15.yaml","reference_id":"","reference_type":"","scores":[{"value":"7.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"},{"value":"8.7","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/pypa/advisory-database/tree/main/vulns/pillow/PYSEC-2015-15.yaml"},{"reference_url":"https://github.com/python-pillow/Pillow","reference_id":"","reference_type":"","scores":[{"value":"7.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"},{"value":"8.7","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/python-pillow/Pillow"},{"reference_url":"https://github.com/python-pillow/Pillow/commit/347a1d8d956f9e64af4463ee25311b60cdd5657d","reference_id":"","reference_type":"","scores":[{"value":"7.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"},{"value":"8.7","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/python-pillow/Pillow/commit/347a1d8d956f9e64af4463ee25311b60cdd5657d"},{"reference_url":"https://pypi.python.org/pypi/Pillow/2.5.3","reference_id":"","reference_type":"","scores":[{"value":"7.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"},{"value":"8.7","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://pypi.python.org/pypi/Pillow/2.5.3"},{"reference_url":"https://bugzilla.redhat.com/show_bug.cgi?id=1163441","reference_id":"1163441","reference_type":"","scores":[],"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1163441"},{"reference_url":"https://nvd.nist.gov/vuln/detail/CVE-2014-3598","reference_id":"CVE-2014-3598","reference_type":"","scores":[{"value":"7.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"},{"value":"8.7","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://nvd.nist.gov/vuln/detail/CVE-2014-3598"},{"reference_url":"https://github.com/advisories/GHSA-j6f7-g425-4gmx","reference_id":"GHSA-j6f7-g425-4gmx","reference_type":"","scores":[{"value":"HIGH","scoring_system":"cvssv3.1_qr","scoring_elements":""}],"url":"https://github.com/advisories/GHSA-j6f7-g425-4gmx"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/3786?format=json","purl":"pkg:pypi/pillow@2.5.3","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-19e1-19hk-duet"},{"vulnerability":"VCID-1vt7-c6e3-7qc8"},{"vulnerability":"VCID-366h-8f99-r7at"},{"vulnerability":"VCID-3qb5-8p8w-gkad"},{"vulnerability":"VCID-3uk9-eds5-rkgc"},{"vulnerability":"VCID-53ac-ceq4-qkhf"},{"vulnerability":"VCID-5rv4-k1q9-zue2"},{"vulnerability":"VCID-64n5-pugj-vue8"},{"vulnerability":"VCID-6gyu-fzpg-c3bn"},{"vulnerability":"VCID-8n2b-wvya-53e1"},{"vulnerability":"VCID-9ckw-ra54-z3b7"},{"vulnerability":"VCID-and9-6jty-pyeq"},{"vulnerability":"VCID-aubw-tsmn-ffcq"},{"vulnerability":"VCID-avx2-mahw-mqes"},{"vulnerability":"VCID-b3au-rcgp-2fag"},{"vulnerability":"VCID-b5a2-83ej-puaw"},{"vulnerability":"VCID-brp2-dtrf-jyfr"},{"vulnerability":"VCID-cas2-jb3y-vyhz"},{"vulnerability":"VCID-d7uf-zdbv-sba1"},{"vulnerability":"VCID-df4x-jt3h-17hx"},{"vulnerability":"VCID-dgds-v95g-pbcv"},{"vulnerability":"VCID-dpc3-td9q-dyee"},{"vulnerability":"VCID-e3gp-zc2b-budg"},{"vulnerability":"VCID-en6t-uxtq-bfek"},{"vulnerability":"VCID-g46h-p8jk-cuhc"},{"vulnerability":"VCID-gvjw-funa-sqak"},{"vulnerability":"VCID-h4x7-7fke-mqgp"},{"vulnerability":"VCID-haum-8zpg-6kgf"},{"vulnerability":"VCID-hmmq-5772-bycm"},{"vulnerability":"VCID-khp6-9hfx-1kge"},{"vulnerability":"VCID-m3tm-h4q9-9yay"},{"vulnerability":"VCID-n1hp-atex-ubh4"},{"vulnerability":"VCID-n1w5-f5p7-xuhb"},{"vulnerability":"VCID-p6r3-puh1-zyg6"},{"vulnerability":"VCID-q4bb-qnxe-8bfa"},{"vulnerability":"VCID-qjqr-jyjn-xfh9"},{"vulnerability":"VCID-rncf-9nf8-wud3"},{"vulnerability":"VCID-sns1-ksqr-vbhr"},{"vulnerability":"VCID-stft-hsk9-zfdy"},{"vulnerability":"VCID-u1en-t8ux-uube"},{"vulnerability":"VCID-ue18-zzau-x7hy"},{"vulnerability":"VCID-uf5t-asns-tudp"},{"vulnerability":"VCID-vdzj-kqfy-d3b7"},{"vulnerability":"VCID-vwbu-ruxm-tbh4"},{"vulnerability":"VCID-vxh1-8rvt-kkak"},{"vulnerability":"VCID-vyzt-df2u-h3cc"},{"vulnerability":"VCID-w9uy-fnpm-cbak"},{"vulnerability":"VCID-x15z-dejc-9ba6"},{"vulnerability":"VCID-xesd-d294-7fcx"},{"vulnerability":"VCID-xk66-1d31-2qbk"},{"vulnerability":"VCID-yccg-zw89-vqff"},{"vulnerability":"VCID-zmd3-henq-r7bd"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:pypi/pillow@2.5.3"}],"aliases":["CVE-2014-3598","GHSA-j6f7-g425-4gmx","PYSEC-2015-15"],"risk_score":4.0,"exploitability":"0.5","weighted_severity":"8.0","resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-ma2g-2f8d-dqa9"},{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/11396?format=json","vulnerability_id":"VCID-n1hp-atex-ubh4","summary":"An issue was discovered in Pillow before 10.0.0. It is a Denial of Service that uncontrollably allocates memory to process a given task, potentially causing a service to crash by having it run out of memory. This occurs for truetype in ImageFont when textlength in an ImageDraw instance operates on a long text argument.","references":[{"reference_url":"https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2023-44271.json","reference_id":"","reference_type":"","scores":[{"value":"7.5","scoring_system":"cvssv3","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"url":"https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2023-44271.json"},{"reference_url":"https://api.first.org/data/v1/epss?cve=CVE-2023-44271","reference_id":"","reference_type":"","scores":[{"value":"0.00218","scoring_system":"epss","scoring_elements":"0.44183","published_at":"2026-04-29T12:55:00Z"},{"value":"0.00218","scoring_system":"epss","scoring_elements":"0.44266","published_at":"2026-04-26T12:55:00Z"},{"value":"0.00218","scoring_system":"epss","scoring_elements":"0.44263","published_at":"2026-04-24T12:55:00Z"},{"value":"0.00218","scoring_system":"epss","scoring_elements":"0.44406","published_at":"2026-04-09T12:55:00Z"},{"value":"0.00218","scoring_system":"epss","scoring_elements":"0.44413","published_at":"2026-04-04T12:55:00Z"},{"value":"0.00218","scoring_system":"epss","scoring_elements":"0.44347","published_at":"2026-04-07T12:55:00Z"},{"value":"0.00218","scoring_system":"epss","scoring_elements":"0.44399","published_at":"2026-04-08T12:55:00Z"},{"value":"0.00218","scoring_system":"epss","scoring_elements":"0.44438","published_at":"2026-04-18T12:55:00Z"},{"value":"0.00218","scoring_system":"epss","scoring_elements":"0.44447","published_at":"2026-04-16T12:55:00Z"},{"value":"0.00218","scoring_system":"epss","scoring_elements":"0.44392","published_at":"2026-04-12T12:55:00Z"},{"value":"0.00218","scoring_system":"epss","scoring_elements":"0.44423","published_at":"2026-04-11T12:55:00Z"},{"value":"0.00218","scoring_system":"epss","scoring_elements":"0.44391","published_at":"2026-04-13T12:55:00Z"},{"value":"0.00224","scoring_system":"epss","scoring_elements":"0.45083","published_at":"2026-04-21T12:55:00Z"},{"value":"0.00236","scoring_system":"epss","scoring_elements":"0.46434","published_at":"2026-05-05T12:55:00Z"}],"url":"https://api.first.org/data/v1/epss?cve=CVE-2023-44271"},{"reference_url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-44271","reference_id":"","reference_type":"","scores":[],"url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-44271"},{"reference_url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-50447","reference_id":"","reference_type":"","scores":[],"url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-50447"},{"reference_url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-28219","reference_id":"","reference_type":"","scores":[],"url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-28219"},{"reference_url":"https://devhub.checkmarx.com/cve-details/CVE-2023-44271/","reference_id":"","reference_type":"","scores":[],"url":"https://devhub.checkmarx.com/cve-details/CVE-2023-44271/"},{"reference_url":"https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml","reference_id":"","reference_type":"","scores":[{"value":"7.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"url":"https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml"},{"reference_url":"https://github.com/pypa/advisory-database/tree/main/vulns/pillow/PYSEC-2023-227.yaml","reference_id":"","reference_type":"","scores":[{"value":"7.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"},{"value":"8.7","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/pypa/advisory-database/tree/main/vulns/pillow/PYSEC-2023-227.yaml"},{"reference_url":"https://github.com/python-pillow/Pillow","reference_id":"","reference_type":"","scores":[{"value":"7.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"},{"value":"8.7","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/python-pillow/Pillow"},{"reference_url":"https://github.com/python-pillow/Pillow/commit/1fe1bb49c452b0318cad12ea9d97c3bef188e9a7","reference_id":"","reference_type":"","scores":[{"value":"7.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"},{"value":"8.7","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/python-pillow/Pillow/commit/1fe1bb49c452b0318cad12ea9d97c3bef188e9a7"},{"reference_url":"https://github.com/python-pillow/Pillow/pull/7244","reference_id":"","reference_type":"","scores":[{"value":"7.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"},{"value":"8.7","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/python-pillow/Pillow/pull/7244"},{"reference_url":"https://lists.debian.org/debian-lts-announce/2024/03/msg00021.html","reference_id":"","reference_type":"","scores":[{"value":"7.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"},{"value":"8.7","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://lists.debian.org/debian-lts-announce/2024/03/msg00021.html"},{"reference_url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/N2JOEDUJDQLCUII2LQYZYSM7RJL2I3P4","reference_id":"","reference_type":"","scores":[{"value":"7.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"},{"value":"8.7","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/N2JOEDUJDQLCUII2LQYZYSM7RJL2I3P4"},{"reference_url":"https://bugzilla.redhat.com/show_bug.cgi?id=2247820","reference_id":"2247820","reference_type":"","scores":[],"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2247820"},{"reference_url":"https://devhub.checkmarx.com/cve-details/CVE-2023-44271","reference_id":"CVE-2023-44271","reference_type":"","scores":[{"value":"7.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"},{"value":"8.7","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://devhub.checkmarx.com/cve-details/CVE-2023-44271"},{"reference_url":"https://nvd.nist.gov/vuln/detail/CVE-2023-44271","reference_id":"CVE-2023-44271","reference_type":"","scores":[{"value":"7.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"},{"value":"8.7","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-44271"},{"reference_url":"https://github.com/advisories/GHSA-8ghj-p4vj-mr35","reference_id":"GHSA-8ghj-p4vj-mr35","reference_type":"","scores":[{"value":"HIGH","scoring_system":"cvssv3.1_qr","scoring_elements":""}],"url":"https://github.com/advisories/GHSA-8ghj-p4vj-mr35"},{"reference_url":"https://security.gentoo.org/glsa/202405-12","reference_id":"GLSA-202405-12","reference_type":"","scores":[],"url":"https://security.gentoo.org/glsa/202405-12"},{"reference_url":"https://access.redhat.com/errata/RHSA-2024:0345","reference_id":"RHSA-2024:0345","reference_type":"","scores":[],"url":"https://access.redhat.com/errata/RHSA-2024:0345"},{"reference_url":"https://access.redhat.com/errata/RHSA-2024:1057","reference_id":"RHSA-2024:1057","reference_type":"","scores":[],"url":"https://access.redhat.com/errata/RHSA-2024:1057"},{"reference_url":"https://access.redhat.com/errata/RHSA-2024:3005","reference_id":"RHSA-2024:3005","reference_type":"","scores":[],"url":"https://access.redhat.com/errata/RHSA-2024:3005"},{"reference_url":"https://usn.ubuntu.com/6618-1/","reference_id":"USN-6618-1","reference_type":"","scores":[],"url":"https://usn.ubuntu.com/6618-1/"},{"reference_url":"https://usn.ubuntu.com/8135-1/","reference_id":"USN-8135-1","reference_type":"","scores":[],"url":"https://usn.ubuntu.com/8135-1/"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/41011?format=json","purl":"pkg:pypi/pillow@10.0.0","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-5rv4-k1q9-zue2"},{"vulnerability":"VCID-64n5-pugj-vue8"},{"vulnerability":"VCID-9ckw-ra54-z3b7"},{"vulnerability":"VCID-d7uf-zdbv-sba1"},{"vulnerability":"VCID-vdzj-kqfy-d3b7"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:pypi/pillow@10.0.0"}],"aliases":["BIT-pillow-2023-44271","CVE-2023-44271","GHSA-8ghj-p4vj-mr35","PYSEC-2023-227"],"risk_score":4.0,"exploitability":"0.5","weighted_severity":"8.0","resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-n1hp-atex-ubh4"},{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/6466?format=json","vulnerability_id":"VCID-n1w5-f5p7-xuhb","summary":"An issue was discovered in Pillow before 8.2.0. There is an out-of-bounds read in J2kDecode, in j2ku_graya_la.","references":[{"reference_url":"https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2021-25287.json","reference_id":"","reference_type":"","scores":[{"value":"9.1","scoring_system":"cvssv3","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H"}],"url":"https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2021-25287.json"},{"reference_url":"https://api.first.org/data/v1/epss?cve=CVE-2021-25287","reference_id":"","reference_type":"","scores":[{"value":"0.00343","scoring_system":"epss","scoring_elements":"0.56873","published_at":"2026-05-05T12:55:00Z"},{"value":"0.00343","scoring_system":"epss","scoring_elements":"0.5692","published_at":"2026-04-29T12:55:00Z"},{"value":"0.00343","scoring_system":"epss","scoring_elements":"0.56936","published_at":"2026-04-26T12:55:00Z"},{"value":"0.00343","scoring_system":"epss","scoring_elements":"0.56866","published_at":"2026-04-01T12:55:00Z"},{"value":"0.00343","scoring_system":"epss","scoring_elements":"0.56961","published_at":"2026-04-07T12:55:00Z"},{"value":"0.00343","scoring_system":"epss","scoring_elements":"0.56985","published_at":"2026-04-04T12:55:00Z"},{"value":"0.00343","scoring_system":"epss","scoring_elements":"0.56963","published_at":"2026-04-02T12:55:00Z"},{"value":"0.00343","scoring_system":"epss","scoring_elements":"0.57007","published_at":"2026-04-18T12:55:00Z"},{"value":"0.00343","scoring_system":"epss","scoring_elements":"0.5701","published_at":"2026-04-16T12:55:00Z"},{"value":"0.00343","scoring_system":"epss","scoring_elements":"0.56981","published_at":"2026-04-13T12:55:00Z"},{"value":"0.00343","scoring_system":"epss","scoring_elements":"0.57005","published_at":"2026-04-12T12:55:00Z"},{"value":"0.00343","scoring_system":"epss","scoring_elements":"0.57025","published_at":"2026-04-11T12:55:00Z"},{"value":"0.00343","scoring_system":"epss","scoring_elements":"0.57014","published_at":"2026-04-09T12:55:00Z"},{"value":"0.00343","scoring_system":"epss","scoring_elements":"0.57011","published_at":"2026-04-08T12:55:00Z"},{"value":"0.00353","scoring_system":"epss","scoring_elements":"0.57699","published_at":"2026-04-21T12:55:00Z"},{"value":"0.00353","scoring_system":"epss","scoring_elements":"0.57655","published_at":"2026-04-24T12:55:00Z"}],"url":"https://api.first.org/data/v1/epss?cve=CVE-2021-25287"},{"reference_url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-25287","reference_id":"","reference_type":"","scores":[],"url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-25287"},{"reference_url":"https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml","reference_id":"","reference_type":"","scores":[{"value":"8.2","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H"}],"url":"https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml"},{"reference_url":"https://github.com/advisories/GHSA-77gc-v2xv-rvvh","reference_id":"","reference_type":"","scores":[{"value":"9.1","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H"},{"value":"HIGH","scoring_system":"cvssv3.1_qr","scoring_elements":""},{"value":"8.8","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:H/SC:N/SI:N/SA:N"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/advisories/GHSA-77gc-v2xv-rvvh"},{"reference_url":"https://github.com/pypa/advisory-database/tree/main/vulns/pillow/PYSEC-2021-137.yaml","reference_id":"","reference_type":"","scores":[{"value":"9.1","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H"},{"value":"8.8","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:H/SC:N/SI:N/SA:N"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/pypa/advisory-database/tree/main/vulns/pillow/PYSEC-2021-137.yaml"},{"reference_url":"https://github.com/python-pillow/Pillow","reference_id":"","reference_type":"","scores":[{"value":"9.1","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H"},{"value":"8.8","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:H/SC:N/SI:N/SA:N"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/python-pillow/Pillow"},{"reference_url":"https://github.com/python-pillow/Pillow/commit/3bf5eddb89afdf690eceaa52bc4d3546ba9a5f87","reference_id":"","reference_type":"","scores":[{"value":"9.1","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H"},{"value":"8.8","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:H/SC:N/SI:N/SA:N"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/python-pillow/Pillow/commit/3bf5eddb89afdf690eceaa52bc4d3546ba9a5f87"},{"reference_url":"https://github.com/python-pillow/Pillow/pull/5377/commits/3bf5eddb89afdf690eceaa52bc4d3546ba9a5f87","reference_id":"","reference_type":"","scores":[{"value":"9.1","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H"},{"value":"8.8","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:H/SC:N/SI:N/SA:N"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/python-pillow/Pillow/pull/5377/commits/3bf5eddb89afdf690eceaa52bc4d3546ba9a5f87"},{"reference_url":"https://github.com/python-pillow/Pillow/pull/5377#issuecomment-833821470","reference_id":"","reference_type":"","scores":[{"value":"9.1","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H"},{"value":"8.8","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:H/SC:N/SI:N/SA:N"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/python-pillow/Pillow/pull/5377#issuecomment-833821470"},{"reference_url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/MQHA5HAIBOYI3R6HDWCLAGFTIQP767FL","reference_id":"","reference_type":"","scores":[{"value":"9.1","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H"},{"value":"8.8","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:H/SC:N/SI:N/SA:N"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/MQHA5HAIBOYI3R6HDWCLAGFTIQP767FL"},{"reference_url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/MQHA5HAIBOYI3R6HDWCLAGFTIQP767FL/","reference_id":"","reference_type":"","scores":[],"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/MQHA5HAIBOYI3R6HDWCLAGFTIQP767FL/"},{"reference_url":"https://nvd.nist.gov/vuln/detail/CVE-2021-25287","reference_id":"","reference_type":"","scores":[{"value":"9.1","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H"},{"value":"8.8","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:H/SC:N/SI:N/SA:N"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-25287"},{"reference_url":"https://pillow.readthedocs.io/en/stable/releasenotes/8.2.0.html#cve-2021-25287-cve-2021-25288-fix-oob-read-in-jpeg2kdecode","reference_id":"","reference_type":"","scores":[{"value":"9.1","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H"},{"value":"8.8","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:H/SC:N/SI:N/SA:N"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://pillow.readthedocs.io/en/stable/releasenotes/8.2.0.html#cve-2021-25287-cve-2021-25288-fix-oob-read-in-jpeg2kdecode"},{"reference_url":"https://security.gentoo.org/glsa/202107-33","reference_id":"","reference_type":"","scores":[{"value":"9.1","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H"},{"value":"8.8","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:H/SC:N/SI:N/SA:N"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://security.gentoo.org/glsa/202107-33"},{"reference_url":"https://bugzilla.redhat.com/show_bug.cgi?id=1958226","reference_id":"1958226","reference_type":"","scores":[],"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1958226"},{"reference_url":"https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=989062","reference_id":"989062","reference_type":"","scores":[],"url":"https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=989062"},{"reference_url":"https://access.redhat.com/errata/RHSA-2021:4149","reference_id":"RHSA-2021:4149","reference_type":"","scores":[],"url":"https://access.redhat.com/errata/RHSA-2021:4149"},{"reference_url":"https://usn.ubuntu.com/4963-1/","reference_id":"USN-4963-1","reference_type":"","scores":[],"url":"https://usn.ubuntu.com/4963-1/"},{"reference_url":"https://usn.ubuntu.com/8135-1/","reference_id":"USN-8135-1","reference_type":"","scores":[],"url":"https://usn.ubuntu.com/8135-1/"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/17188?format=json","purl":"pkg:pypi/pillow@8.2.0","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-19e1-19hk-duet"},{"vulnerability":"VCID-1vt7-c6e3-7qc8"},{"vulnerability":"VCID-5rv4-k1q9-zue2"},{"vulnerability":"VCID-64n5-pugj-vue8"},{"vulnerability":"VCID-9ckw-ra54-z3b7"},{"vulnerability":"VCID-brp2-dtrf-jyfr"},{"vulnerability":"VCID-d7uf-zdbv-sba1"},{"vulnerability":"VCID-df4x-jt3h-17hx"},{"vulnerability":"VCID-dpc3-td9q-dyee"},{"vulnerability":"VCID-g46h-p8jk-cuhc"},{"vulnerability":"VCID-n1hp-atex-ubh4"},{"vulnerability":"VCID-q4bb-qnxe-8bfa"},{"vulnerability":"VCID-vdzj-kqfy-d3b7"},{"vulnerability":"VCID-w9uy-fnpm-cbak"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:pypi/pillow@8.2.0"}],"aliases":["BIT-pillow-2021-25287","CVE-2021-25287","GHSA-77gc-v2xv-rvvh","PYSEC-2021-137"],"risk_score":4.1,"exploitability":"0.5","weighted_severity":"8.2","resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-n1w5-f5p7-xuhb"},{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/6291?format=json","vulnerability_id":"VCID-p6r3-puh1-zyg6","summary":"An issue was discovered in Pillow before 8.1.1. There is an out-of-bounds read in SGIRleDecode.c.","references":[{"reference_url":"https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2021-25293.json","reference_id":"","reference_type":"","scores":[{"value":"7.5","scoring_system":"cvssv3","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"url":"https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2021-25293.json"},{"reference_url":"https://api.first.org/data/v1/epss?cve=CVE-2021-25293","reference_id":"","reference_type":"","scores":[{"value":"0.001","scoring_system":"epss","scoring_elements":"0.27705","published_at":"2026-04-18T12:55:00Z"},{"value":"0.001","scoring_system":"epss","scoring_elements":"0.27731","published_at":"2026-04-16T12:55:00Z"},{"value":"0.001","scoring_system":"epss","scoring_elements":"0.27723","published_at":"2026-04-13T12:55:00Z"},{"value":"0.001","scoring_system":"epss","scoring_elements":"0.2778","published_at":"2026-04-12T12:55:00Z"},{"value":"0.001","scoring_system":"epss","scoring_elements":"0.27822","published_at":"2026-04-11T12:55:00Z"},{"value":"0.001","scoring_system":"epss","scoring_elements":"0.27816","published_at":"2026-04-09T12:55:00Z"},{"value":"0.001","scoring_system":"epss","scoring_elements":"0.27823","published_at":"2026-04-01T12:55:00Z"},{"value":"0.001","scoring_system":"epss","scoring_elements":"0.27773","published_at":"2026-04-08T12:55:00Z"},{"value":"0.001","scoring_system":"epss","scoring_elements":"0.27873","published_at":"2026-04-02T12:55:00Z"},{"value":"0.001","scoring_system":"epss","scoring_elements":"0.27913","published_at":"2026-04-04T12:55:00Z"},{"value":"0.00169","scoring_system":"epss","scoring_elements":"0.37573","published_at":"2026-05-05T12:55:00Z"},{"value":"0.00169","scoring_system":"epss","scoring_elements":"0.38018","published_at":"2026-04-21T12:55:00Z"},{"value":"0.00169","scoring_system":"epss","scoring_elements":"0.37803","published_at":"2026-04-24T12:55:00Z"},{"value":"0.00169","scoring_system":"epss","scoring_elements":"0.37781","published_at":"2026-04-26T12:55:00Z"},{"value":"0.00169","scoring_system":"epss","scoring_elements":"0.37686","published_at":"2026-04-29T12:55:00Z"}],"url":"https://api.first.org/data/v1/epss?cve=CVE-2021-25293"},{"reference_url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-25293","reference_id":"","reference_type":"","scores":[],"url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-25293"},{"reference_url":"https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml","reference_id":"","reference_type":"","scores":[{"value":"7.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"url":"https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml"},{"reference_url":"https://github.com/advisories/GHSA-p43w-g3c5-g5mq","reference_id":"","reference_type":"","scores":[{"value":"7.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"},{"value":"HIGH","scoring_system":"cvssv3.1_qr","scoring_elements":""},{"value":"8.7","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/advisories/GHSA-p43w-g3c5-g5mq"},{"reference_url":"https://github.com/pypa/advisory-database/tree/main/vulns/pillow/PYSEC-2021-39.yaml","reference_id":"","reference_type":"","scores":[{"value":"7.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"},{"value":"8.7","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/pypa/advisory-database/tree/main/vulns/pillow/PYSEC-2021-39.yaml"},{"reference_url":"https://github.com/python-pillow/Pillow","reference_id":"","reference_type":"","scores":[{"value":"7.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"},{"value":"8.7","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/python-pillow/Pillow"},{"reference_url":"https://github.com/python-pillow/Pillow/commit/4853e522bddbec66022c0915b9a56255d0188bf9","reference_id":"","reference_type":"","scores":[{"value":"7.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"},{"value":"8.7","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/python-pillow/Pillow/commit/4853e522bddbec66022c0915b9a56255d0188bf9"},{"reference_url":"https://github.com/python-pillow/Pillow/commit/f891baa604636cd2506a9360d170bc2cf4963cc5","reference_id":"","reference_type":"","scores":[{"value":"7.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"},{"value":"8.7","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/python-pillow/Pillow/commit/f891baa604636cd2506a9360d170bc2cf4963cc5"},{"reference_url":"https://nvd.nist.gov/vuln/detail/CVE-2021-25293","reference_id":"","reference_type":"","scores":[{"value":"7.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"},{"value":"8.7","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-25293"},{"reference_url":"https://pillow.readthedocs.io/en/stable/releasenotes/8.1.1.html","reference_id":"","reference_type":"","scores":[{"value":"7.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"},{"value":"8.7","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://pillow.readthedocs.io/en/stable/releasenotes/8.1.1.html"},{"reference_url":"https://security.gentoo.org/glsa/202107-33","reference_id":"","reference_type":"","scores":[{"value":"7.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"},{"value":"8.7","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://security.gentoo.org/glsa/202107-33"},{"reference_url":"https://bugzilla.redhat.com/show_bug.cgi?id=1934705","reference_id":"1934705","reference_type":"","scores":[],"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1934705"},{"reference_url":"https://security.archlinux.org/AVG-1635","reference_id":"AVG-1635","reference_type":"","scores":[{"value":"Medium","scoring_system":"archlinux","scoring_elements":""}],"url":"https://security.archlinux.org/AVG-1635"},{"reference_url":"https://access.redhat.com/errata/RHSA-2021:3917","reference_id":"RHSA-2021:3917","reference_type":"","scores":[],"url":"https://access.redhat.com/errata/RHSA-2021:3917"},{"reference_url":"https://access.redhat.com/errata/RHSA-2021:4149","reference_id":"RHSA-2021:4149","reference_type":"","scores":[],"url":"https://access.redhat.com/errata/RHSA-2021:4149"},{"reference_url":"https://usn.ubuntu.com/4763-1/","reference_id":"USN-4763-1","reference_type":"","scores":[],"url":"https://usn.ubuntu.com/4763-1/"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/15250?format=json","purl":"pkg:pypi/pillow@8.1.1","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-19e1-19hk-duet"},{"vulnerability":"VCID-1vt7-c6e3-7qc8"},{"vulnerability":"VCID-3qb5-8p8w-gkad"},{"vulnerability":"VCID-3uk9-eds5-rkgc"},{"vulnerability":"VCID-53ac-ceq4-qkhf"},{"vulnerability":"VCID-5rv4-k1q9-zue2"},{"vulnerability":"VCID-64n5-pugj-vue8"},{"vulnerability":"VCID-9ckw-ra54-z3b7"},{"vulnerability":"VCID-aubw-tsmn-ffcq"},{"vulnerability":"VCID-brp2-dtrf-jyfr"},{"vulnerability":"VCID-d7uf-zdbv-sba1"},{"vulnerability":"VCID-df4x-jt3h-17hx"},{"vulnerability":"VCID-dpc3-td9q-dyee"},{"vulnerability":"VCID-g46h-p8jk-cuhc"},{"vulnerability":"VCID-gvjw-funa-sqak"},{"vulnerability":"VCID-n1hp-atex-ubh4"},{"vulnerability":"VCID-n1w5-f5p7-xuhb"},{"vulnerability":"VCID-q4bb-qnxe-8bfa"},{"vulnerability":"VCID-ue18-zzau-x7hy"},{"vulnerability":"VCID-vdzj-kqfy-d3b7"},{"vulnerability":"VCID-vwbu-ruxm-tbh4"},{"vulnerability":"VCID-vyzt-df2u-h3cc"},{"vulnerability":"VCID-w9uy-fnpm-cbak"},{"vulnerability":"VCID-xesd-d294-7fcx"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:pypi/pillow@8.1.1"}],"aliases":["BIT-pillow-2021-25293","CVE-2021-25293","GHSA-p43w-g3c5-g5mq","PYSEC-2021-39"],"risk_score":4.0,"exploitability":"0.5","weighted_severity":"8.0","resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-p6r3-puh1-zyg6"},{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/5379?format=json","vulnerability_id":"VCID-ptk9-u246-q7gh","summary":"The (1) JpegImagePlugin.py and (2) EpsImagePlugin.py scripts in Python Image Library (PIL) 1.1.7 and earlier and Pillow before 2.3.1 uses the names of temporary files on the command line, which makes it easier for local users to conduct symlink attacks by listing the processes.","references":[{"reference_url":"http://lists.opensuse.org/opensuse-updates/2014-05/msg00002.html","reference_id":"","reference_type":"","scores":[{"value":"4.0","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"},{"value":"5.1","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"http://lists.opensuse.org/opensuse-updates/2014-05/msg00002.html"},{"reference_url":"https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2014-1933.json","reference_id":"","reference_type":"","scores":[],"url":"https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2014-1933.json"},{"reference_url":"https://api.first.org/data/v1/epss?cve=CVE-2014-1933","reference_id":"","reference_type":"","scores":[{"value":"0.00111","scoring_system":"epss","scoring_elements":"0.29177","published_at":"2026-04-26T12:55:00Z"},{"value":"0.00111","scoring_system":"epss","scoring_elements":"0.29289","published_at":"2026-04-24T12:55:00Z"},{"value":"0.00111","scoring_system":"epss","scoring_elements":"0.29405","published_at":"2026-04-21T12:55:00Z"},{"value":"0.00111","scoring_system":"epss","scoring_elements":"0.29515","published_at":"2026-04-08T12:55:00Z"},{"value":"0.00111","scoring_system":"epss","scoring_elements":"0.28963","published_at":"2026-05-05T12:55:00Z"},{"value":"0.00111","scoring_system":"epss","scoring_elements":"0.2911","published_at":"2026-04-29T12:55:00Z"},{"value":"0.00111","scoring_system":"epss","scoring_elements":"0.29479","published_at":"2026-04-16T12:55:00Z"},{"value":"0.00111","scoring_system":"epss","scoring_elements":"0.2946","published_at":"2026-04-13T12:55:00Z"},{"value":"0.00111","scoring_system":"epss","scoring_elements":"0.29512","published_at":"2026-04-12T12:55:00Z"},{"value":"0.00111","scoring_system":"epss","scoring_elements":"0.29557","published_at":"2026-04-11T12:55:00Z"},{"value":"0.00111","scoring_system":"epss","scoring_elements":"0.29555","published_at":"2026-04-09T12:55:00Z"},{"value":"0.00111","scoring_system":"epss","scoring_elements":"0.29452","published_at":"2026-04-07T12:55:00Z"},{"value":"0.00111","scoring_system":"epss","scoring_elements":"0.29631","published_at":"2026-04-04T12:55:00Z"},{"value":"0.00111","scoring_system":"epss","scoring_elements":"0.29582","published_at":"2026-04-02T12:55:00Z"},{"value":"0.00111","scoring_system":"epss","scoring_elements":"0.29451","published_at":"2026-04-18T12:55:00Z"}],"url":"https://api.first.org/data/v1/epss?cve=CVE-2014-1933"},{"reference_url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-1933","reference_id":"","reference_type":"","scores":[],"url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-1933"},{"reference_url":"https://github.com/advisories/GHSA-r854-96gq-rfg3","reference_id":"","reference_type":"","scores":[{"value":"MODERATE","scoring_system":"cvssv3.1_qr","scoring_elements":""}],"url":"https://github.com/advisories/GHSA-r854-96gq-rfg3"},{"reference_url":"https://github.com/pypa/advisory-database/tree/main/vulns/pillow/PYSEC-2014-23.yaml","reference_id":"","reference_type":"","scores":[{"value":"4.0","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"},{"value":"5.1","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/pypa/advisory-database/tree/main/vulns/pillow/PYSEC-2014-23.yaml"},{"reference_url":"https://github.com/python-imaging/Pillow","reference_id":"","reference_type":"","scores":[{"value":"4.0","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"},{"value":"5.1","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/python-imaging/Pillow"},{"reference_url":"https://github.com/python-imaging/Pillow/commit/4e9f367dfd3f04c8f5d23f7f759ec12782e10ee7","reference_id":"","reference_type":"","scores":[{"value":"4.0","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"},{"value":"5.1","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/python-imaging/Pillow/commit/4e9f367dfd3f04c8f5d23f7f759ec12782e10ee7"},{"reference_url":"https://nvd.nist.gov/vuln/detail/CVE-2014-1933","reference_id":"","reference_type":"","scores":[{"value":"4.0","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"},{"value":"5.1","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://nvd.nist.gov/vuln/detail/CVE-2014-1933"},{"reference_url":"https://security.gentoo.org/glsa/201612-52","reference_id":"","reference_type":"","scores":[{"value":"4.0","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"},{"value":"5.1","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://security.gentoo.org/glsa/201612-52"},{"reference_url":"http://www.openwall.com/lists/oss-security/2014/02/10/15","reference_id":"","reference_type":"","scores":[{"value":"4.0","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"},{"value":"5.1","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"http://www.openwall.com/lists/oss-security/2014/02/10/15"},{"reference_url":"http://www.openwall.com/lists/oss-security/2014/02/11/1","reference_id":"","reference_type":"","scores":[{"value":"4.0","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"},{"value":"5.1","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"http://www.openwall.com/lists/oss-security/2014/02/11/1"},{"reference_url":"http://www.securityfocus.com/bid/65513","reference_id":"","reference_type":"","scores":[],"url":"http://www.securityfocus.com/bid/65513"},{"reference_url":"http://www.ubuntu.com/usn/USN-2168-1","reference_id":"","reference_type":"","scores":[{"value":"4.0","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"},{"value":"5.1","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"http://www.ubuntu.com/usn/USN-2168-1"},{"reference_url":"https://bugzilla.redhat.com/show_bug.cgi?id=1063660","reference_id":"1063660","reference_type":"","scores":[],"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1063660"},{"reference_url":"https://usn.ubuntu.com/2168-1/","reference_id":"USN-2168-1","reference_type":"","scores":[],"url":"https://usn.ubuntu.com/2168-1/"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/3048?format=json","purl":"pkg:pypi/pillow@2.3.1","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-19e1-19hk-duet"},{"vulnerability":"VCID-1vt7-c6e3-7qc8"},{"vulnerability":"VCID-366h-8f99-r7at"},{"vulnerability":"VCID-3qb5-8p8w-gkad"},{"vulnerability":"VCID-3uk9-eds5-rkgc"},{"vulnerability":"VCID-53ac-ceq4-qkhf"},{"vulnerability":"VCID-5rv4-k1q9-zue2"},{"vulnerability":"VCID-64n5-pugj-vue8"},{"vulnerability":"VCID-6gyu-fzpg-c3bn"},{"vulnerability":"VCID-8n2b-wvya-53e1"},{"vulnerability":"VCID-9ckw-ra54-z3b7"},{"vulnerability":"VCID-and9-6jty-pyeq"},{"vulnerability":"VCID-aubw-tsmn-ffcq"},{"vulnerability":"VCID-avx2-mahw-mqes"},{"vulnerability":"VCID-b3au-rcgp-2fag"},{"vulnerability":"VCID-b5a2-83ej-puaw"},{"vulnerability":"VCID-brp2-dtrf-jyfr"},{"vulnerability":"VCID-cas2-jb3y-vyhz"},{"vulnerability":"VCID-d7uf-zdbv-sba1"},{"vulnerability":"VCID-df4x-jt3h-17hx"},{"vulnerability":"VCID-dgds-v95g-pbcv"},{"vulnerability":"VCID-dpc3-td9q-dyee"},{"vulnerability":"VCID-e3gp-zc2b-budg"},{"vulnerability":"VCID-en6t-uxtq-bfek"},{"vulnerability":"VCID-g46h-p8jk-cuhc"},{"vulnerability":"VCID-gmd5-pbxc-a3gd"},{"vulnerability":"VCID-gvjw-funa-sqak"},{"vulnerability":"VCID-h4x7-7fke-mqgp"},{"vulnerability":"VCID-haum-8zpg-6kgf"},{"vulnerability":"VCID-hmmq-5772-bycm"},{"vulnerability":"VCID-khp6-9hfx-1kge"},{"vulnerability":"VCID-m3tm-h4q9-9yay"},{"vulnerability":"VCID-ma2g-2f8d-dqa9"},{"vulnerability":"VCID-n1hp-atex-ubh4"},{"vulnerability":"VCID-n1w5-f5p7-xuhb"},{"vulnerability":"VCID-p6r3-puh1-zyg6"},{"vulnerability":"VCID-q4bb-qnxe-8bfa"},{"vulnerability":"VCID-qjqr-jyjn-xfh9"},{"vulnerability":"VCID-rncf-9nf8-wud3"},{"vulnerability":"VCID-sns1-ksqr-vbhr"},{"vulnerability":"VCID-stft-hsk9-zfdy"},{"vulnerability":"VCID-u1en-t8ux-uube"},{"vulnerability":"VCID-ue18-zzau-x7hy"},{"vulnerability":"VCID-uf5t-asns-tudp"},{"vulnerability":"VCID-vdzj-kqfy-d3b7"},{"vulnerability":"VCID-vwbu-ruxm-tbh4"},{"vulnerability":"VCID-vxh1-8rvt-kkak"},{"vulnerability":"VCID-vyzt-df2u-h3cc"},{"vulnerability":"VCID-vz9s-jqpb-2ybf"},{"vulnerability":"VCID-w9uy-fnpm-cbak"},{"vulnerability":"VCID-x15z-dejc-9ba6"},{"vulnerability":"VCID-xesd-d294-7fcx"},{"vulnerability":"VCID-xk66-1d31-2qbk"},{"vulnerability":"VCID-zmd3-henq-r7bd"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:pypi/pillow@2.3.1"}],"aliases":["CVE-2014-1933","GHSA-r854-96gq-rfg3","PYSEC-2014-23"],"risk_score":3.1,"exploitability":"0.5","weighted_severity":"6.2","resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-ptk9-u246-q7gh"},{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/7536?format=json","vulnerability_id":"VCID-q4bb-qnxe-8bfa","summary":"PIL.ImageMath.eval in Pillow before 9.0.0 allows evaluation of arbitrary expressions, such as ones that use the Python exec method.","references":[{"reference_url":"https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2022-22817.json","reference_id":"","reference_type":"","scores":[{"value":"9.8","scoring_system":"cvssv3","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"}],"url":"https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2022-22817.json"},{"reference_url":"https://api.first.org/data/v1/epss?cve=CVE-2022-22817","reference_id":"","reference_type":"","scores":[{"value":"0.02781","scoring_system":"epss","scoring_elements":"0.86128","published_at":"2026-05-05T12:55:00Z"},{"value":"0.02781","scoring_system":"epss","scoring_elements":"0.86109","published_at":"2026-04-29T12:55:00Z"},{"value":"0.02781","scoring_system":"epss","scoring_elements":"0.86099","published_at":"2026-04-24T12:55:00Z"},{"value":"0.02781","scoring_system":"epss","scoring_elements":"0.86079","published_at":"2026-04-21T12:55:00Z"},{"value":"0.02781","scoring_system":"epss","scoring_elements":"0.86086","published_at":"2026-04-18T12:55:00Z"},{"value":"0.02781","scoring_system":"epss","scoring_elements":"0.86081","published_at":"2026-04-16T12:55:00Z"},{"value":"0.02781","scoring_system":"epss","scoring_elements":"0.86064","published_at":"2026-04-13T12:55:00Z"},{"value":"0.02781","scoring_system":"epss","scoring_elements":"0.86068","published_at":"2026-04-12T12:55:00Z"},{"value":"0.02781","scoring_system":"epss","scoring_elements":"0.86071","published_at":"2026-04-11T12:55:00Z"},{"value":"0.02781","scoring_system":"epss","scoring_elements":"0.86057","published_at":"2026-04-09T12:55:00Z"},{"value":"0.02781","scoring_system":"epss","scoring_elements":"0.86027","published_at":"2026-04-07T12:55:00Z"},{"value":"0.02781","scoring_system":"epss","scoring_elements":"0.86047","published_at":"2026-04-08T12:55:00Z"},{"value":"0.02781","scoring_system":"epss","scoring_elements":"0.86011","published_at":"2026-04-02T12:55:00Z"},{"value":"0.02781","scoring_system":"epss","scoring_elements":"0.86028","published_at":"2026-04-04T12:55:00Z"}],"url":"https://api.first.org/data/v1/epss?cve=CVE-2022-22817"},{"reference_url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-22815","reference_id":"","reference_type":"","scores":[],"url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-22815"},{"reference_url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-22816","reference_id":"","reference_type":"","scores":[],"url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-22816"},{"reference_url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-22817","reference_id":"","reference_type":"","scores":[],"url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-22817"},{"reference_url":"https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml","reference_id":"","reference_type":"","scores":[{"value":"4.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:L"}],"url":"https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml"},{"reference_url":"https://github.com/advisories/GHSA-8vj2-vxx3-667w","reference_id":"","reference_type":"","scores":[{"value":"9.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},{"value":"CRITICAL","scoring_system":"cvssv3.1_qr","scoring_elements":""},{"value":"9.3","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N"},{"value":"CRITICAL","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/advisories/GHSA-8vj2-vxx3-667w"},{"reference_url":"https://github.com/pypa/advisory-database/tree/main/vulns/pillow/PYSEC-2022-10.yaml","reference_id":"","reference_type":"","scores":[{"value":"9.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},{"value":"9.3","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N"},{"value":"CRITICAL","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/pypa/advisory-database/tree/main/vulns/pillow/PYSEC-2022-10.yaml"},{"reference_url":"https://github.com/python-pillow/Pillow","reference_id":"","reference_type":"","scores":[{"value":"9.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},{"value":"9.3","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N"},{"value":"CRITICAL","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/python-pillow/Pillow"},{"reference_url":"https://github.com/python-pillow/Pillow/commit/8531b01d6cdf0b70f256f93092caa2a5d91afc11","reference_id":"","reference_type":"","scores":[{"value":"9.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},{"value":"9.3","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N"},{"value":"CRITICAL","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/python-pillow/Pillow/commit/8531b01d6cdf0b70f256f93092caa2a5d91afc11"},{"reference_url":"https://lists.debian.org/debian-lts-announce/2022/01/msg00018.html","reference_id":"","reference_type":"","scores":[{"value":"9.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},{"value":"9.3","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N"},{"value":"CRITICAL","scoring_system":"generic_textual","scoring_elements":""},{"value":"Track","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:N/A:Y/T:T/P:M/B:A/M:M/D:T/2024-10-15T17:36:26Z/"}],"url":"https://lists.debian.org/debian-lts-announce/2022/01/msg00018.html"},{"reference_url":"https://lists.debian.org/debian-lts-announce/2024/03/msg00021.html","reference_id":"","reference_type":"","scores":[{"value":"9.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},{"value":"9.3","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N"},{"value":"CRITICAL","scoring_system":"generic_textual","scoring_elements":""},{"value":"Track","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:N/A:Y/T:T/P:M/B:A/M:M/D:T/2024-10-15T17:36:26Z/"}],"url":"https://lists.debian.org/debian-lts-announce/2024/03/msg00021.html"},{"reference_url":"https://pillow.readthedocs.io/en/stable/releasenotes/9.0.0.html#restrict-builtins-available-to-imagemath-eval","reference_id":"","reference_type":"","scores":[{"value":"9.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},{"value":"9.3","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N"},{"value":"CRITICAL","scoring_system":"generic_textual","scoring_elements":""},{"value":"Track","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:N/A:Y/T:T/P:M/B:A/M:M/D:T/2024-10-15T17:36:26Z/"}],"url":"https://pillow.readthedocs.io/en/stable/releasenotes/9.0.0.html#restrict-builtins-available-to-imagemath-eval"},{"reference_url":"https://pillow.readthedocs.io/en/stable/releasenotes/9.0.1.html#security","reference_id":"","reference_type":"","scores":[{"value":"9.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},{"value":"9.3","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N"},{"value":"CRITICAL","scoring_system":"generic_textual","scoring_elements":""},{"value":"Track","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:N/A:Y/T:T/P:M/B:A/M:M/D:T/2024-10-15T17:36:26Z/"}],"url":"https://pillow.readthedocs.io/en/stable/releasenotes/9.0.1.html#security"},{"reference_url":"https://security.gentoo.org/glsa/202211-10","reference_id":"","reference_type":"","scores":[{"value":"9.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},{"value":"9.3","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N"},{"value":"CRITICAL","scoring_system":"generic_textual","scoring_elements":""},{"value":"Track","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:N/A:Y/T:T/P:M/B:A/M:M/D:T/2024-10-15T17:36:26Z/"}],"url":"https://security.gentoo.org/glsa/202211-10"},{"reference_url":"https://www.debian.org/security/2022/dsa-5053","reference_id":"","reference_type":"","scores":[{"value":"9.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},{"value":"9.3","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N"},{"value":"CRITICAL","scoring_system":"generic_textual","scoring_elements":""},{"value":"Track","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:N/A:Y/T:T/P:M/B:A/M:M/D:T/2024-10-15T17:36:26Z/"}],"url":"https://www.debian.org/security/2022/dsa-5053"},{"reference_url":"https://bugzilla.redhat.com/show_bug.cgi?id=2042527","reference_id":"2042527","reference_type":"","scores":[],"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2042527"},{"reference_url":"https://nvd.nist.gov/vuln/detail/CVE-2022-22817","reference_id":"CVE-2022-22817","reference_type":"","scores":[{"value":"9.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},{"value":"9.3","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N"},{"value":"CRITICAL","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-22817"},{"reference_url":"https://access.redhat.com/errata/RHSA-2022:0609","reference_id":"RHSA-2022:0609","reference_type":"","scores":[],"url":"https://access.redhat.com/errata/RHSA-2022:0609"},{"reference_url":"https://access.redhat.com/errata/RHSA-2022:0643","reference_id":"RHSA-2022:0643","reference_type":"","scores":[],"url":"https://access.redhat.com/errata/RHSA-2022:0643"},{"reference_url":"https://access.redhat.com/errata/RHSA-2022:0665","reference_id":"RHSA-2022:0665","reference_type":"","scores":[],"url":"https://access.redhat.com/errata/RHSA-2022:0665"},{"reference_url":"https://access.redhat.com/errata/RHSA-2022:0667","reference_id":"RHSA-2022:0667","reference_type":"","scores":[],"url":"https://access.redhat.com/errata/RHSA-2022:0667"},{"reference_url":"https://access.redhat.com/errata/RHSA-2022:0669","reference_id":"RHSA-2022:0669","reference_type":"","scores":[],"url":"https://access.redhat.com/errata/RHSA-2022:0669"},{"reference_url":"https://usn.ubuntu.com/5227-1/","reference_id":"USN-5227-1","reference_type":"","scores":[],"url":"https://usn.ubuntu.com/5227-1/"},{"reference_url":"https://usn.ubuntu.com/5227-2/","reference_id":"USN-5227-2","reference_type":"","scores":[],"url":"https://usn.ubuntu.com/5227-2/"},{"reference_url":"https://usn.ubuntu.com/5227-3/","reference_id":"USN-5227-3","reference_type":"","scores":[],"url":"https://usn.ubuntu.com/5227-3/"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/23250?format=json","purl":"pkg:pypi/pillow@9.0.0","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-19e1-19hk-duet"},{"vulnerability":"VCID-5rv4-k1q9-zue2"},{"vulnerability":"VCID-64n5-pugj-vue8"},{"vulnerability":"VCID-9ckw-ra54-z3b7"},{"vulnerability":"VCID-brp2-dtrf-jyfr"},{"vulnerability":"VCID-d7uf-zdbv-sba1"},{"vulnerability":"VCID-n1hp-atex-ubh4"},{"vulnerability":"VCID-q4bb-qnxe-8bfa"},{"vulnerability":"VCID-vdzj-kqfy-d3b7"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:pypi/pillow@9.0.0"},{"url":"http://public2.vulnerablecode.io/api/packages/26287?format=json","purl":"pkg:pypi/pillow@9.0.1","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-19e1-19hk-duet"},{"vulnerability":"VCID-5rv4-k1q9-zue2"},{"vulnerability":"VCID-64n5-pugj-vue8"},{"vulnerability":"VCID-9ckw-ra54-z3b7"},{"vulnerability":"VCID-d7uf-zdbv-sba1"},{"vulnerability":"VCID-n1hp-atex-ubh4"},{"vulnerability":"VCID-vdzj-kqfy-d3b7"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:pypi/pillow@9.0.1"}],"aliases":["BIT-pillow-2022-22817","CVE-2022-22817","GHSA-8vj2-vxx3-667w","PYSEC-2022-10"],"risk_score":4.5,"exploitability":"0.5","weighted_severity":"9.0","resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-q4bb-qnxe-8bfa"},{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/5458?format=json","vulnerability_id":"VCID-qjqr-jyjn-xfh9","summary":"Pillow before 2.7.0 allows remote attackers to cause a denial of service via a compressed text chunk in a PNG image that has a large size when it is decompressed.","references":[{"reference_url":"http://lists.fedoraproject.org/pipermail/package-announce/2015-January/148442.html","reference_id":"","reference_type":"","scores":[{"value":"7.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"},{"value":"8.7","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"http://lists.fedoraproject.org/pipermail/package-announce/2015-January/148442.html"},{"reference_url":"http://lists.opensuse.org/opensuse-updates/2015-04/msg00056.html","reference_id":"","reference_type":"","scores":[{"value":"7.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"},{"value":"8.7","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"http://lists.opensuse.org/opensuse-updates/2015-04/msg00056.html"},{"reference_url":"http://pillow.readthedocs.org/releasenotes/2.7.0.html","reference_id":"","reference_type":"","scores":[{"value":"7.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"},{"value":"8.7","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"http://pillow.readthedocs.org/releasenotes/2.7.0.html"},{"reference_url":"https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2014-9601.json","reference_id":"","reference_type":"","scores":[],"url":"https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2014-9601.json"},{"reference_url":"https://api.first.org/data/v1/epss?cve=CVE-2014-9601","reference_id":"","reference_type":"","scores":[{"value":"0.01034","scoring_system":"epss","scoring_elements":"0.7743","published_at":"2026-04-24T12:55:00Z"},{"value":"0.01034","scoring_system":"epss","scoring_elements":"0.77396","published_at":"2026-04-21T12:55:00Z"},{"value":"0.01034","scoring_system":"epss","scoring_elements":"0.77404","published_at":"2026-04-18T12:55:00Z"},{"value":"0.01034","scoring_system":"epss","scoring_elements":"0.77436","published_at":"2026-04-26T12:55:00Z"},{"value":"0.01034","scoring_system":"epss","scoring_elements":"0.77449","published_at":"2026-04-29T12:55:00Z"},{"value":"0.01034","scoring_system":"epss","scoring_elements":"0.77457","published_at":"2026-05-05T12:55:00Z"},{"value":"0.01207","scoring_system":"epss","scoring_elements":"0.78924","published_at":"2026-04-02T12:55:00Z"},{"value":"0.01207","scoring_system":"epss","scoring_elements":"0.78965","published_at":"2026-04-13T12:55:00Z"},{"value":"0.01207","scoring_system":"epss","scoring_elements":"0.78975","published_at":"2026-04-12T12:55:00Z"},{"value":"0.01207","scoring_system":"epss","scoring_elements":"0.7899","published_at":"2026-04-11T12:55:00Z"},{"value":"0.01207","scoring_system":"epss","scoring_elements":"0.78966","published_at":"2026-04-09T12:55:00Z"},{"value":"0.01207","scoring_system":"epss","scoring_elements":"0.7896","published_at":"2026-04-08T12:55:00Z"},{"value":"0.01207","scoring_system":"epss","scoring_elements":"0.78936","published_at":"2026-04-07T12:55:00Z"},{"value":"0.01207","scoring_system":"epss","scoring_elements":"0.78952","published_at":"2026-04-04T12:55:00Z"},{"value":"0.01207","scoring_system":"epss","scoring_elements":"0.78918","published_at":"2026-04-01T12:55:00Z"}],"url":"https://api.first.org/data/v1/epss?cve=CVE-2014-9601"},{"reference_url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-9601","reference_id":"","reference_type":"","scores":[],"url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-9601"},{"reference_url":"https://github.com/pypa/advisory-database/tree/main/vulns/pillow/PYSEC-2015-16.yaml","reference_id":"","reference_type":"","scores":[{"value":"7.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"},{"value":"8.7","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/pypa/advisory-database/tree/main/vulns/pillow/PYSEC-2015-16.yaml"},{"reference_url":"https://github.com/python-pillow/Pillow","reference_id":"","reference_type":"","scores":[{"value":"7.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"},{"value":"8.7","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/python-pillow/Pillow"},{"reference_url":"https://github.com/python-pillow/Pillow/pull/1060","reference_id":"","reference_type":"","scores":[{"value":"7.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"},{"value":"8.7","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/python-pillow/Pillow/pull/1060"},{"reference_url":"https://web.archive.org/web/20200227221255/http://www.securityfocus.com/bid/77758","reference_id":"","reference_type":"","scores":[{"value":"7.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"},{"value":"8.7","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://web.archive.org/web/20200227221255/http://www.securityfocus.com/bid/77758"},{"reference_url":"https://www.djangoproject.com/weblog/2015/jan/02/pillow-security-release","reference_id":"","reference_type":"","scores":[{"value":"7.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"},{"value":"8.7","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://www.djangoproject.com/weblog/2015/jan/02/pillow-security-release"},{"reference_url":"https://www.djangoproject.com/weblog/2015/jan/02/pillow-security-release/","reference_id":"","reference_type":"","scores":[],"url":"https://www.djangoproject.com/weblog/2015/jan/02/pillow-security-release/"},{"reference_url":"http://www.oracle.com/technetwork/topics/security/bulletinjul2015-2511963.html","reference_id":"","reference_type":"","scores":[{"value":"7.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"},{"value":"8.7","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"http://www.oracle.com/technetwork/topics/security/bulletinjul2015-2511963.html"},{"reference_url":"http://www.securityfocus.com/bid/77758","reference_id":"","reference_type":"","scores":[],"url":"http://www.securityfocus.com/bid/77758"},{"reference_url":"https://bugzilla.redhat.com/show_bug.cgi?id=1179354","reference_id":"1179354","reference_type":"","scores":[],"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1179354"},{"reference_url":"https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=776303","reference_id":"776303","reference_type":"","scores":[],"url":"https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=776303"},{"reference_url":"https://nvd.nist.gov/vuln/detail/CVE-2014-9601","reference_id":"CVE-2014-9601","reference_type":"","scores":[{"value":"7.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"},{"value":"8.7","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://nvd.nist.gov/vuln/detail/CVE-2014-9601"},{"reference_url":"https://github.com/advisories/GHSA-h5rf-vgqx-wjv2","reference_id":"GHSA-h5rf-vgqx-wjv2","reference_type":"","scores":[{"value":"HIGH","scoring_system":"cvssv3.1_qr","scoring_elements":""}],"url":"https://github.com/advisories/GHSA-h5rf-vgqx-wjv2"},{"reference_url":"https://usn.ubuntu.com/3090-1/","reference_id":"USN-3090-1","reference_type":"","scores":[],"url":"https://usn.ubuntu.com/3090-1/"},{"reference_url":"https://usn.ubuntu.com/3090-2/","reference_id":"USN-3090-2","reference_type":"","scores":[],"url":"https://usn.ubuntu.com/3090-2/"},{"reference_url":"https://usn.ubuntu.com/3229-1/","reference_id":"USN-3229-1","reference_type":"","scores":[],"url":"https://usn.ubuntu.com/3229-1/"},{"reference_url":"https://usn.ubuntu.com/3230-1/","reference_id":"USN-3230-1","reference_type":"","scores":[],"url":"https://usn.ubuntu.com/3230-1/"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/3790?format=json","purl":"pkg:pypi/pillow@2.7.0","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-19e1-19hk-duet"},{"vulnerability":"VCID-1vt7-c6e3-7qc8"},{"vulnerability":"VCID-366h-8f99-r7at"},{"vulnerability":"VCID-3qb5-8p8w-gkad"},{"vulnerability":"VCID-3uk9-eds5-rkgc"},{"vulnerability":"VCID-53ac-ceq4-qkhf"},{"vulnerability":"VCID-5rv4-k1q9-zue2"},{"vulnerability":"VCID-64n5-pugj-vue8"},{"vulnerability":"VCID-6gyu-fzpg-c3bn"},{"vulnerability":"VCID-8n2b-wvya-53e1"},{"vulnerability":"VCID-9ckw-ra54-z3b7"},{"vulnerability":"VCID-and9-6jty-pyeq"},{"vulnerability":"VCID-aubw-tsmn-ffcq"},{"vulnerability":"VCID-avx2-mahw-mqes"},{"vulnerability":"VCID-b3au-rcgp-2fag"},{"vulnerability":"VCID-b5a2-83ej-puaw"},{"vulnerability":"VCID-brp2-dtrf-jyfr"},{"vulnerability":"VCID-cas2-jb3y-vyhz"},{"vulnerability":"VCID-d7uf-zdbv-sba1"},{"vulnerability":"VCID-df4x-jt3h-17hx"},{"vulnerability":"VCID-dgds-v95g-pbcv"},{"vulnerability":"VCID-dpc3-td9q-dyee"},{"vulnerability":"VCID-e3gp-zc2b-budg"},{"vulnerability":"VCID-en6t-uxtq-bfek"},{"vulnerability":"VCID-g46h-p8jk-cuhc"},{"vulnerability":"VCID-gvjw-funa-sqak"},{"vulnerability":"VCID-h4x7-7fke-mqgp"},{"vulnerability":"VCID-haum-8zpg-6kgf"},{"vulnerability":"VCID-hmmq-5772-bycm"},{"vulnerability":"VCID-khp6-9hfx-1kge"},{"vulnerability":"VCID-m3tm-h4q9-9yay"},{"vulnerability":"VCID-n1hp-atex-ubh4"},{"vulnerability":"VCID-n1w5-f5p7-xuhb"},{"vulnerability":"VCID-p6r3-puh1-zyg6"},{"vulnerability":"VCID-q4bb-qnxe-8bfa"},{"vulnerability":"VCID-rncf-9nf8-wud3"},{"vulnerability":"VCID-sns1-ksqr-vbhr"},{"vulnerability":"VCID-stft-hsk9-zfdy"},{"vulnerability":"VCID-u1en-t8ux-uube"},{"vulnerability":"VCID-ue18-zzau-x7hy"},{"vulnerability":"VCID-uf5t-asns-tudp"},{"vulnerability":"VCID-vdzj-kqfy-d3b7"},{"vulnerability":"VCID-vwbu-ruxm-tbh4"},{"vulnerability":"VCID-vxh1-8rvt-kkak"},{"vulnerability":"VCID-vyzt-df2u-h3cc"},{"vulnerability":"VCID-w9uy-fnpm-cbak"},{"vulnerability":"VCID-x15z-dejc-9ba6"},{"vulnerability":"VCID-xesd-d294-7fcx"},{"vulnerability":"VCID-xk66-1d31-2qbk"},{"vulnerability":"VCID-yccg-zw89-vqff"},{"vulnerability":"VCID-zmd3-henq-r7bd"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:pypi/pillow@2.7.0"}],"aliases":["CVE-2014-9601","GHSA-h5rf-vgqx-wjv2","PYSEC-2015-16"],"risk_score":4.0,"exploitability":"0.5","weighted_severity":"8.0","resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-qjqr-jyjn-xfh9"},{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/6295?format=json","vulnerability_id":"VCID-rncf-9nf8-wud3","summary":"An issue was discovered in Pillow before 8.1.1. In TiffDecode.c, there is a negative-offset memcpy with an invalid size.","references":[{"reference_url":"https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2021-25290.json","reference_id":"","reference_type":"","scores":[{"value":"7.5","scoring_system":"cvssv3","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"url":"https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2021-25290.json"},{"reference_url":"https://api.first.org/data/v1/epss?cve=CVE-2021-25290","reference_id":"","reference_type":"","scores":[{"value":"0.00143","scoring_system":"epss","scoring_elements":"0.34335","published_at":"2026-04-01T12:55:00Z"},{"value":"0.00143","scoring_system":"epss","scoring_elements":"0.34621","published_at":"2026-04-11T12:55:00Z"},{"value":"0.00143","scoring_system":"epss","scoring_elements":"0.3462","published_at":"2026-04-09T12:55:00Z"},{"value":"0.00143","scoring_system":"epss","scoring_elements":"0.34591","published_at":"2026-04-08T12:55:00Z"},{"value":"0.00143","scoring_system":"epss","scoring_elements":"0.34548","published_at":"2026-04-07T12:55:00Z"},{"value":"0.00143","scoring_system":"epss","scoring_elements":"0.34679","published_at":"2026-04-04T12:55:00Z"},{"value":"0.00143","scoring_system":"epss","scoring_elements":"0.34653","published_at":"2026-04-02T12:55:00Z"},{"value":"0.00143","scoring_system":"epss","scoring_elements":"0.34596","published_at":"2026-04-16T12:55:00Z"},{"value":"0.00143","scoring_system":"epss","scoring_elements":"0.34558","published_at":"2026-04-13T12:55:00Z"},{"value":"0.00143","scoring_system":"epss","scoring_elements":"0.34582","published_at":"2026-04-18T12:55:00Z"},{"value":"0.0024","scoring_system":"epss","scoring_elements":"0.4723","published_at":"2026-04-29T12:55:00Z"},{"value":"0.0024","scoring_system":"epss","scoring_elements":"0.47283","published_at":"2026-04-26T12:55:00Z"},{"value":"0.0024","scoring_system":"epss","scoring_elements":"0.47273","published_at":"2026-04-24T12:55:00Z"},{"value":"0.0024","scoring_system":"epss","scoring_elements":"0.47146","published_at":"2026-05-05T12:55:00Z"},{"value":"0.00247","scoring_system":"epss","scoring_elements":"0.47959","published_at":"2026-04-21T12:55:00Z"}],"url":"https://api.first.org/data/v1/epss?cve=CVE-2021-25290"},{"reference_url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-25290","reference_id":"","reference_type":"","scores":[],"url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-25290"},{"reference_url":"https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml","reference_id":"","reference_type":"","scores":[{"value":"7.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"url":"https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml"},{"reference_url":"https://github.com/advisories/GHSA-8xjq-8fcg-g5hw","reference_id":"","reference_type":"","scores":[{"value":"7.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"},{"value":"HIGH","scoring_system":"cvssv3.1_qr","scoring_elements":""},{"value":"8.7","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/advisories/GHSA-8xjq-8fcg-g5hw"},{"reference_url":"https://github.com/pypa/advisory-database/tree/main/vulns/pillow/PYSEC-2021-36.yaml","reference_id":"","reference_type":"","scores":[{"value":"7.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"},{"value":"8.7","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/pypa/advisory-database/tree/main/vulns/pillow/PYSEC-2021-36.yaml"},{"reference_url":"https://github.com/python-pillow/Pillow","reference_id":"","reference_type":"","scores":[{"value":"7.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"},{"value":"8.7","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/python-pillow/Pillow"},{"reference_url":"https://github.com/python-pillow/Pillow/commit/86f02f7c70862a0954bfe8133736d352db978eaa","reference_id":"","reference_type":"","scores":[{"value":"7.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"},{"value":"8.7","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/python-pillow/Pillow/commit/86f02f7c70862a0954bfe8133736d352db978eaa"},{"reference_url":"https://github.com/python-pillow/Pillow/commit/e25be1e33dc526bfd1094bc778a54d8e29bf66c9","reference_id":"","reference_type":"","scores":[{"value":"7.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"},{"value":"8.7","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/python-pillow/Pillow/commit/e25be1e33dc526bfd1094bc778a54d8e29bf66c9"},{"reference_url":"https://lists.debian.org/debian-lts-announce/2021/07/msg00018.html","reference_id":"","reference_type":"","scores":[{"value":"7.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"},{"value":"8.7","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://lists.debian.org/debian-lts-announce/2021/07/msg00018.html"},{"reference_url":"https://nvd.nist.gov/vuln/detail/CVE-2021-25290","reference_id":"","reference_type":"","scores":[{"value":"7.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"},{"value":"8.7","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-25290"},{"reference_url":"https://pillow.readthedocs.io/en/stable/releasenotes/8.1.1.html","reference_id":"","reference_type":"","scores":[{"value":"7.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"},{"value":"8.7","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://pillow.readthedocs.io/en/stable/releasenotes/8.1.1.html"},{"reference_url":"https://security.gentoo.org/glsa/202107-33","reference_id":"","reference_type":"","scores":[{"value":"7.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"},{"value":"8.7","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://security.gentoo.org/glsa/202107-33"},{"reference_url":"https://bugzilla.redhat.com/show_bug.cgi?id=1934685","reference_id":"1934685","reference_type":"","scores":[],"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1934685"},{"reference_url":"https://security.archlinux.org/AVG-1635","reference_id":"AVG-1635","reference_type":"","scores":[{"value":"Medium","scoring_system":"archlinux","scoring_elements":""}],"url":"https://security.archlinux.org/AVG-1635"},{"reference_url":"https://access.redhat.com/errata/RHSA-2021:3917","reference_id":"RHSA-2021:3917","reference_type":"","scores":[],"url":"https://access.redhat.com/errata/RHSA-2021:3917"},{"reference_url":"https://access.redhat.com/errata/RHSA-2021:4149","reference_id":"RHSA-2021:4149","reference_type":"","scores":[],"url":"https://access.redhat.com/errata/RHSA-2021:4149"},{"reference_url":"https://usn.ubuntu.com/4763-1/","reference_id":"USN-4763-1","reference_type":"","scores":[],"url":"https://usn.ubuntu.com/4763-1/"},{"reference_url":"https://usn.ubuntu.com/8135-1/","reference_id":"USN-8135-1","reference_type":"","scores":[],"url":"https://usn.ubuntu.com/8135-1/"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/15250?format=json","purl":"pkg:pypi/pillow@8.1.1","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-19e1-19hk-duet"},{"vulnerability":"VCID-1vt7-c6e3-7qc8"},{"vulnerability":"VCID-3qb5-8p8w-gkad"},{"vulnerability":"VCID-3uk9-eds5-rkgc"},{"vulnerability":"VCID-53ac-ceq4-qkhf"},{"vulnerability":"VCID-5rv4-k1q9-zue2"},{"vulnerability":"VCID-64n5-pugj-vue8"},{"vulnerability":"VCID-9ckw-ra54-z3b7"},{"vulnerability":"VCID-aubw-tsmn-ffcq"},{"vulnerability":"VCID-brp2-dtrf-jyfr"},{"vulnerability":"VCID-d7uf-zdbv-sba1"},{"vulnerability":"VCID-df4x-jt3h-17hx"},{"vulnerability":"VCID-dpc3-td9q-dyee"},{"vulnerability":"VCID-g46h-p8jk-cuhc"},{"vulnerability":"VCID-gvjw-funa-sqak"},{"vulnerability":"VCID-n1hp-atex-ubh4"},{"vulnerability":"VCID-n1w5-f5p7-xuhb"},{"vulnerability":"VCID-q4bb-qnxe-8bfa"},{"vulnerability":"VCID-ue18-zzau-x7hy"},{"vulnerability":"VCID-vdzj-kqfy-d3b7"},{"vulnerability":"VCID-vwbu-ruxm-tbh4"},{"vulnerability":"VCID-vyzt-df2u-h3cc"},{"vulnerability":"VCID-w9uy-fnpm-cbak"},{"vulnerability":"VCID-xesd-d294-7fcx"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:pypi/pillow@8.1.1"}],"aliases":["BIT-pillow-2021-25290","CVE-2021-25290","GHSA-8xjq-8fcg-g5hw","PYSEC-2021-36"],"risk_score":4.0,"exploitability":"0.5","weighted_severity":"8.0","resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-rncf-9nf8-wud3"},{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/5999?format=json","vulnerability_id":"VCID-sns1-ksqr-vbhr","summary":"libImaging/PcxDecode.c in Pillow before 6.2.2 has a PCX P mode buffer overflow.","references":[{"reference_url":"https://access.redhat.com/errata/RHSA-2020:0566","reference_id":"","reference_type":"","scores":[{"value":"9.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},{"value":"9.3","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N"},{"value":"CRITICAL","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://access.redhat.com/errata/RHSA-2020:0566"},{"reference_url":"https://access.redhat.com/errata/RHSA-2020:0578","reference_id":"","reference_type":"","scores":[{"value":"9.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},{"value":"9.3","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N"},{"value":"CRITICAL","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://access.redhat.com/errata/RHSA-2020:0578"},{"reference_url":"https://access.redhat.com/errata/RHSA-2020:0580","reference_id":"","reference_type":"","scores":[{"value":"9.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},{"value":"9.3","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N"},{"value":"CRITICAL","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://access.redhat.com/errata/RHSA-2020:0580"},{"reference_url":"https://access.redhat.com/errata/RHSA-2020:0681","reference_id":"","reference_type":"","scores":[{"value":"9.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},{"value":"9.3","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N"},{"value":"CRITICAL","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://access.redhat.com/errata/RHSA-2020:0681"},{"reference_url":"https://access.redhat.com/errata/RHSA-2020:0683","reference_id":"","reference_type":"","scores":[{"value":"9.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},{"value":"9.3","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N"},{"value":"CRITICAL","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://access.redhat.com/errata/RHSA-2020:0683"},{"reference_url":"https://access.redhat.com/errata/RHSA-2020:0694","reference_id":"","reference_type":"","scores":[{"value":"9.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},{"value":"9.3","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N"},{"value":"CRITICAL","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://access.redhat.com/errata/RHSA-2020:0694"},{"reference_url":"https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2020-5312.json","reference_id":"","reference_type":"","scores":[{"value":"9.8","scoring_system":"cvssv3","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"}],"url":"https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2020-5312.json"},{"reference_url":"https://api.first.org/data/v1/epss?cve=CVE-2020-5312","reference_id":"","reference_type":"","scores":[{"value":"0.0173","scoring_system":"epss","scoring_elements":"0.82551","published_at":"2026-05-05T12:55:00Z"},{"value":"0.0173","scoring_system":"epss","scoring_elements":"0.8238","published_at":"2026-04-01T12:55:00Z"},{"value":"0.0173","scoring_system":"epss","scoring_elements":"0.82394","published_at":"2026-04-02T12:55:00Z"},{"value":"0.0173","scoring_system":"epss","scoring_elements":"0.82412","published_at":"2026-04-04T12:55:00Z"},{"value":"0.0173","scoring_system":"epss","scoring_elements":"0.82409","published_at":"2026-04-07T12:55:00Z"},{"value":"0.0173","scoring_system":"epss","scoring_elements":"0.82437","published_at":"2026-04-08T12:55:00Z"},{"value":"0.0173","scoring_system":"epss","scoring_elements":"0.82444","published_at":"2026-04-09T12:55:00Z"},{"value":"0.0173","scoring_system":"epss","scoring_elements":"0.82462","published_at":"2026-04-11T12:55:00Z"},{"value":"0.0173","scoring_system":"epss","scoring_elements":"0.82458","published_at":"2026-04-12T12:55:00Z"},{"value":"0.0173","scoring_system":"epss","scoring_elements":"0.82453","published_at":"2026-04-13T12:55:00Z"},{"value":"0.0173","scoring_system":"epss","scoring_elements":"0.82489","published_at":"2026-04-16T12:55:00Z"},{"value":"0.0173","scoring_system":"epss","scoring_elements":"0.8249","published_at":"2026-04-18T12:55:00Z"},{"value":"0.0173","scoring_system":"epss","scoring_elements":"0.82494","published_at":"2026-04-21T12:55:00Z"},{"value":"0.0173","scoring_system":"epss","scoring_elements":"0.82516","published_at":"2026-04-24T12:55:00Z"},{"value":"0.0173","scoring_system":"epss","scoring_elements":"0.82527","published_at":"2026-04-26T12:55:00Z"},{"value":"0.0173","scoring_system":"epss","scoring_elements":"0.8253","published_at":"2026-04-29T12:55:00Z"}],"url":"https://api.first.org/data/v1/epss?cve=CVE-2020-5312"},{"reference_url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-19911","reference_id":"","reference_type":"","scores":[],"url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-19911"},{"reference_url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-5312","reference_id":"","reference_type":"","scores":[],"url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-5312"},{"reference_url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-5313","reference_id":"","reference_type":"","scores":[],"url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-5313"},{"reference_url":"https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml","reference_id":"","reference_type":"","scores":[{"value":"8.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"}],"url":"https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml"},{"reference_url":"https://github.com/advisories/GHSA-p49h-hjvm-jg3h","reference_id":"","reference_type":"","scores":[{"value":"9.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},{"value":"CRITICAL","scoring_system":"cvssv3.1_qr","scoring_elements":""},{"value":"9.3","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N"},{"value":"CRITICAL","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/advisories/GHSA-p49h-hjvm-jg3h"},{"reference_url":"https://github.com/pypa/advisory-database/tree/main/vulns/pillow/PYSEC-2020-83.yaml","reference_id":"","reference_type":"","scores":[{"value":"9.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},{"value":"9.3","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N"},{"value":"CRITICAL","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/pypa/advisory-database/tree/main/vulns/pillow/PYSEC-2020-83.yaml"},{"reference_url":"https://github.com/pypa/advisory-db/blob/7872b0a91b4d980f749e6d75a81f8cc1af32829f/vulns/pillow/PYSEC-2020-83.yaml","reference_id":"","reference_type":"","scores":[{"value":"9.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},{"value":"9.3","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N"},{"value":"CRITICAL","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/pypa/advisory-db/blob/7872b0a91b4d980f749e6d75a81f8cc1af32829f/vulns/pillow/PYSEC-2020-83.yaml"},{"reference_url":"https://github.com/python-pillow/Pillow","reference_id":"","reference_type":"","scores":[{"value":"9.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},{"value":"9.3","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N"},{"value":"CRITICAL","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/python-pillow/Pillow"},{"reference_url":"https://github.com/python-pillow/Pillow/commit/93b22b846e0269ee9594ff71a72bec02d2bea8fd","reference_id":"","reference_type":"","scores":[{"value":"9.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},{"value":"9.3","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N"},{"value":"CRITICAL","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/python-pillow/Pillow/commit/93b22b846e0269ee9594ff71a72bec02d2bea8fd"},{"reference_url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/2MMU3WT2X64GS5WHDPKKC2WZA7UIIQ3A","reference_id":"","reference_type":"","scores":[{"value":"9.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},{"value":"9.3","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N"},{"value":"CRITICAL","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/2MMU3WT2X64GS5WHDPKKC2WZA7UIIQ3A"},{"reference_url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/2MMU3WT2X64GS5WHDPKKC2WZA7UIIQ3A/","reference_id":"","reference_type":"","scores":[],"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/2MMU3WT2X64GS5WHDPKKC2WZA7UIIQ3A/"},{"reference_url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/3DUMIBUYGJRAVJCTFUWBRLVQKOUTVX5P","reference_id":"","reference_type":"","scores":[{"value":"9.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},{"value":"9.3","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N"},{"value":"CRITICAL","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/3DUMIBUYGJRAVJCTFUWBRLVQKOUTVX5P"},{"reference_url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/3DUMIBUYGJRAVJCTFUWBRLVQKOUTVX5P/","reference_id":"","reference_type":"","scores":[],"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/3DUMIBUYGJRAVJCTFUWBRLVQKOUTVX5P/"},{"reference_url":"https://pillow.readthedocs.io/en/stable/releasenotes/6.2.2.html","reference_id":"","reference_type":"","scores":[{"value":"9.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},{"value":"9.3","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N"},{"value":"CRITICAL","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://pillow.readthedocs.io/en/stable/releasenotes/6.2.2.html"},{"reference_url":"https://usn.ubuntu.com/4272-1","reference_id":"","reference_type":"","scores":[{"value":"9.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},{"value":"9.3","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N"},{"value":"CRITICAL","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://usn.ubuntu.com/4272-1"},{"reference_url":"https://usn.ubuntu.com/4272-1/","reference_id":"","reference_type":"","scores":[],"url":"https://usn.ubuntu.com/4272-1/"},{"reference_url":"https://www.debian.org/security/2020/dsa-4631","reference_id":"","reference_type":"","scores":[{"value":"9.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},{"value":"9.3","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N"},{"value":"CRITICAL","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://www.debian.org/security/2020/dsa-4631"},{"reference_url":"https://bugzilla.redhat.com/show_bug.cgi?id=1789533","reference_id":"1789533","reference_type":"","scores":[],"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1789533"},{"reference_url":"https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=948224","reference_id":"948224","reference_type":"","scores":[],"url":"https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=948224"},{"reference_url":"https://nvd.nist.gov/vuln/detail/CVE-2020-5312","reference_id":"CVE-2020-5312","reference_type":"","scores":[{"value":"9.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},{"value":"9.3","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N"},{"value":"CRITICAL","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://nvd.nist.gov/vuln/detail/CVE-2020-5312"},{"reference_url":"https://access.redhat.com/errata/RHSA-2020:0898","reference_id":"RHSA-2020:0898","reference_type":"","scores":[],"url":"https://access.redhat.com/errata/RHSA-2020:0898"},{"reference_url":"https://access.redhat.com/errata/RHSA-2021:0420","reference_id":"RHSA-2021:0420","reference_type":"","scores":[],"url":"https://access.redhat.com/errata/RHSA-2021:0420"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/9845?format=json","purl":"pkg:pypi/pillow@6.2.2","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-19e1-19hk-duet"},{"vulnerability":"VCID-1vt7-c6e3-7qc8"},{"vulnerability":"VCID-3qb5-8p8w-gkad"},{"vulnerability":"VCID-3uk9-eds5-rkgc"},{"vulnerability":"VCID-53ac-ceq4-qkhf"},{"vulnerability":"VCID-5rv4-k1q9-zue2"},{"vulnerability":"VCID-64n5-pugj-vue8"},{"vulnerability":"VCID-6gyu-fzpg-c3bn"},{"vulnerability":"VCID-7bjx-gkf7-cke9"},{"vulnerability":"VCID-8n2b-wvya-53e1"},{"vulnerability":"VCID-9ckw-ra54-z3b7"},{"vulnerability":"VCID-and9-6jty-pyeq"},{"vulnerability":"VCID-aubw-tsmn-ffcq"},{"vulnerability":"VCID-b5a2-83ej-puaw"},{"vulnerability":"VCID-brp2-dtrf-jyfr"},{"vulnerability":"VCID-d7uf-zdbv-sba1"},{"vulnerability":"VCID-df4x-jt3h-17hx"},{"vulnerability":"VCID-dpc3-td9q-dyee"},{"vulnerability":"VCID-en6t-uxtq-bfek"},{"vulnerability":"VCID-g46h-p8jk-cuhc"},{"vulnerability":"VCID-gvjw-funa-sqak"},{"vulnerability":"VCID-haum-8zpg-6kgf"},{"vulnerability":"VCID-khp6-9hfx-1kge"},{"vulnerability":"VCID-n1hp-atex-ubh4"},{"vulnerability":"VCID-n1w5-f5p7-xuhb"},{"vulnerability":"VCID-p6r3-puh1-zyg6"},{"vulnerability":"VCID-q4bb-qnxe-8bfa"},{"vulnerability":"VCID-rncf-9nf8-wud3"},{"vulnerability":"VCID-ue18-zzau-x7hy"},{"vulnerability":"VCID-uf5t-asns-tudp"},{"vulnerability":"VCID-vdzj-kqfy-d3b7"},{"vulnerability":"VCID-vwbu-ruxm-tbh4"},{"vulnerability":"VCID-vxh1-8rvt-kkak"},{"vulnerability":"VCID-vyzt-df2u-h3cc"},{"vulnerability":"VCID-w9uy-fnpm-cbak"},{"vulnerability":"VCID-x15z-dejc-9ba6"},{"vulnerability":"VCID-xesd-d294-7fcx"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:pypi/pillow@6.2.2"}],"aliases":["BIT-pillow-2020-5312","CVE-2020-5312","GHSA-p49h-hjvm-jg3h","PYSEC-2020-83"],"risk_score":4.5,"exploitability":"0.5","weighted_severity":"9.0","resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-sns1-ksqr-vbhr"},{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/5998?format=json","vulnerability_id":"VCID-stft-hsk9-zfdy","summary":"libImaging/TiffDecode.c in Pillow before 6.2.2 has a TIFF decoding integer overflow, related to realloc.","references":[{"reference_url":"https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2020-5310.json","reference_id":"","reference_type":"","scores":[{"value":"8.1","scoring_system":"cvssv3","scoring_elements":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"}],"url":"https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2020-5310.json"},{"reference_url":"https://api.first.org/data/v1/epss?cve=CVE-2020-5310","reference_id":"","reference_type":"","scores":[{"value":"0.00611","scoring_system":"epss","scoring_elements":"0.69867","published_at":"2026-05-05T12:55:00Z"},{"value":"0.00611","scoring_system":"epss","scoring_elements":"0.69893","published_at":"2026-04-29T12:55:00Z"},{"value":"0.00611","scoring_system":"epss","scoring_elements":"0.69889","published_at":"2026-04-26T12:55:00Z"},{"value":"0.00611","scoring_system":"epss","scoring_elements":"0.6988","published_at":"2026-04-24T12:55:00Z"},{"value":"0.00611","scoring_system":"epss","scoring_elements":"0.69829","published_at":"2026-04-21T12:55:00Z"},{"value":"0.00611","scoring_system":"epss","scoring_elements":"0.69848","published_at":"2026-04-18T12:55:00Z"},{"value":"0.00611","scoring_system":"epss","scoring_elements":"0.69838","published_at":"2026-04-16T12:55:00Z"},{"value":"0.00611","scoring_system":"epss","scoring_elements":"0.69796","published_at":"2026-04-13T12:55:00Z"},{"value":"0.00611","scoring_system":"epss","scoring_elements":"0.6981","published_at":"2026-04-12T12:55:00Z"},{"value":"0.00611","scoring_system":"epss","scoring_elements":"0.69825","published_at":"2026-04-11T12:55:00Z"},{"value":"0.00611","scoring_system":"epss","scoring_elements":"0.69802","published_at":"2026-04-09T12:55:00Z"},{"value":"0.00611","scoring_system":"epss","scoring_elements":"0.69786","published_at":"2026-04-08T12:55:00Z"},{"value":"0.00611","scoring_system":"epss","scoring_elements":"0.69738","published_at":"2026-04-07T12:55:00Z"},{"value":"0.00611","scoring_system":"epss","scoring_elements":"0.69761","published_at":"2026-04-04T12:55:00Z"},{"value":"0.00611","scoring_system":"epss","scoring_elements":"0.69745","published_at":"2026-04-02T12:55:00Z"},{"value":"0.00611","scoring_system":"epss","scoring_elements":"0.69734","published_at":"2026-04-01T12:55:00Z"}],"url":"https://api.first.org/data/v1/epss?cve=CVE-2020-5310"},{"reference_url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-5310","reference_id":"","reference_type":"","scores":[],"url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-5310"},{"reference_url":"https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml","reference_id":"","reference_type":"","scores":[{"value":"8.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"}],"url":"https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml"},{"reference_url":"https://github.com/advisories/GHSA-vcqg-3p29-xw73","reference_id":"","reference_type":"","scores":[{"value":"8.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"},{"value":"CRITICAL","scoring_system":"cvssv3.1_qr","scoring_elements":""},{"value":"9.3","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N"},{"value":"CRITICAL","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/advisories/GHSA-vcqg-3p29-xw73"},{"reference_url":"https://github.com/pypa/advisory-database/tree/main/vulns/pillow/PYSEC-2020-81.yaml","reference_id":"","reference_type":"","scores":[{"value":"8.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"},{"value":"9.3","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N"},{"value":"CRITICAL","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/pypa/advisory-database/tree/main/vulns/pillow/PYSEC-2020-81.yaml"},{"reference_url":"https://github.com/pypa/advisory-db/blob/7872b0a91b4d980f749e6d75a81f8cc1af32829f/vulns/pillow/PYSEC-2020-81.yaml","reference_id":"","reference_type":"","scores":[{"value":"8.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"},{"value":"9.3","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N"},{"value":"CRITICAL","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/pypa/advisory-db/blob/7872b0a91b4d980f749e6d75a81f8cc1af32829f/vulns/pillow/PYSEC-2020-81.yaml"},{"reference_url":"https://github.com/python-pillow/Pillow","reference_id":"","reference_type":"","scores":[{"value":"8.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"},{"value":"9.3","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N"},{"value":"CRITICAL","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/python-pillow/Pillow"},{"reference_url":"https://github.com/python-pillow/Pillow/commit/4e2def2539ec13e53a82e06c4b3daf00454100c4","reference_id":"","reference_type":"","scores":[{"value":"8.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"},{"value":"9.3","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N"},{"value":"CRITICAL","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/python-pillow/Pillow/commit/4e2def2539ec13e53a82e06c4b3daf00454100c4"},{"reference_url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/2MMU3WT2X64GS5WHDPKKC2WZA7UIIQ3A","reference_id":"","reference_type":"","scores":[{"value":"8.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"},{"value":"9.3","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N"},{"value":"CRITICAL","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/2MMU3WT2X64GS5WHDPKKC2WZA7UIIQ3A"},{"reference_url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/2MMU3WT2X64GS5WHDPKKC2WZA7UIIQ3A/","reference_id":"","reference_type":"","scores":[],"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/2MMU3WT2X64GS5WHDPKKC2WZA7UIIQ3A/"},{"reference_url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/3DUMIBUYGJRAVJCTFUWBRLVQKOUTVX5P","reference_id":"","reference_type":"","scores":[{"value":"8.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"},{"value":"9.3","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N"},{"value":"CRITICAL","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/3DUMIBUYGJRAVJCTFUWBRLVQKOUTVX5P"},{"reference_url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/3DUMIBUYGJRAVJCTFUWBRLVQKOUTVX5P/","reference_id":"","reference_type":"","scores":[],"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/3DUMIBUYGJRAVJCTFUWBRLVQKOUTVX5P/"},{"reference_url":"https://pillow.readthedocs.io/en/stable/releasenotes/6.2.2.html","reference_id":"","reference_type":"","scores":[{"value":"8.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"},{"value":"9.3","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N"},{"value":"CRITICAL","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://pillow.readthedocs.io/en/stable/releasenotes/6.2.2.html"},{"reference_url":"https://usn.ubuntu.com/4272-1","reference_id":"","reference_type":"","scores":[{"value":"8.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"},{"value":"9.3","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N"},{"value":"CRITICAL","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://usn.ubuntu.com/4272-1"},{"reference_url":"https://usn.ubuntu.com/4272-1/","reference_id":"","reference_type":"","scores":[],"url":"https://usn.ubuntu.com/4272-1/"},{"reference_url":"https://bugzilla.redhat.com/show_bug.cgi?id=1789538","reference_id":"1789538","reference_type":"","scores":[],"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1789538"},{"reference_url":"https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=948224","reference_id":"948224","reference_type":"","scores":[],"url":"https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=948224"},{"reference_url":"https://nvd.nist.gov/vuln/detail/CVE-2020-5310","reference_id":"CVE-2020-5310","reference_type":"","scores":[{"value":"8.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"},{"value":"9.3","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N"},{"value":"CRITICAL","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://nvd.nist.gov/vuln/detail/CVE-2020-5310"},{"reference_url":"https://access.redhat.com/errata/RHSA-2021:0420","reference_id":"RHSA-2021:0420","reference_type":"","scores":[],"url":"https://access.redhat.com/errata/RHSA-2021:0420"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/9845?format=json","purl":"pkg:pypi/pillow@6.2.2","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-19e1-19hk-duet"},{"vulnerability":"VCID-1vt7-c6e3-7qc8"},{"vulnerability":"VCID-3qb5-8p8w-gkad"},{"vulnerability":"VCID-3uk9-eds5-rkgc"},{"vulnerability":"VCID-53ac-ceq4-qkhf"},{"vulnerability":"VCID-5rv4-k1q9-zue2"},{"vulnerability":"VCID-64n5-pugj-vue8"},{"vulnerability":"VCID-6gyu-fzpg-c3bn"},{"vulnerability":"VCID-7bjx-gkf7-cke9"},{"vulnerability":"VCID-8n2b-wvya-53e1"},{"vulnerability":"VCID-9ckw-ra54-z3b7"},{"vulnerability":"VCID-and9-6jty-pyeq"},{"vulnerability":"VCID-aubw-tsmn-ffcq"},{"vulnerability":"VCID-b5a2-83ej-puaw"},{"vulnerability":"VCID-brp2-dtrf-jyfr"},{"vulnerability":"VCID-d7uf-zdbv-sba1"},{"vulnerability":"VCID-df4x-jt3h-17hx"},{"vulnerability":"VCID-dpc3-td9q-dyee"},{"vulnerability":"VCID-en6t-uxtq-bfek"},{"vulnerability":"VCID-g46h-p8jk-cuhc"},{"vulnerability":"VCID-gvjw-funa-sqak"},{"vulnerability":"VCID-haum-8zpg-6kgf"},{"vulnerability":"VCID-khp6-9hfx-1kge"},{"vulnerability":"VCID-n1hp-atex-ubh4"},{"vulnerability":"VCID-n1w5-f5p7-xuhb"},{"vulnerability":"VCID-p6r3-puh1-zyg6"},{"vulnerability":"VCID-q4bb-qnxe-8bfa"},{"vulnerability":"VCID-rncf-9nf8-wud3"},{"vulnerability":"VCID-ue18-zzau-x7hy"},{"vulnerability":"VCID-uf5t-asns-tudp"},{"vulnerability":"VCID-vdzj-kqfy-d3b7"},{"vulnerability":"VCID-vwbu-ruxm-tbh4"},{"vulnerability":"VCID-vxh1-8rvt-kkak"},{"vulnerability":"VCID-vyzt-df2u-h3cc"},{"vulnerability":"VCID-w9uy-fnpm-cbak"},{"vulnerability":"VCID-x15z-dejc-9ba6"},{"vulnerability":"VCID-xesd-d294-7fcx"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:pypi/pillow@6.2.2"}],"aliases":["BIT-pillow-2020-5310","CVE-2020-5310","GHSA-vcqg-3p29-xw73","PYSEC-2020-81"],"risk_score":4.5,"exploitability":"0.5","weighted_severity":"9.0","resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-stft-hsk9-zfdy"},{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/5523?format=json","vulnerability_id":"VCID-u1en-t8ux-uube","summary":"Pillow before 3.3.2 allows context-dependent attackers to execute arbitrary code by using the \"crafted image file\" approach, related to an \"Insecure Sign Extension\" issue affecting the ImagingNew in Storage.c component.","references":[{"reference_url":"http://pillow.readthedocs.io/en/3.4.x/releasenotes/3.3.2.html","reference_id":"","reference_type":"","scores":[{"value":"7.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"},{"value":"8.7","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"http://pillow.readthedocs.io/en/3.4.x/releasenotes/3.3.2.html"},{"reference_url":"https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2016-9190.json","reference_id":"","reference_type":"","scores":[{"value":"7.3","scoring_system":"cvssv3","scoring_elements":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L"}],"url":"https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2016-9190.json"},{"reference_url":"https://api.first.org/data/v1/epss?cve=CVE-2016-9190","reference_id":"","reference_type":"","scores":[{"value":"0.00566","scoring_system":"epss","scoring_elements":"0.6853","published_at":"2026-04-24T12:55:00Z"},{"value":"0.00566","scoring_system":"epss","scoring_elements":"0.68481","published_at":"2026-04-21T12:55:00Z"},{"value":"0.00566","scoring_system":"epss","scoring_elements":"0.68502","published_at":"2026-04-18T12:55:00Z"},{"value":"0.00566","scoring_system":"epss","scoring_elements":"0.68489","published_at":"2026-04-16T12:55:00Z"},{"value":"0.00566","scoring_system":"epss","scoring_elements":"0.68451","published_at":"2026-04-13T12:55:00Z"},{"value":"0.00566","scoring_system":"epss","scoring_elements":"0.68484","published_at":"2026-04-12T12:55:00Z"},{"value":"0.00566","scoring_system":"epss","scoring_elements":"0.68496","published_at":"2026-04-11T12:55:00Z"},{"value":"0.00566","scoring_system":"epss","scoring_elements":"0.6847","published_at":"2026-04-09T12:55:00Z"},{"value":"0.00566","scoring_system":"epss","scoring_elements":"0.68387","published_at":"2026-04-01T12:55:00Z"},{"value":"0.00566","scoring_system":"epss","scoring_elements":"0.68541","published_at":"2026-04-29T12:55:00Z"},{"value":"0.00566","scoring_system":"epss","scoring_elements":"0.68535","published_at":"2026-04-26T12:55:00Z"},{"value":"0.00566","scoring_system":"epss","scoring_elements":"0.68427","published_at":"2026-04-04T12:55:00Z"},{"value":"0.00566","scoring_system":"epss","scoring_elements":"0.68518","published_at":"2026-05-05T12:55:00Z"},{"value":"0.00566","scoring_system":"epss","scoring_elements":"0.68407","published_at":"2026-04-02T12:55:00Z"},{"value":"0.00566","scoring_system":"epss","scoring_elements":"0.68453","published_at":"2026-04-08T12:55:00Z"},{"value":"0.00566","scoring_system":"epss","scoring_elements":"0.68403","published_at":"2026-04-07T12:55:00Z"}],"url":"https://api.first.org/data/v1/epss?cve=CVE-2016-9190"},{"reference_url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-9189","reference_id":"","reference_type":"","scores":[],"url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-9189"},{"reference_url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-9190","reference_id":"","reference_type":"","scores":[],"url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-9190"},{"reference_url":"https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml","reference_id":"","reference_type":"","scores":[{"value":"6.8","scoring_system":"cvssv2","scoring_elements":"AV:N/AC:M/Au:N/C:P/I:P/A:P"}],"url":"https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml"},{"reference_url":"https://github.com/advisories/GHSA-w4vg-rf63-f3j3","reference_id":"","reference_type":"","scores":[{"value":"7.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"},{"value":"HIGH","scoring_system":"cvssv3.1_qr","scoring_elements":""},{"value":"8.7","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/advisories/GHSA-w4vg-rf63-f3j3"},{"reference_url":"https://github.com/pypa/advisory-database/tree/main/vulns/pillow/PYSEC-2016-9.yaml","reference_id":"","reference_type":"","scores":[{"value":"7.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"},{"value":"8.7","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/pypa/advisory-database/tree/main/vulns/pillow/PYSEC-2016-9.yaml"},{"reference_url":"https://github.com/python-pillow/Pillow","reference_id":"","reference_type":"","scores":[{"value":"7.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"},{"value":"8.7","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/python-pillow/Pillow"},{"reference_url":"https://github.com/python-pillow/Pillow/issues/2105","reference_id":"","reference_type":"","scores":[{"value":"7.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"},{"value":"8.7","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/python-pillow/Pillow/issues/2105"},{"reference_url":"https://github.com/python-pillow/Pillow/pull/2146/commits/5d8a0be45aad78c5a22c8d099118ee26ef8144af","reference_id":"","reference_type":"","scores":[{"value":"7.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"},{"value":"8.7","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/python-pillow/Pillow/pull/2146/commits/5d8a0be45aad78c5a22c8d099118ee26ef8144af"},{"reference_url":"https://security.gentoo.org/glsa/201612-52","reference_id":"","reference_type":"","scores":[{"value":"7.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"},{"value":"8.7","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://security.gentoo.org/glsa/201612-52"},{"reference_url":"http://www.debian.org/security/2016/dsa-3710","reference_id":"","reference_type":"","scores":[{"value":"7.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"},{"value":"8.7","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"http://www.debian.org/security/2016/dsa-3710"},{"reference_url":"http://www.securityfocus.com/bid/94234","reference_id":"","reference_type":"","scores":[{"value":"7.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"},{"value":"8.7","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"http://www.securityfocus.com/bid/94234"},{"reference_url":"https://bugzilla.redhat.com/show_bug.cgi?id=1382006","reference_id":"1382006","reference_type":"","scores":[],"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1382006"},{"reference_url":"https://nvd.nist.gov/vuln/detail/CVE-2016-9190","reference_id":"CVE-2016-9190","reference_type":"","scores":[{"value":"7.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"},{"value":"8.7","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://nvd.nist.gov/vuln/detail/CVE-2016-9190"},{"reference_url":"https://usn.ubuntu.com/3229-1/","reference_id":"USN-3229-1","reference_type":"","scores":[],"url":"https://usn.ubuntu.com/3229-1/"},{"reference_url":"https://usn.ubuntu.com/3230-1/","reference_id":"USN-3230-1","reference_type":"","scores":[],"url":"https://usn.ubuntu.com/3230-1/"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/4497?format=json","purl":"pkg:pypi/pillow@3.3.2","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-19e1-19hk-duet"},{"vulnerability":"VCID-1vt7-c6e3-7qc8"},{"vulnerability":"VCID-3qb5-8p8w-gkad"},{"vulnerability":"VCID-3uk9-eds5-rkgc"},{"vulnerability":"VCID-53ac-ceq4-qkhf"},{"vulnerability":"VCID-5rv4-k1q9-zue2"},{"vulnerability":"VCID-64n5-pugj-vue8"},{"vulnerability":"VCID-6gyu-fzpg-c3bn"},{"vulnerability":"VCID-8n2b-wvya-53e1"},{"vulnerability":"VCID-9ckw-ra54-z3b7"},{"vulnerability":"VCID-and9-6jty-pyeq"},{"vulnerability":"VCID-aubw-tsmn-ffcq"},{"vulnerability":"VCID-b3au-rcgp-2fag"},{"vulnerability":"VCID-b5a2-83ej-puaw"},{"vulnerability":"VCID-brp2-dtrf-jyfr"},{"vulnerability":"VCID-cas2-jb3y-vyhz"},{"vulnerability":"VCID-d7uf-zdbv-sba1"},{"vulnerability":"VCID-df4x-jt3h-17hx"},{"vulnerability":"VCID-dpc3-td9q-dyee"},{"vulnerability":"VCID-en6t-uxtq-bfek"},{"vulnerability":"VCID-g46h-p8jk-cuhc"},{"vulnerability":"VCID-gvjw-funa-sqak"},{"vulnerability":"VCID-h4x7-7fke-mqgp"},{"vulnerability":"VCID-haum-8zpg-6kgf"},{"vulnerability":"VCID-hmmq-5772-bycm"},{"vulnerability":"VCID-khp6-9hfx-1kge"},{"vulnerability":"VCID-m3tm-h4q9-9yay"},{"vulnerability":"VCID-n1hp-atex-ubh4"},{"vulnerability":"VCID-n1w5-f5p7-xuhb"},{"vulnerability":"VCID-p6r3-puh1-zyg6"},{"vulnerability":"VCID-q4bb-qnxe-8bfa"},{"vulnerability":"VCID-rncf-9nf8-wud3"},{"vulnerability":"VCID-sns1-ksqr-vbhr"},{"vulnerability":"VCID-stft-hsk9-zfdy"},{"vulnerability":"VCID-ue18-zzau-x7hy"},{"vulnerability":"VCID-uf5t-asns-tudp"},{"vulnerability":"VCID-vdzj-kqfy-d3b7"},{"vulnerability":"VCID-vwbu-ruxm-tbh4"},{"vulnerability":"VCID-vxh1-8rvt-kkak"},{"vulnerability":"VCID-vyzt-df2u-h3cc"},{"vulnerability":"VCID-w9uy-fnpm-cbak"},{"vulnerability":"VCID-x15z-dejc-9ba6"},{"vulnerability":"VCID-xesd-d294-7fcx"},{"vulnerability":"VCID-xk66-1d31-2qbk"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:pypi/pillow@3.3.2"}],"aliases":["CVE-2016-9190","GHSA-w4vg-rf63-f3j3","PYSEC-2016-9"],"risk_score":4.0,"exploitability":"0.5","weighted_severity":"8.0","resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-u1en-t8ux-uube"},{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/6465?format=json","vulnerability_id":"VCID-ue18-zzau-x7hy","summary":"An issue was discovered in Pillow before 8.2.0. There is an out-of-bounds read in J2kDecode, in j2ku_gray_i.","references":[{"reference_url":"https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2021-25288.json","reference_id":"","reference_type":"","scores":[{"value":"9.1","scoring_system":"cvssv3","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H"}],"url":"https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2021-25288.json"},{"reference_url":"https://api.first.org/data/v1/epss?cve=CVE-2021-25288","reference_id":"","reference_type":"","scores":[{"value":"0.00267","scoring_system":"epss","scoring_elements":"0.50055","published_at":"2026-05-05T12:55:00Z"},{"value":"0.00267","scoring_system":"epss","scoring_elements":"0.50138","published_at":"2026-04-29T12:55:00Z"},{"value":"0.00267","scoring_system":"epss","scoring_elements":"0.50184","published_at":"2026-04-26T12:55:00Z"},{"value":"0.00267","scoring_system":"epss","scoring_elements":"0.50179","published_at":"2026-04-24T12:55:00Z"},{"value":"0.00267","scoring_system":"epss","scoring_elements":"0.50231","published_at":"2026-04-18T12:55:00Z"},{"value":"0.00267","scoring_system":"epss","scoring_elements":"0.5023","published_at":"2026-04-16T12:55:00Z"},{"value":"0.00267","scoring_system":"epss","scoring_elements":"0.50186","published_at":"2026-04-13T12:55:00Z"},{"value":"0.00267","scoring_system":"epss","scoring_elements":"0.50224","published_at":"2026-04-11T12:55:00Z"},{"value":"0.00267","scoring_system":"epss","scoring_elements":"0.50196","published_at":"2026-04-09T12:55:00Z"},{"value":"0.00267","scoring_system":"epss","scoring_elements":"0.50203","published_at":"2026-04-08T12:55:00Z"},{"value":"0.00267","scoring_system":"epss","scoring_elements":"0.50125","published_at":"2026-04-01T12:55:00Z"},{"value":"0.00267","scoring_system":"epss","scoring_elements":"0.50149","published_at":"2026-04-07T12:55:00Z"},{"value":"0.00267","scoring_system":"epss","scoring_elements":"0.50198","published_at":"2026-04-12T12:55:00Z"},{"value":"0.00267","scoring_system":"epss","scoring_elements":"0.50171","published_at":"2026-04-02T12:55:00Z"},{"value":"0.00274","scoring_system":"epss","scoring_elements":"0.50917","published_at":"2026-04-21T12:55:00Z"}],"url":"https://api.first.org/data/v1/epss?cve=CVE-2021-25288"},{"reference_url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-25288","reference_id":"","reference_type":"","scores":[],"url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-25288"},{"reference_url":"https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml","reference_id":"","reference_type":"","scores":[{"value":"7.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"url":"https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml"},{"reference_url":"https://github.com/advisories/GHSA-rwv7-3v45-hg29","reference_id":"","reference_type":"","scores":[{"value":"9.1","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H"},{"value":"HIGH","scoring_system":"cvssv3.1_qr","scoring_elements":""},{"value":"8.8","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:H/SC:N/SI:N/SA:N"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/advisories/GHSA-rwv7-3v45-hg29"},{"reference_url":"https://github.com/pypa/advisory-database/tree/main/vulns/pillow/PYSEC-2021-138.yaml","reference_id":"","reference_type":"","scores":[{"value":"9.1","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H"},{"value":"8.8","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:H/SC:N/SI:N/SA:N"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/pypa/advisory-database/tree/main/vulns/pillow/PYSEC-2021-138.yaml"},{"reference_url":"https://github.com/python-pillow/Pillow","reference_id":"","reference_type":"","scores":[{"value":"9.1","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H"},{"value":"8.8","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:H/SC:N/SI:N/SA:N"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/python-pillow/Pillow"},{"reference_url":"https://github.com/python-pillow/Pillow/commit/3bf5eddb89afdf690eceaa52bc4d3546ba9a5f87","reference_id":"","reference_type":"","scores":[{"value":"9.1","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H"},{"value":"8.8","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:H/SC:N/SI:N/SA:N"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/python-pillow/Pillow/commit/3bf5eddb89afdf690eceaa52bc4d3546ba9a5f87"},{"reference_url":"https://github.com/python-pillow/Pillow/pull/5377#issuecomment-833821470","reference_id":"","reference_type":"","scores":[{"value":"9.1","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H"},{"value":"8.8","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:H/SC:N/SI:N/SA:N"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/python-pillow/Pillow/pull/5377#issuecomment-833821470"},{"reference_url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/MQHA5HAIBOYI3R6HDWCLAGFTIQP767FL","reference_id":"","reference_type":"","scores":[{"value":"9.1","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H"},{"value":"8.8","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:H/SC:N/SI:N/SA:N"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/MQHA5HAIBOYI3R6HDWCLAGFTIQP767FL"},{"reference_url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/MQHA5HAIBOYI3R6HDWCLAGFTIQP767FL/","reference_id":"","reference_type":"","scores":[],"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/MQHA5HAIBOYI3R6HDWCLAGFTIQP767FL/"},{"reference_url":"https://nvd.nist.gov/vuln/detail/CVE-2021-25288","reference_id":"","reference_type":"","scores":[{"value":"9.1","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H"},{"value":"8.8","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:H/SC:N/SI:N/SA:N"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-25288"},{"reference_url":"https://pillow.readthedocs.io/en/stable/releasenotes/8.2.0.html#cve-2021-25287-cve-2021-25288-fix-oob-read-in-jpeg2kdecode","reference_id":"","reference_type":"","scores":[{"value":"9.1","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H"},{"value":"8.8","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:H/SC:N/SI:N/SA:N"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://pillow.readthedocs.io/en/stable/releasenotes/8.2.0.html#cve-2021-25287-cve-2021-25288-fix-oob-read-in-jpeg2kdecode"},{"reference_url":"https://security.gentoo.org/glsa/202107-33","reference_id":"","reference_type":"","scores":[{"value":"9.1","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H"},{"value":"8.8","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:H/SC:N/SI:N/SA:N"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://security.gentoo.org/glsa/202107-33"},{"reference_url":"https://bugzilla.redhat.com/show_bug.cgi?id=1958231","reference_id":"1958231","reference_type":"","scores":[],"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1958231"},{"reference_url":"https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=989062","reference_id":"989062","reference_type":"","scores":[],"url":"https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=989062"},{"reference_url":"https://access.redhat.com/errata/RHSA-2021:4149","reference_id":"RHSA-2021:4149","reference_type":"","scores":[],"url":"https://access.redhat.com/errata/RHSA-2021:4149"},{"reference_url":"https://usn.ubuntu.com/4963-1/","reference_id":"USN-4963-1","reference_type":"","scores":[],"url":"https://usn.ubuntu.com/4963-1/"},{"reference_url":"https://usn.ubuntu.com/8135-1/","reference_id":"USN-8135-1","reference_type":"","scores":[],"url":"https://usn.ubuntu.com/8135-1/"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/17188?format=json","purl":"pkg:pypi/pillow@8.2.0","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-19e1-19hk-duet"},{"vulnerability":"VCID-1vt7-c6e3-7qc8"},{"vulnerability":"VCID-5rv4-k1q9-zue2"},{"vulnerability":"VCID-64n5-pugj-vue8"},{"vulnerability":"VCID-9ckw-ra54-z3b7"},{"vulnerability":"VCID-brp2-dtrf-jyfr"},{"vulnerability":"VCID-d7uf-zdbv-sba1"},{"vulnerability":"VCID-df4x-jt3h-17hx"},{"vulnerability":"VCID-dpc3-td9q-dyee"},{"vulnerability":"VCID-g46h-p8jk-cuhc"},{"vulnerability":"VCID-n1hp-atex-ubh4"},{"vulnerability":"VCID-q4bb-qnxe-8bfa"},{"vulnerability":"VCID-vdzj-kqfy-d3b7"},{"vulnerability":"VCID-w9uy-fnpm-cbak"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:pypi/pillow@8.2.0"}],"aliases":["BIT-pillow-2021-25288","CVE-2021-25288","GHSA-rwv7-3v45-hg29","PYSEC-2021-138"],"risk_score":4.1,"exploitability":"0.5","weighted_severity":"8.2","resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-ue18-zzau-x7hy"},{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/6103?format=json","vulnerability_id":"VCID-uf5t-asns-tudp","summary":"In libImaging/Jpeg2KDecode.c in Pillow before 7.1.0, there are multiple out-of-bounds reads via a crafted JP2 file.","references":[{"reference_url":"https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2020-10994.json","reference_id":"","reference_type":"","scores":[{"value":"5.3","scoring_system":"cvssv3","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"}],"url":"https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2020-10994.json"},{"reference_url":"https://api.first.org/data/v1/epss?cve=CVE-2020-10994","reference_id":"","reference_type":"","scores":[{"value":"0.00424","scoring_system":"epss","scoring_elements":"0.62226","published_at":"2026-04-29T12:55:00Z"},{"value":"0.00424","scoring_system":"epss","scoring_elements":"0.62232","published_at":"2026-04-26T12:55:00Z"},{"value":"0.00424","scoring_system":"epss","scoring_elements":"0.62215","published_at":"2026-04-24T12:55:00Z"},{"value":"0.00424","scoring_system":"epss","scoring_elements":"0.62204","published_at":"2026-04-21T12:55:00Z"},{"value":"0.00424","scoring_system":"epss","scoring_elements":"0.62221","published_at":"2026-04-18T12:55:00Z"},{"value":"0.00424","scoring_system":"epss","scoring_elements":"0.62214","published_at":"2026-04-16T12:55:00Z"},{"value":"0.00424","scoring_system":"epss","scoring_elements":"0.62171","published_at":"2026-05-05T12:55:00Z"},{"value":"0.00424","scoring_system":"epss","scoring_elements":"0.62191","published_at":"2026-04-12T12:55:00Z"},{"value":"0.00424","scoring_system":"epss","scoring_elements":"0.62183","published_at":"2026-04-09T12:55:00Z"},{"value":"0.00424","scoring_system":"epss","scoring_elements":"0.62165","published_at":"2026-04-08T12:55:00Z"},{"value":"0.00424","scoring_system":"epss","scoring_elements":"0.62148","published_at":"2026-04-04T12:55:00Z"},{"value":"0.00424","scoring_system":"epss","scoring_elements":"0.62115","published_at":"2026-04-07T12:55:00Z"},{"value":"0.00424","scoring_system":"epss","scoring_elements":"0.62202","published_at":"2026-04-11T12:55:00Z"},{"value":"0.00424","scoring_system":"epss","scoring_elements":"0.62056","published_at":"2026-04-01T12:55:00Z"}],"url":"https://api.first.org/data/v1/epss?cve=CVE-2020-10994"},{"reference_url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-10994","reference_id":"","reference_type":"","scores":[],"url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-10994"},{"reference_url":"https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml","reference_id":"","reference_type":"","scores":[{"value":"6.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L"}],"url":"https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml"},{"reference_url":"https://github.com/advisories/GHSA-vj42-xq3r-hr3r","reference_id":"","reference_type":"","scores":[{"value":"5.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H"},{"value":"HIGH","scoring_system":"cvssv3.1_qr","scoring_elements":""},{"value":"7.1","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/advisories/GHSA-vj42-xq3r-hr3r"},{"reference_url":"https://github.com/pypa/advisory-database/tree/main/vulns/pillow/PYSEC-2020-79.yaml","reference_id":"","reference_type":"","scores":[{"value":"5.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H"},{"value":"7.1","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/pypa/advisory-database/tree/main/vulns/pillow/PYSEC-2020-79.yaml"},{"reference_url":"https://github.com/python-pillow/Pillow","reference_id":"","reference_type":"","scores":[{"value":"5.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H"},{"value":"7.1","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/python-pillow/Pillow"},{"reference_url":"https://github.com/python-pillow/Pillow/blob/master/docs/releasenotes/7.1.0.rst#security","reference_id":"","reference_type":"","scores":[{"value":"5.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H"},{"value":"7.1","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/python-pillow/Pillow/blob/master/docs/releasenotes/7.1.0.rst#security"},{"reference_url":"https://github.com/python-pillow/Pillow/commit/ff60894d697d1992147b791101ad53a8bf1352e4","reference_id":"","reference_type":"","scores":[{"value":"5.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H"},{"value":"7.1","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/python-pillow/Pillow/commit/ff60894d697d1992147b791101ad53a8bf1352e4"},{"reference_url":"https://github.com/python-pillow/Pillow/commits/master/src/libImaging","reference_id":"","reference_type":"","scores":[{"value":"5.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H"},{"value":"7.1","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/python-pillow/Pillow/commits/master/src/libImaging"},{"reference_url":"https://github.com/python-pillow/Pillow/commits/master/src/libImaging/","reference_id":"","reference_type":"","scores":[],"url":"https://github.com/python-pillow/Pillow/commits/master/src/libImaging/"},{"reference_url":"https://github.com/python-pillow/Pillow/pull/4505","reference_id":"","reference_type":"","scores":[{"value":"5.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H"},{"value":"7.1","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/python-pillow/Pillow/pull/4505"},{"reference_url":"https://github.com/python-pillow/Pillow/pull/4538","reference_id":"","reference_type":"","scores":[{"value":"5.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H"},{"value":"7.1","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/python-pillow/Pillow/pull/4538"},{"reference_url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/BEBCPE4F2VHTIT6EZA2YZQZLPVDEBJGD","reference_id":"","reference_type":"","scores":[{"value":"5.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H"},{"value":"7.1","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/BEBCPE4F2VHTIT6EZA2YZQZLPVDEBJGD"},{"reference_url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/BEBCPE4F2VHTIT6EZA2YZQZLPVDEBJGD/","reference_id":"","reference_type":"","scores":[],"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/BEBCPE4F2VHTIT6EZA2YZQZLPVDEBJGD/"},{"reference_url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/HOKHNWV2VS5GESY7IBD237E7C6T3I427","reference_id":"","reference_type":"","scores":[{"value":"5.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H"},{"value":"7.1","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/HOKHNWV2VS5GESY7IBD237E7C6T3I427"},{"reference_url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/HOKHNWV2VS5GESY7IBD237E7C6T3I427/","reference_id":"","reference_type":"","scores":[],"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/HOKHNWV2VS5GESY7IBD237E7C6T3I427/"},{"reference_url":"https://nvd.nist.gov/vuln/detail/CVE-2020-10994","reference_id":"","reference_type":"","scores":[{"value":"5.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H"},{"value":"7.1","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://nvd.nist.gov/vuln/detail/CVE-2020-10994"},{"reference_url":"https://pillow.readthedocs.io/en/stable/releasenotes","reference_id":"","reference_type":"","scores":[{"value":"5.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H"},{"value":"7.1","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://pillow.readthedocs.io/en/stable/releasenotes"},{"reference_url":"https://pillow.readthedocs.io/en/stable/releasenotes/","reference_id":"","reference_type":"","scores":[],"url":"https://pillow.readthedocs.io/en/stable/releasenotes/"},{"reference_url":"https://pillow.readthedocs.io/en/stable/releasenotes/7.1.0.html","reference_id":"","reference_type":"","scores":[{"value":"5.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H"},{"value":"7.1","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://pillow.readthedocs.io/en/stable/releasenotes/7.1.0.html"},{"reference_url":"https://snyk.io/vuln/SNYK-PYTHON-PILLOW-574575","reference_id":"","reference_type":"","scores":[{"value":"5.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H"},{"value":"7.1","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://snyk.io/vuln/SNYK-PYTHON-PILLOW-574575"},{"reference_url":"https://usn.ubuntu.com/4430-1","reference_id":"","reference_type":"","scores":[{"value":"5.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H"},{"value":"7.1","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://usn.ubuntu.com/4430-1"},{"reference_url":"https://usn.ubuntu.com/4430-1/","reference_id":"","reference_type":"","scores":[],"url":"https://usn.ubuntu.com/4430-1/"},{"reference_url":"https://usn.ubuntu.com/4430-2","reference_id":"","reference_type":"","scores":[{"value":"5.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H"},{"value":"7.1","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://usn.ubuntu.com/4430-2"},{"reference_url":"https://usn.ubuntu.com/4430-2/","reference_id":"","reference_type":"","scores":[],"url":"https://usn.ubuntu.com/4430-2/"},{"reference_url":"https://bugzilla.redhat.com/show_bug.cgi?id=1852820","reference_id":"1852820","reference_type":"","scores":[],"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1852820"},{"reference_url":"https://access.redhat.com/errata/RHSA-2021:0420","reference_id":"RHSA-2021:0420","reference_type":"","scores":[],"url":"https://access.redhat.com/errata/RHSA-2021:0420"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/12774?format=json","purl":"pkg:pypi/pillow@7.0.0","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-19e1-19hk-duet"},{"vulnerability":"VCID-1vt7-c6e3-7qc8"},{"vulnerability":"VCID-3qb5-8p8w-gkad"},{"vulnerability":"VCID-3uk9-eds5-rkgc"},{"vulnerability":"VCID-53ac-ceq4-qkhf"},{"vulnerability":"VCID-5rv4-k1q9-zue2"},{"vulnerability":"VCID-64n5-pugj-vue8"},{"vulnerability":"VCID-6gyu-fzpg-c3bn"},{"vulnerability":"VCID-7bjx-gkf7-cke9"},{"vulnerability":"VCID-8n2b-wvya-53e1"},{"vulnerability":"VCID-9ckw-ra54-z3b7"},{"vulnerability":"VCID-and9-6jty-pyeq"},{"vulnerability":"VCID-aubw-tsmn-ffcq"},{"vulnerability":"VCID-b5a2-83ej-puaw"},{"vulnerability":"VCID-brp2-dtrf-jyfr"},{"vulnerability":"VCID-d7uf-zdbv-sba1"},{"vulnerability":"VCID-df4x-jt3h-17hx"},{"vulnerability":"VCID-dpc3-td9q-dyee"},{"vulnerability":"VCID-en6t-uxtq-bfek"},{"vulnerability":"VCID-g46h-p8jk-cuhc"},{"vulnerability":"VCID-gvjw-funa-sqak"},{"vulnerability":"VCID-haum-8zpg-6kgf"},{"vulnerability":"VCID-khp6-9hfx-1kge"},{"vulnerability":"VCID-n1hp-atex-ubh4"},{"vulnerability":"VCID-n1w5-f5p7-xuhb"},{"vulnerability":"VCID-p6r3-puh1-zyg6"},{"vulnerability":"VCID-q4bb-qnxe-8bfa"},{"vulnerability":"VCID-rncf-9nf8-wud3"},{"vulnerability":"VCID-ue18-zzau-x7hy"},{"vulnerability":"VCID-uf5t-asns-tudp"},{"vulnerability":"VCID-vdzj-kqfy-d3b7"},{"vulnerability":"VCID-vwbu-ruxm-tbh4"},{"vulnerability":"VCID-vxh1-8rvt-kkak"},{"vulnerability":"VCID-vyzt-df2u-h3cc"},{"vulnerability":"VCID-w9uy-fnpm-cbak"},{"vulnerability":"VCID-x15z-dejc-9ba6"},{"vulnerability":"VCID-xesd-d294-7fcx"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:pypi/pillow@7.0.0"},{"url":"http://public2.vulnerablecode.io/api/packages/12775?format=json","purl":"pkg:pypi/pillow@7.1.0","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-19e1-19hk-duet"},{"vulnerability":"VCID-1vt7-c6e3-7qc8"},{"vulnerability":"VCID-3qb5-8p8w-gkad"},{"vulnerability":"VCID-3uk9-eds5-rkgc"},{"vulnerability":"VCID-53ac-ceq4-qkhf"},{"vulnerability":"VCID-5rv4-k1q9-zue2"},{"vulnerability":"VCID-64n5-pugj-vue8"},{"vulnerability":"VCID-6gyu-fzpg-c3bn"},{"vulnerability":"VCID-7bjx-gkf7-cke9"},{"vulnerability":"VCID-9ckw-ra54-z3b7"},{"vulnerability":"VCID-aubw-tsmn-ffcq"},{"vulnerability":"VCID-brp2-dtrf-jyfr"},{"vulnerability":"VCID-d7uf-zdbv-sba1"},{"vulnerability":"VCID-df4x-jt3h-17hx"},{"vulnerability":"VCID-dpc3-td9q-dyee"},{"vulnerability":"VCID-en6t-uxtq-bfek"},{"vulnerability":"VCID-g46h-p8jk-cuhc"},{"vulnerability":"VCID-gvjw-funa-sqak"},{"vulnerability":"VCID-khp6-9hfx-1kge"},{"vulnerability":"VCID-n1hp-atex-ubh4"},{"vulnerability":"VCID-n1w5-f5p7-xuhb"},{"vulnerability":"VCID-p6r3-puh1-zyg6"},{"vulnerability":"VCID-q4bb-qnxe-8bfa"},{"vulnerability":"VCID-rncf-9nf8-wud3"},{"vulnerability":"VCID-ue18-zzau-x7hy"},{"vulnerability":"VCID-vdzj-kqfy-d3b7"},{"vulnerability":"VCID-vwbu-ruxm-tbh4"},{"vulnerability":"VCID-vxh1-8rvt-kkak"},{"vulnerability":"VCID-vyzt-df2u-h3cc"},{"vulnerability":"VCID-w9uy-fnpm-cbak"},{"vulnerability":"VCID-x15z-dejc-9ba6"},{"vulnerability":"VCID-xesd-d294-7fcx"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:pypi/pillow@7.1.0"}],"aliases":["BIT-pillow-2020-10994","CVE-2020-10994","GHSA-vj42-xq3r-hr3r","PYSEC-2020-79"],"risk_score":4.0,"exploitability":"0.5","weighted_severity":"8.0","resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-uf5t-asns-tudp"},{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/18987?format=json","vulnerability_id":"VCID-vdzj-kqfy-d3b7","summary":"libwebp: OOB write in BuildHuffmanTable\nHeap buffer overflow in libwebp allow a remote attacker to perform an out of bounds memory write via a crafted HTML page.","references":[{"reference_url":"https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2023-4863.json","reference_id":"","reference_type":"","scores":[{"value":"9.6","scoring_system":"cvssv3","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H"}],"url":"https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2023-4863.json"},{"reference_url":"https://adamcaudill.com/2023/09/14/whose-cve-is-it-anyway","reference_id":"","reference_type":"","scores":[{"value":"8.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://adamcaudill.com/2023/09/14/whose-cve-is-it-anyway"},{"reference_url":"https://adamcaudill.com/2023/09/14/whose-cve-is-it-anyway/","reference_id":"","reference_type":"","scores":[{"value":"8.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"},{"value":"Attend","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:A/A:N/T:T/P:M/B:A/M:M/D:A/2023-11-28T05:00:18Z/"}],"url":"https://adamcaudill.com/2023/09/14/whose-cve-is-it-anyway/"},{"reference_url":"https://api.first.org/data/v1/epss?cve=CVE-2023-4863","reference_id":"","reference_type":"","scores":[{"value":"0.93606","scoring_system":"epss","scoring_elements":"0.99837","published_at":"2026-04-18T12:55:00Z"},{"value":"0.93606","scoring_system":"epss","scoring_elements":"0.99835","published_at":"2026-04-07T12:55:00Z"},{"value":"0.93606","scoring_system":"epss","scoring_elements":"0.99836","published_at":"2026-04-13T12:55:00Z"},{"value":"0.94083","scoring_system":"epss","scoring_elements":"0.99908","published_at":"2026-05-05T12:55:00Z"},{"value":"0.94083","scoring_system":"epss","scoring_elements":"0.99907","published_at":"2026-04-29T12:55:00Z"},{"value":"0.94083","scoring_system":"epss","scoring_elements":"0.99905","published_at":"2026-04-12T12:55:00Z"},{"value":"0.94117","scoring_system":"epss","scoring_elements":"0.99911","published_at":"2026-04-21T12:55:00Z"},{"value":"0.94117","scoring_system":"epss","scoring_elements":"0.9991","published_at":"2026-04-02T12:55:00Z"},{"value":"0.94117","scoring_system":"epss","scoring_elements":"0.99909","published_at":"2026-04-04T12:55:00Z"}],"url":"https://api.first.org/data/v1/epss?cve=CVE-2023-4863"},{"reference_url":"https://blog.isosceles.com/the-webp-0day","reference_id":"","reference_type":"","scores":[{"value":"8.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://blog.isosceles.com/the-webp-0day"},{"reference_url":"https://bugzilla.suse.com/show_bug.cgi?id=1215231","reference_id":"","reference_type":"","scores":[{"value":"8.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""},{"value":"Attend","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:A/A:N/T:T/P:M/B:A/M:M/D:A/2023-11-28T05:00:18Z/"}],"url":"https://bugzilla.suse.com/show_bug.cgi?id=1215231"},{"reference_url":"https://chromereleases.googleblog.com/2023/09/stable-channel-update-for-desktop_11.html","reference_id":"","reference_type":"","scores":[{"value":"8.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""},{"value":"Attend","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:A/A:N/T:T/P:M/B:A/M:M/D:A/2023-11-28T05:00:18Z/"}],"url":"https://chromereleases.googleblog.com/2023/09/stable-channel-update-for-desktop_11.html"},{"reference_url":"https://crbug.com/1479274","reference_id":"","reference_type":"","scores":[{"value":"8.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""},{"value":"Attend","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:A/A:N/T:T/P:M/B:A/M:M/D:A/2023-11-28T05:00:18Z/"}],"url":"https://crbug.com/1479274"},{"reference_url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-4863","reference_id":"","reference_type":"","scores":[],"url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-4863"},{"reference_url":"https://en.bandisoft.com/honeyview/history","reference_id":"","reference_type":"","scores":[{"value":"8.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://en.bandisoft.com/honeyview/history"},{"reference_url":"https://en.bandisoft.com/honeyview/history/","reference_id":"","reference_type":"","scores":[{"value":"8.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"},{"value":"Attend","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:A/A:N/T:T/P:M/B:A/M:M/D:A/2023-11-28T05:00:18Z/"}],"url":"https://en.bandisoft.com/honeyview/history/"},{"reference_url":"https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml","reference_id":"","reference_type":"","scores":[{"value":"8.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"}],"url":"https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml"},{"reference_url":"https://github.com/dlemstra/Magick.NET/releases/tag/13.3.0","reference_id":"","reference_type":"","scores":[{"value":"8.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/dlemstra/Magick.NET/releases/tag/13.3.0"},{"reference_url":"https://github.com/electron/electron/pull/39823","reference_id":"","reference_type":"","scores":[{"value":"8.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/electron/electron/pull/39823"},{"reference_url":"https://github.com/electron/electron/pull/39825","reference_id":"","reference_type":"","scores":[{"value":"8.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/electron/electron/pull/39825"},{"reference_url":"https://github.com/electron/electron/pull/39826","reference_id":"","reference_type":"","scores":[{"value":"8.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/electron/electron/pull/39826"},{"reference_url":"https://github.com/electron/electron/pull/39827","reference_id":"","reference_type":"","scores":[{"value":"8.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/electron/electron/pull/39827"},{"reference_url":"https://github.com/electron/electron/pull/39828","reference_id":"","reference_type":"","scores":[{"value":"8.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/electron/electron/pull/39828"},{"reference_url":"https://github.com/ImageMagick/ImageMagick/discussions/6664","reference_id":"","reference_type":"","scores":[{"value":"8.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/ImageMagick/ImageMagick/discussions/6664"},{"reference_url":"https://github.com/jaredforth/webp/commit/9d4c56e63abecc777df71c702503c3eaabd7dcbc","reference_id":"","reference_type":"","scores":[{"value":"8.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/jaredforth/webp/commit/9d4c56e63abecc777df71c702503c3eaabd7dcbc"},{"reference_url":"https://github.com/jaredforth/webp/pull/30","reference_id":"","reference_type":"","scores":[{"value":"8.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/jaredforth/webp/pull/30"},{"reference_url":"https://github.com/python-pillow/Pillow/pull/7395","reference_id":"","reference_type":"","scores":[{"value":"8.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/python-pillow/Pillow/pull/7395"},{"reference_url":"https://github.com/qnighy/libwebp-sys2-rs/commit/4560c473a76ec8bd8c650f19ddf9d7a44f719f8b","reference_id":"","reference_type":"","scores":[{"value":"8.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/qnighy/libwebp-sys2-rs/commit/4560c473a76ec8bd8c650f19ddf9d7a44f719f8b"},{"reference_url":"https://github.com/qnighy/libwebp-sys2-rs/pull/21","reference_id":"","reference_type":"","scores":[{"value":"8.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/qnighy/libwebp-sys2-rs/pull/21"},{"reference_url":"https://github.com/webmproject/libwebp","reference_id":"","reference_type":"","scores":[{"value":"8.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/webmproject/libwebp"},{"reference_url":"https://github.com/webmproject/libwebp/commit/902bc9190331343b2017211debcec8d2ab87e17a","reference_id":"","reference_type":"","scores":[{"value":"8.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""},{"value":"Attend","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:A/A:N/T:T/P:M/B:A/M:M/D:A/2023-11-28T05:00:18Z/"}],"url":"https://github.com/webmproject/libwebp/commit/902bc9190331343b2017211debcec8d2ab87e17a"},{"reference_url":"https://github.com/webmproject/libwebp/releases/tag/v1.3.2","reference_id":"","reference_type":"","scores":[{"value":"8.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""},{"value":"Attend","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:A/A:N/T:T/P:M/B:A/M:M/D:A/2023-11-28T05:00:18Z/"}],"url":"https://github.com/webmproject/libwebp/releases/tag/v1.3.2"},{"reference_url":"https://lists.debian.org/debian-lts-announce/2023/09/msg00015.html","reference_id":"","reference_type":"","scores":[{"value":"8.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""},{"value":"Attend","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:A/A:N/T:T/P:M/B:A/M:M/D:A/2023-11-28T05:00:18Z/"}],"url":"https://lists.debian.org/debian-lts-announce/2023/09/msg00015.html"},{"reference_url":"https://lists.debian.org/debian-lts-announce/2023/09/msg00016.html","reference_id":"","reference_type":"","scores":[{"value":"8.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""},{"value":"Attend","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:A/A:N/T:T/P:M/B:A/M:M/D:A/2023-11-28T05:00:18Z/"}],"url":"https://lists.debian.org/debian-lts-announce/2023/09/msg00016.html"},{"reference_url":"https://lists.debian.org/debian-lts-announce/2023/09/msg00017.html","reference_id":"","reference_type":"","scores":[{"value":"8.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""},{"value":"Attend","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:A/A:N/T:T/P:M/B:A/M:M/D:A/2023-11-28T05:00:18Z/"}],"url":"https://lists.debian.org/debian-lts-announce/2023/09/msg00017.html"},{"reference_url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6T655QF7CQ3DYAMPFV7IECQYGDEUIVVT","reference_id":"","reference_type":"","scores":[{"value":"8.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6T655QF7CQ3DYAMPFV7IECQYGDEUIVVT"},{"reference_url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6T655QF7CQ3DYAMPFV7IECQYGDEUIVVT/","reference_id":"","reference_type":"","scores":[{"value":"8.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"},{"value":"Attend","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:A/A:N/T:T/P:M/B:A/M:M/D:A/2023-11-28T05:00:18Z/"}],"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6T655QF7CQ3DYAMPFV7IECQYGDEUIVVT/"},{"reference_url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/FYYKLG6CRGEDTNRBSU26EEWAO6D6U645","reference_id":"","reference_type":"","scores":[{"value":"8.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/FYYKLG6CRGEDTNRBSU26EEWAO6D6U645"},{"reference_url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/FYYKLG6CRGEDTNRBSU26EEWAO6D6U645/","reference_id":"","reference_type":"","scores":[{"value":"8.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"},{"value":"Attend","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:A/A:N/T:T/P:M/B:A/M:M/D:A/2023-11-28T05:00:18Z/"}],"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/FYYKLG6CRGEDTNRBSU26EEWAO6D6U645/"},{"reference_url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/KUQ7CTX3W372X3UY56VVNAHCH6H2F4X3","reference_id":"","reference_type":"","scores":[{"value":"8.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/KUQ7CTX3W372X3UY56VVNAHCH6H2F4X3"},{"reference_url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/OZDGWWMJREPAGKWCJKSCM4WYLANSKIFX","reference_id":"","reference_type":"","scores":[{"value":"8.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/OZDGWWMJREPAGKWCJKSCM4WYLANSKIFX"},{"reference_url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/OZDGWWMJREPAGKWCJKSCM4WYLANSKIFX/","reference_id":"","reference_type":"","scores":[{"value":"8.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"},{"value":"Attend","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:A/A:N/T:T/P:M/B:A/M:M/D:A/2023-11-28T05:00:18Z/"}],"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/OZDGWWMJREPAGKWCJKSCM4WYLANSKIFX/"},{"reference_url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/PYZV7TMKF4QHZ54SFJX54BDN52VHGGCX","reference_id":"","reference_type":"","scores":[{"value":"8.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/PYZV7TMKF4QHZ54SFJX54BDN52VHGGCX"},{"reference_url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/PYZV7TMKF4QHZ54SFJX54BDN52VHGGCX/","reference_id":"","reference_type":"","scores":[{"value":"8.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"},{"value":"Attend","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:A/A:N/T:T/P:M/B:A/M:M/D:A/2023-11-28T05:00:18Z/"}],"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/PYZV7TMKF4QHZ54SFJX54BDN52VHGGCX/"},{"reference_url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/WHOLML7N2G5KCAZXFWC5IDFFHSQS5SDB","reference_id":"","reference_type":"","scores":[{"value":"8.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/WHOLML7N2G5KCAZXFWC5IDFFHSQS5SDB"},{"reference_url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/WHOLML7N2G5KCAZXFWC5IDFFHSQS5SDB/","reference_id":"","reference_type":"","scores":[{"value":"8.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"},{"value":"Attend","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:A/A:N/T:T/P:M/B:A/M:M/D:A/2023-11-28T05:00:18Z/"}],"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/WHOLML7N2G5KCAZXFWC5IDFFHSQS5SDB/"},{"reference_url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/WTRUIS3564P7ZLM2S2IH4Y4KZ327LI4I","reference_id":"","reference_type":"","scores":[{"value":"8.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/WTRUIS3564P7ZLM2S2IH4Y4KZ327LI4I"},{"reference_url":"https://news.ycombinator.com/item?id=37478403","reference_id":"","reference_type":"","scores":[{"value":"8.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""},{"value":"Attend","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:A/A:N/T:T/P:M/B:A/M:M/D:A/2023-11-28T05:00:18Z/"}],"url":"https://news.ycombinator.com/item?id=37478403"},{"reference_url":"https://nvd.nist.gov/vuln/detail/CVE-2023-4863","reference_id":"","reference_type":"","scores":[{"value":"8.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-4863"},{"reference_url":"https://pillow.readthedocs.io/en/stable/releasenotes/10.0.1.html#security","reference_id":"","reference_type":"","scores":[{"value":"8.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://pillow.readthedocs.io/en/stable/releasenotes/10.0.1.html#security"},{"reference_url":"https://rustsec.org/advisories/RUSTSEC-2023-0060.html","reference_id":"","reference_type":"","scores":[{"value":"8.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://rustsec.org/advisories/RUSTSEC-2023-0060.html"},{"reference_url":"https://rustsec.org/advisories/RUSTSEC-2023-0061.html","reference_id":"","reference_type":"","scores":[{"value":"8.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://rustsec.org/advisories/RUSTSEC-2023-0061.html"},{"reference_url":"https://security.gentoo.org/glsa/202309-05","reference_id":"","reference_type":"","scores":[{"value":"8.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""},{"value":"Attend","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:A/A:N/T:T/P:M/B:A/M:M/D:A/2023-11-28T05:00:18Z/"}],"url":"https://security.gentoo.org/glsa/202309-05"},{"reference_url":"https://security.gentoo.org/glsa/202401-10","reference_id":"","reference_type":"","scores":[{"value":"8.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""},{"value":"Attend","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:A/A:N/T:T/P:M/B:A/M:M/D:A/2023-11-28T05:00:18Z/"}],"url":"https://security.gentoo.org/glsa/202401-10"},{"reference_url":"https://security.netapp.com/advisory/ntap-20230929-0011","reference_id":"","reference_type":"","scores":[{"value":"8.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://security.netapp.com/advisory/ntap-20230929-0011"},{"reference_url":"https://sethmlarson.dev/security-developer-in-residence-weekly-report-16","reference_id":"","reference_type":"","scores":[{"value":"8.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""},{"value":"Attend","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:A/A:N/T:T/P:M/B:A/M:M/D:A/2023-11-28T05:00:18Z/"}],"url":"https://sethmlarson.dev/security-developer-in-residence-weekly-report-16"},{"reference_url":"https://stackdiary.com/critical-vulnerability-in-webp-codec-cve-2023-4863","reference_id":"","reference_type":"","scores":[{"value":"8.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://stackdiary.com/critical-vulnerability-in-webp-codec-cve-2023-4863"},{"reference_url":"https://stackdiary.com/critical-vulnerability-in-webp-codec-cve-2023-4863/","reference_id":"","reference_type":"","scores":[{"value":"8.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"},{"value":"Attend","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:A/A:N/T:T/P:M/B:A/M:M/D:A/2023-11-28T05:00:18Z/"}],"url":"https://stackdiary.com/critical-vulnerability-in-webp-codec-cve-2023-4863/"},{"reference_url":"https://www.bentley.com/advisories/be-2023-0001","reference_id":"","reference_type":"","scores":[{"value":"8.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://www.bentley.com/advisories/be-2023-0001"},{"reference_url":"https://www.bleepingcomputer.com/news/google/google-fixes-another-chrome-zero-day-bug-exploited-in-attacks","reference_id":"","reference_type":"","scores":[{"value":"8.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://www.bleepingcomputer.com/news/google/google-fixes-another-chrome-zero-day-bug-exploited-in-attacks"},{"reference_url":"https://www.bleepingcomputer.com/news/google/google-fixes-another-chrome-zero-day-bug-exploited-in-attacks/","reference_id":"","reference_type":"","scores":[{"value":"8.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"},{"value":"Attend","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:A/A:N/T:T/P:M/B:A/M:M/D:A/2023-11-28T05:00:18Z/"}],"url":"https://www.bleepingcomputer.com/news/google/google-fixes-another-chrome-zero-day-bug-exploited-in-attacks/"},{"reference_url":"https://www.debian.org/security/2023/dsa-5496","reference_id":"","reference_type":"","scores":[{"value":"8.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""},{"value":"Attend","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:A/A:N/T:T/P:M/B:A/M:M/D:A/2023-11-28T05:00:18Z/"}],"url":"https://www.debian.org/security/2023/dsa-5496"},{"reference_url":"https://www.debian.org/security/2023/dsa-5497","reference_id":"","reference_type":"","scores":[{"value":"8.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""},{"value":"Attend","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:A/A:N/T:T/P:M/B:A/M:M/D:A/2023-11-28T05:00:18Z/"}],"url":"https://www.debian.org/security/2023/dsa-5497"},{"reference_url":"https://www.debian.org/security/2023/dsa-5498","reference_id":"","reference_type":"","scores":[{"value":"8.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""},{"value":"Attend","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:A/A:N/T:T/P:M/B:A/M:M/D:A/2023-11-28T05:00:18Z/"}],"url":"https://www.debian.org/security/2023/dsa-5498"},{"reference_url":"https://www.mozilla.org/en-US/security/advisories/mfsa2023-40","reference_id":"","reference_type":"","scores":[{"value":"8.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"},{"value":"critical","scoring_system":"generic_textual","scoring_elements":""},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://www.mozilla.org/en-US/security/advisories/mfsa2023-40"},{"reference_url":"https://www.mozilla.org/en-US/security/advisories/mfsa2023-40/","reference_id":"","reference_type":"","scores":[{"value":"8.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"},{"value":"Attend","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:A/A:N/T:T/P:M/B:A/M:M/D:A/2023-11-28T05:00:18Z/"}],"url":"https://www.mozilla.org/en-US/security/advisories/mfsa2023-40/"},{"reference_url":"https://www.vicarius.io/vsociety/posts/zero-day-webp-vulnerability-cve-2023-4863","reference_id":"","reference_type":"","scores":[{"value":"8.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://www.vicarius.io/vsociety/posts/zero-day-webp-vulnerability-cve-2023-4863"},{"reference_url":"http://www.openwall.com/lists/oss-security/2023/09/21/4","reference_id":"","reference_type":"","scores":[{"value":"8.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""},{"value":"Attend","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:A/A:N/T:T/P:M/B:A/M:M/D:A/2023-11-28T05:00:18Z/"}],"url":"http://www.openwall.com/lists/oss-security/2023/09/21/4"},{"reference_url":"http://www.openwall.com/lists/oss-security/2023/09/22/1","reference_id":"","reference_type":"","scores":[{"value":"8.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""},{"value":"Attend","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:A/A:N/T:T/P:M/B:A/M:M/D:A/2023-11-28T05:00:18Z/"}],"url":"http://www.openwall.com/lists/oss-security/2023/09/22/1"},{"reference_url":"http://www.openwall.com/lists/oss-security/2023/09/22/3","reference_id":"","reference_type":"","scores":[{"value":"8.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""},{"value":"Attend","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:A/A:N/T:T/P:M/B:A/M:M/D:A/2023-11-28T05:00:18Z/"}],"url":"http://www.openwall.com/lists/oss-security/2023/09/22/3"},{"reference_url":"http://www.openwall.com/lists/oss-security/2023/09/22/4","reference_id":"","reference_type":"","scores":[{"value":"8.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""},{"value":"Attend","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:A/A:N/T:T/P:M/B:A/M:M/D:A/2023-11-28T05:00:18Z/"}],"url":"http://www.openwall.com/lists/oss-security/2023/09/22/4"},{"reference_url":"http://www.openwall.com/lists/oss-security/2023/09/22/5","reference_id":"","reference_type":"","scores":[{"value":"8.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""},{"value":"Attend","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:A/A:N/T:T/P:M/B:A/M:M/D:A/2023-11-28T05:00:18Z/"}],"url":"http://www.openwall.com/lists/oss-security/2023/09/22/5"},{"reference_url":"http://www.openwall.com/lists/oss-security/2023/09/22/6","reference_id":"","reference_type":"","scores":[{"value":"8.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""},{"value":"Attend","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:A/A:N/T:T/P:M/B:A/M:M/D:A/2023-11-28T05:00:18Z/"}],"url":"http://www.openwall.com/lists/oss-security/2023/09/22/6"},{"reference_url":"http://www.openwall.com/lists/oss-security/2023/09/22/7","reference_id":"","reference_type":"","scores":[{"value":"8.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""},{"value":"Attend","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:A/A:N/T:T/P:M/B:A/M:M/D:A/2023-11-28T05:00:18Z/"}],"url":"http://www.openwall.com/lists/oss-security/2023/09/22/7"},{"reference_url":"http://www.openwall.com/lists/oss-security/2023/09/22/8","reference_id":"","reference_type":"","scores":[{"value":"8.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""},{"value":"Attend","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:A/A:N/T:T/P:M/B:A/M:M/D:A/2023-11-28T05:00:18Z/"}],"url":"http://www.openwall.com/lists/oss-security/2023/09/22/8"},{"reference_url":"http://www.openwall.com/lists/oss-security/2023/09/26/1","reference_id":"","reference_type":"","scores":[{"value":"8.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""},{"value":"Attend","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:A/A:N/T:T/P:M/B:A/M:M/D:A/2023-11-28T05:00:18Z/"}],"url":"http://www.openwall.com/lists/oss-security/2023/09/26/1"},{"reference_url":"http://www.openwall.com/lists/oss-security/2023/09/26/7","reference_id":"","reference_type":"","scores":[{"value":"8.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""},{"value":"Attend","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:A/A:N/T:T/P:M/B:A/M:M/D:A/2023-11-28T05:00:18Z/"}],"url":"http://www.openwall.com/lists/oss-security/2023/09/26/7"},{"reference_url":"http://www.openwall.com/lists/oss-security/2023/09/28/1","reference_id":"","reference_type":"","scores":[{"value":"8.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""},{"value":"Attend","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:A/A:N/T:T/P:M/B:A/M:M/D:A/2023-11-28T05:00:18Z/"}],"url":"http://www.openwall.com/lists/oss-security/2023/09/28/1"},{"reference_url":"http://www.openwall.com/lists/oss-security/2023/09/28/2","reference_id":"","reference_type":"","scores":[{"value":"8.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""},{"value":"Attend","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:A/A:N/T:T/P:M/B:A/M:M/D:A/2023-11-28T05:00:18Z/"}],"url":"http://www.openwall.com/lists/oss-security/2023/09/28/2"},{"reference_url":"http://www.openwall.com/lists/oss-security/2023/09/28/4","reference_id":"","reference_type":"","scores":[{"value":"8.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""},{"value":"Attend","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:A/A:N/T:T/P:M/B:A/M:M/D:A/2023-11-28T05:00:18Z/"}],"url":"http://www.openwall.com/lists/oss-security/2023/09/28/4"},{"reference_url":"https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1051787","reference_id":"1051787","reference_type":"","scores":[],"url":"https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1051787"},{"reference_url":"https://bugzilla.redhat.com/show_bug.cgi?id=2238431","reference_id":"2238431","reference_type":"","scores":[],"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2238431"},{"reference_url":"https://www.bentley.com/advisories/be-2023-0001/","reference_id":"be-2023-0001","reference_type":"","scores":[{"value":"8.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"},{"value":"Attend","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:A/A:N/T:T/P:M/B:A/M:M/D:A/2023-11-28T05:00:18Z/"}],"url":"https://www.bentley.com/advisories/be-2023-0001/"},{"reference_url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-4863","reference_id":"CVE-2023-4863","reference_type":"","scores":[{"value":"8.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""},{"value":"Attend","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:A/A:N/T:T/P:M/B:A/M:M/D:A/2023-11-28T05:00:18Z/"}],"url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-4863"},{"reference_url":"https://security-tracker.debian.org/tracker/CVE-2023-4863","reference_id":"CVE-2023-4863","reference_type":"","scores":[{"value":"8.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""},{"value":"Attend","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:A/A:N/T:T/P:M/B:A/M:M/D:A/2023-11-28T05:00:18Z/"}],"url":"https://security-tracker.debian.org/tracker/CVE-2023-4863"},{"reference_url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/KUQ7CTX3W372X3UY56VVNAHCH6H2F4X3/","reference_id":"KUQ7CTX3W372X3UY56VVNAHCH6H2F4X3","reference_type":"","scores":[{"value":"8.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"},{"value":"Attend","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:A/A:N/T:T/P:M/B:A/M:M/D:A/2023-11-28T05:00:18Z/"}],"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/KUQ7CTX3W372X3UY56VVNAHCH6H2F4X3/"},{"reference_url":"https://security.netapp.com/advisory/ntap-20230929-0011/","reference_id":"ntap-20230929-0011","reference_type":"","scores":[{"value":"8.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"},{"value":"Attend","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:A/A:N/T:T/P:M/B:A/M:M/D:A/2023-11-28T05:00:18Z/"}],"url":"https://security.netapp.com/advisory/ntap-20230929-0011/"},{"reference_url":"https://access.redhat.com/errata/RHSA-2023:5183","reference_id":"RHSA-2023:5183","reference_type":"","scores":[],"url":"https://access.redhat.com/errata/RHSA-2023:5183"},{"reference_url":"https://access.redhat.com/errata/RHSA-2023:5184","reference_id":"RHSA-2023:5184","reference_type":"","scores":[],"url":"https://access.redhat.com/errata/RHSA-2023:5184"},{"reference_url":"https://access.redhat.com/errata/RHSA-2023:5185","reference_id":"RHSA-2023:5185","reference_type":"","scores":[],"url":"https://access.redhat.com/errata/RHSA-2023:5185"},{"reference_url":"https://access.redhat.com/errata/RHSA-2023:5186","reference_id":"RHSA-2023:5186","reference_type":"","scores":[],"url":"https://access.redhat.com/errata/RHSA-2023:5186"},{"reference_url":"https://access.redhat.com/errata/RHSA-2023:5187","reference_id":"RHSA-2023:5187","reference_type":"","scores":[],"url":"https://access.redhat.com/errata/RHSA-2023:5187"},{"reference_url":"https://access.redhat.com/errata/RHSA-2023:5188","reference_id":"RHSA-2023:5188","reference_type":"","scores":[],"url":"https://access.redhat.com/errata/RHSA-2023:5188"},{"reference_url":"https://access.redhat.com/errata/RHSA-2023:5189","reference_id":"RHSA-2023:5189","reference_type":"","scores":[],"url":"https://access.redhat.com/errata/RHSA-2023:5189"},{"reference_url":"https://access.redhat.com/errata/RHSA-2023:5190","reference_id":"RHSA-2023:5190","reference_type":"","scores":[],"url":"https://access.redhat.com/errata/RHSA-2023:5190"},{"reference_url":"https://access.redhat.com/errata/RHSA-2023:5191","reference_id":"RHSA-2023:5191","reference_type":"","scores":[],"url":"https://access.redhat.com/errata/RHSA-2023:5191"},{"reference_url":"https://access.redhat.com/errata/RHSA-2023:5192","reference_id":"RHSA-2023:5192","reference_type":"","scores":[],"url":"https://access.redhat.com/errata/RHSA-2023:5192"},{"reference_url":"https://access.redhat.com/errata/RHSA-2023:5197","reference_id":"RHSA-2023:5197","reference_type":"","scores":[],"url":"https://access.redhat.com/errata/RHSA-2023:5197"},{"reference_url":"https://access.redhat.com/errata/RHSA-2023:5198","reference_id":"RHSA-2023:5198","reference_type":"","scores":[],"url":"https://access.redhat.com/errata/RHSA-2023:5198"},{"reference_url":"https://access.redhat.com/errata/RHSA-2023:5200","reference_id":"RHSA-2023:5200","reference_type":"","scores":[],"url":"https://access.redhat.com/errata/RHSA-2023:5200"},{"reference_url":"https://access.redhat.com/errata/RHSA-2023:5201","reference_id":"RHSA-2023:5201","reference_type":"","scores":[],"url":"https://access.redhat.com/errata/RHSA-2023:5201"},{"reference_url":"https://access.redhat.com/errata/RHSA-2023:5202","reference_id":"RHSA-2023:5202","reference_type":"","scores":[],"url":"https://access.redhat.com/errata/RHSA-2023:5202"},{"reference_url":"https://access.redhat.com/errata/RHSA-2023:5204","reference_id":"RHSA-2023:5204","reference_type":"","scores":[],"url":"https://access.redhat.com/errata/RHSA-2023:5204"},{"reference_url":"https://access.redhat.com/errata/RHSA-2023:5205","reference_id":"RHSA-2023:5205","reference_type":"","scores":[],"url":"https://access.redhat.com/errata/RHSA-2023:5205"},{"reference_url":"https://access.redhat.com/errata/RHSA-2023:5214","reference_id":"RHSA-2023:5214","reference_type":"","scores":[],"url":"https://access.redhat.com/errata/RHSA-2023:5214"},{"reference_url":"https://access.redhat.com/errata/RHSA-2023:5222","reference_id":"RHSA-2023:5222","reference_type":"","scores":[],"url":"https://access.redhat.com/errata/RHSA-2023:5222"},{"reference_url":"https://access.redhat.com/errata/RHSA-2023:5223","reference_id":"RHSA-2023:5223","reference_type":"","scores":[],"url":"https://access.redhat.com/errata/RHSA-2023:5223"},{"reference_url":"https://access.redhat.com/errata/RHSA-2023:5224","reference_id":"RHSA-2023:5224","reference_type":"","scores":[],"url":"https://access.redhat.com/errata/RHSA-2023:5224"},{"reference_url":"https://access.redhat.com/errata/RHSA-2023:5236","reference_id":"RHSA-2023:5236","reference_type":"","scores":[],"url":"https://access.redhat.com/errata/RHSA-2023:5236"},{"reference_url":"https://access.redhat.com/errata/RHSA-2023:5309","reference_id":"RHSA-2023:5309","reference_type":"","scores":[],"url":"https://access.redhat.com/errata/RHSA-2023:5309"},{"reference_url":"https://usn.ubuntu.com/6367-1/","reference_id":"USN-6367-1","reference_type":"","scores":[],"url":"https://usn.ubuntu.com/6367-1/"},{"reference_url":"https://usn.ubuntu.com/6368-1/","reference_id":"USN-6368-1","reference_type":"","scores":[],"url":"https://usn.ubuntu.com/6368-1/"},{"reference_url":"https://usn.ubuntu.com/6369-1/","reference_id":"USN-6369-1","reference_type":"","scores":[],"url":"https://usn.ubuntu.com/6369-1/"},{"reference_url":"https://usn.ubuntu.com/6369-2/","reference_id":"USN-6369-2","reference_type":"","scores":[],"url":"https://usn.ubuntu.com/6369-2/"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/54025?format=json","purl":"pkg:pypi/pillow@10.0.1","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-64n5-pugj-vue8"},{"vulnerability":"VCID-9ckw-ra54-z3b7"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:pypi/pillow@10.0.1"}],"aliases":["CVE-2023-4863","GHSA-j7hp-h8jx-5ppr"],"risk_score":10.0,"exploitability":"2.0","weighted_severity":"9.0","resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-vdzj-kqfy-d3b7"},{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/6293?format=json","vulnerability_id":"VCID-vwbu-ruxm-tbh4","summary":"An issue was discovered in Pillow before 8.1.1. In TiffDecode.c, there is an out-of-bounds read in TiffreadRGBATile via invalid tile boundaries.","references":[{"reference_url":"https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2021-25291.json","reference_id":"","reference_type":"","scores":[{"value":"7.5","scoring_system":"cvssv3","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"url":"https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2021-25291.json"},{"reference_url":"https://api.first.org/data/v1/epss?cve=CVE-2021-25291","reference_id":"","reference_type":"","scores":[{"value":"0.00536","scoring_system":"epss","scoring_elements":"0.67486","published_at":"2026-04-08T12:55:00Z"},{"value":"0.00536","scoring_system":"epss","scoring_elements":"0.67508","published_at":"2026-05-05T12:55:00Z"},{"value":"0.00536","scoring_system":"epss","scoring_elements":"0.67534","published_at":"2026-04-29T12:55:00Z"},{"value":"0.00536","scoring_system":"epss","scoring_elements":"0.67533","published_at":"2026-04-26T12:55:00Z"},{"value":"0.00536","scoring_system":"epss","scoring_elements":"0.67522","published_at":"2026-04-24T12:55:00Z"},{"value":"0.00536","scoring_system":"epss","scoring_elements":"0.67503","published_at":"2026-04-21T12:55:00Z"},{"value":"0.00536","scoring_system":"epss","scoring_elements":"0.67524","published_at":"2026-04-18T12:55:00Z"},{"value":"0.00536","scoring_system":"epss","scoring_elements":"0.67512","published_at":"2026-04-16T12:55:00Z"},{"value":"0.00536","scoring_system":"epss","scoring_elements":"0.67476","published_at":"2026-04-13T12:55:00Z"},{"value":"0.00536","scoring_system":"epss","scoring_elements":"0.6751","published_at":"2026-04-12T12:55:00Z"},{"value":"0.00536","scoring_system":"epss","scoring_elements":"0.67523","published_at":"2026-04-11T12:55:00Z"},{"value":"0.00536","scoring_system":"epss","scoring_elements":"0.67398","published_at":"2026-04-01T12:55:00Z"},{"value":"0.00536","scoring_system":"epss","scoring_elements":"0.675","published_at":"2026-04-09T12:55:00Z"},{"value":"0.00536","scoring_system":"epss","scoring_elements":"0.67434","published_at":"2026-04-07T12:55:00Z"},{"value":"0.00536","scoring_system":"epss","scoring_elements":"0.67455","published_at":"2026-04-04T12:55:00Z"}],"url":"https://api.first.org/data/v1/epss?cve=CVE-2021-25291"},{"reference_url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-25291","reference_id":"","reference_type":"","scores":[],"url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-25291"},{"reference_url":"https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml","reference_id":"","reference_type":"","scores":[{"value":"7.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"url":"https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml"},{"reference_url":"https://github.com/advisories/GHSA-mvg9-xffr-p774","reference_id":"","reference_type":"","scores":[{"value":"7.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"},{"value":"HIGH","scoring_system":"cvssv3.1_qr","scoring_elements":""},{"value":"8.7","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/advisories/GHSA-mvg9-xffr-p774"},{"reference_url":"https://github.com/pypa/advisory-database/tree/main/vulns/pillow/PYSEC-2021-37.yaml","reference_id":"","reference_type":"","scores":[{"value":"7.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"},{"value":"8.7","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/pypa/advisory-database/tree/main/vulns/pillow/PYSEC-2021-37.yaml"},{"reference_url":"https://github.com/python-pillow/Pillow","reference_id":"","reference_type":"","scores":[{"value":"7.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"},{"value":"8.7","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/python-pillow/Pillow"},{"reference_url":"https://github.com/python-pillow/Pillow/commit/8b8076bdcb3815be0ef0d279651d8d1342b8ea61","reference_id":"","reference_type":"","scores":[{"value":"7.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"},{"value":"8.7","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/python-pillow/Pillow/commit/8b8076bdcb3815be0ef0d279651d8d1342b8ea61"},{"reference_url":"https://github.com/python-pillow/Pillow/commit/cbdce6c5d054fccaf4af34b47f212355c64ace7a","reference_id":"","reference_type":"","scores":[{"value":"7.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"},{"value":"8.7","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/python-pillow/Pillow/commit/cbdce6c5d054fccaf4af34b47f212355c64ace7a"},{"reference_url":"https://nvd.nist.gov/vuln/detail/CVE-2021-25291","reference_id":"","reference_type":"","scores":[{"value":"7.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"},{"value":"8.7","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-25291"},{"reference_url":"https://pillow.readthedocs.io/en/stable/releasenotes/8.1.1.html","reference_id":"","reference_type":"","scores":[{"value":"7.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"},{"value":"8.7","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://pillow.readthedocs.io/en/stable/releasenotes/8.1.1.html"},{"reference_url":"https://security.gentoo.org/glsa/202107-33","reference_id":"","reference_type":"","scores":[{"value":"7.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"},{"value":"8.7","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://security.gentoo.org/glsa/202107-33"},{"reference_url":"https://bugzilla.redhat.com/show_bug.cgi?id=1934692","reference_id":"1934692","reference_type":"","scores":[],"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1934692"},{"reference_url":"https://security.archlinux.org/AVG-1635","reference_id":"AVG-1635","reference_type":"","scores":[{"value":"Medium","scoring_system":"archlinux","scoring_elements":""}],"url":"https://security.archlinux.org/AVG-1635"},{"reference_url":"https://access.redhat.com/errata/RHSA-2021:3917","reference_id":"RHSA-2021:3917","reference_type":"","scores":[],"url":"https://access.redhat.com/errata/RHSA-2021:3917"},{"reference_url":"https://usn.ubuntu.com/4763-1/","reference_id":"USN-4763-1","reference_type":"","scores":[],"url":"https://usn.ubuntu.com/4763-1/"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/15250?format=json","purl":"pkg:pypi/pillow@8.1.1","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-19e1-19hk-duet"},{"vulnerability":"VCID-1vt7-c6e3-7qc8"},{"vulnerability":"VCID-3qb5-8p8w-gkad"},{"vulnerability":"VCID-3uk9-eds5-rkgc"},{"vulnerability":"VCID-53ac-ceq4-qkhf"},{"vulnerability":"VCID-5rv4-k1q9-zue2"},{"vulnerability":"VCID-64n5-pugj-vue8"},{"vulnerability":"VCID-9ckw-ra54-z3b7"},{"vulnerability":"VCID-aubw-tsmn-ffcq"},{"vulnerability":"VCID-brp2-dtrf-jyfr"},{"vulnerability":"VCID-d7uf-zdbv-sba1"},{"vulnerability":"VCID-df4x-jt3h-17hx"},{"vulnerability":"VCID-dpc3-td9q-dyee"},{"vulnerability":"VCID-g46h-p8jk-cuhc"},{"vulnerability":"VCID-gvjw-funa-sqak"},{"vulnerability":"VCID-n1hp-atex-ubh4"},{"vulnerability":"VCID-n1w5-f5p7-xuhb"},{"vulnerability":"VCID-q4bb-qnxe-8bfa"},{"vulnerability":"VCID-ue18-zzau-x7hy"},{"vulnerability":"VCID-vdzj-kqfy-d3b7"},{"vulnerability":"VCID-vwbu-ruxm-tbh4"},{"vulnerability":"VCID-vyzt-df2u-h3cc"},{"vulnerability":"VCID-w9uy-fnpm-cbak"},{"vulnerability":"VCID-xesd-d294-7fcx"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:pypi/pillow@8.1.1"},{"url":"http://public2.vulnerablecode.io/api/packages/17188?format=json","purl":"pkg:pypi/pillow@8.2.0","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-19e1-19hk-duet"},{"vulnerability":"VCID-1vt7-c6e3-7qc8"},{"vulnerability":"VCID-5rv4-k1q9-zue2"},{"vulnerability":"VCID-64n5-pugj-vue8"},{"vulnerability":"VCID-9ckw-ra54-z3b7"},{"vulnerability":"VCID-brp2-dtrf-jyfr"},{"vulnerability":"VCID-d7uf-zdbv-sba1"},{"vulnerability":"VCID-df4x-jt3h-17hx"},{"vulnerability":"VCID-dpc3-td9q-dyee"},{"vulnerability":"VCID-g46h-p8jk-cuhc"},{"vulnerability":"VCID-n1hp-atex-ubh4"},{"vulnerability":"VCID-q4bb-qnxe-8bfa"},{"vulnerability":"VCID-vdzj-kqfy-d3b7"},{"vulnerability":"VCID-w9uy-fnpm-cbak"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:pypi/pillow@8.2.0"}],"aliases":["BIT-pillow-2021-25291","CVE-2021-25291","GHSA-mvg9-xffr-p774","PYSEC-2021-37"],"risk_score":4.0,"exploitability":"0.5","weighted_severity":"8.0","resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-vwbu-ruxm-tbh4"},{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/6294?format=json","vulnerability_id":"VCID-vxh1-8rvt-kkak","summary":"An issue was discovered in Pillow before 8.1.1. The PDF parser allows a regular expression DoS (ReDoS) attack via a crafted PDF file because of a catastrophic backtracking regex.","references":[{"reference_url":"https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2021-25292.json","reference_id":"","reference_type":"","scores":[{"value":"7.5","scoring_system":"cvssv3","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"url":"https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2021-25292.json"},{"reference_url":"https://api.first.org/data/v1/epss?cve=CVE-2021-25292","reference_id":"","reference_type":"","scores":[{"value":"0.00147","scoring_system":"epss","scoring_elements":"0.35024","published_at":"2026-04-01T12:55:00Z"},{"value":"0.00147","scoring_system":"epss","scoring_elements":"0.35172","published_at":"2026-04-18T12:55:00Z"},{"value":"0.00147","scoring_system":"epss","scoring_elements":"0.35186","published_at":"2026-04-16T12:55:00Z"},{"value":"0.00147","scoring_system":"epss","scoring_elements":"0.35148","published_at":"2026-04-13T12:55:00Z"},{"value":"0.00147","scoring_system":"epss","scoring_elements":"0.35173","published_at":"2026-04-12T12:55:00Z"},{"value":"0.00147","scoring_system":"epss","scoring_elements":"0.35208","published_at":"2026-04-11T12:55:00Z"},{"value":"0.00147","scoring_system":"epss","scoring_elements":"0.35203","published_at":"2026-04-09T12:55:00Z"},{"value":"0.00147","scoring_system":"epss","scoring_elements":"0.35177","published_at":"2026-04-08T12:55:00Z"},{"value":"0.00147","scoring_system":"epss","scoring_elements":"0.35133","published_at":"2026-04-07T12:55:00Z"},{"value":"0.00147","scoring_system":"epss","scoring_elements":"0.35252","published_at":"2026-04-04T12:55:00Z"},{"value":"0.00147","scoring_system":"epss","scoring_elements":"0.35224","published_at":"2026-04-02T12:55:00Z"},{"value":"0.00185","scoring_system":"epss","scoring_elements":"0.39956","published_at":"2026-04-24T12:55:00Z"},{"value":"0.00185","scoring_system":"epss","scoring_elements":"0.39732","published_at":"2026-05-05T12:55:00Z"},{"value":"0.00185","scoring_system":"epss","scoring_elements":"0.40129","published_at":"2026-04-21T12:55:00Z"},{"value":"0.00185","scoring_system":"epss","scoring_elements":"0.39861","published_at":"2026-04-29T12:55:00Z"},{"value":"0.00185","scoring_system":"epss","scoring_elements":"0.39941","published_at":"2026-04-26T12:55:00Z"}],"url":"https://api.first.org/data/v1/epss?cve=CVE-2021-25292"},{"reference_url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-25292","reference_id":"","reference_type":"","scores":[],"url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-25292"},{"reference_url":"https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml","reference_id":"","reference_type":"","scores":[{"value":"7.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"url":"https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml"},{"reference_url":"https://github.com/advisories/GHSA-9hx2-hgq2-2g4f","reference_id":"","reference_type":"","scores":[{"value":"6.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H"},{"value":"MODERATE","scoring_system":"cvssv3.1_qr","scoring_elements":""},{"value":"6.9","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/advisories/GHSA-9hx2-hgq2-2g4f"},{"reference_url":"https://github.com/pypa/advisory-database/tree/main/vulns/pillow/PYSEC-2021-38.yaml","reference_id":"","reference_type":"","scores":[{"value":"6.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H"},{"value":"6.9","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/pypa/advisory-database/tree/main/vulns/pillow/PYSEC-2021-38.yaml"},{"reference_url":"https://github.com/python-pillow/Pillow","reference_id":"","reference_type":"","scores":[{"value":"6.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H"},{"value":"6.9","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/python-pillow/Pillow"},{"reference_url":"https://github.com/python-pillow/Pillow/commit/3bce145966374dd39ce58a6fc0083f8d1890719c","reference_id":"","reference_type":"","scores":[{"value":"6.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H"},{"value":"6.9","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/python-pillow/Pillow/commit/3bce145966374dd39ce58a6fc0083f8d1890719c"},{"reference_url":"https://github.com/python-pillow/Pillow/commit/521dab94c7ab72b037bd9a83e9663401e0fd2cee","reference_id":"","reference_type":"","scores":[{"value":"6.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H"},{"value":"6.9","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/python-pillow/Pillow/commit/521dab94c7ab72b037bd9a83e9663401e0fd2cee"},{"reference_url":"https://github.com/python-pillow/Pillow/commit/6207b44ab1ff4a91d8ddc7579619876d0bb191a4","reference_id":"","reference_type":"","scores":[{"value":"6.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H"},{"value":"6.9","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/python-pillow/Pillow/commit/6207b44ab1ff4a91d8ddc7579619876d0bb191a4"},{"reference_url":"https://nvd.nist.gov/vuln/detail/CVE-2021-25292","reference_id":"","reference_type":"","scores":[{"value":"6.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H"},{"value":"6.9","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-25292"},{"reference_url":"https://pillow.readthedocs.io/en/stable/releasenotes/8.1.1.html","reference_id":"","reference_type":"","scores":[{"value":"6.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H"},{"value":"6.9","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://pillow.readthedocs.io/en/stable/releasenotes/8.1.1.html"},{"reference_url":"https://security.gentoo.org/glsa/202107-33","reference_id":"","reference_type":"","scores":[{"value":"6.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H"},{"value":"6.9","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://security.gentoo.org/glsa/202107-33"},{"reference_url":"https://bugzilla.redhat.com/show_bug.cgi?id=1934699","reference_id":"1934699","reference_type":"","scores":[],"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1934699"},{"reference_url":"https://security.archlinux.org/AVG-1635","reference_id":"AVG-1635","reference_type":"","scores":[{"value":"Medium","scoring_system":"archlinux","scoring_elements":""}],"url":"https://security.archlinux.org/AVG-1635"},{"reference_url":"https://access.redhat.com/errata/RHSA-2021:3917","reference_id":"RHSA-2021:3917","reference_type":"","scores":[],"url":"https://access.redhat.com/errata/RHSA-2021:3917"},{"reference_url":"https://access.redhat.com/errata/RHSA-2021:4149","reference_id":"RHSA-2021:4149","reference_type":"","scores":[],"url":"https://access.redhat.com/errata/RHSA-2021:4149"},{"reference_url":"https://usn.ubuntu.com/4763-1/","reference_id":"USN-4763-1","reference_type":"","scores":[],"url":"https://usn.ubuntu.com/4763-1/"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/15250?format=json","purl":"pkg:pypi/pillow@8.1.1","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-19e1-19hk-duet"},{"vulnerability":"VCID-1vt7-c6e3-7qc8"},{"vulnerability":"VCID-3qb5-8p8w-gkad"},{"vulnerability":"VCID-3uk9-eds5-rkgc"},{"vulnerability":"VCID-53ac-ceq4-qkhf"},{"vulnerability":"VCID-5rv4-k1q9-zue2"},{"vulnerability":"VCID-64n5-pugj-vue8"},{"vulnerability":"VCID-9ckw-ra54-z3b7"},{"vulnerability":"VCID-aubw-tsmn-ffcq"},{"vulnerability":"VCID-brp2-dtrf-jyfr"},{"vulnerability":"VCID-d7uf-zdbv-sba1"},{"vulnerability":"VCID-df4x-jt3h-17hx"},{"vulnerability":"VCID-dpc3-td9q-dyee"},{"vulnerability":"VCID-g46h-p8jk-cuhc"},{"vulnerability":"VCID-gvjw-funa-sqak"},{"vulnerability":"VCID-n1hp-atex-ubh4"},{"vulnerability":"VCID-n1w5-f5p7-xuhb"},{"vulnerability":"VCID-q4bb-qnxe-8bfa"},{"vulnerability":"VCID-ue18-zzau-x7hy"},{"vulnerability":"VCID-vdzj-kqfy-d3b7"},{"vulnerability":"VCID-vwbu-ruxm-tbh4"},{"vulnerability":"VCID-vyzt-df2u-h3cc"},{"vulnerability":"VCID-w9uy-fnpm-cbak"},{"vulnerability":"VCID-xesd-d294-7fcx"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:pypi/pillow@8.1.1"}],"aliases":["BIT-pillow-2021-25292","CVE-2021-25292","GHSA-9hx2-hgq2-2g4f","PYSEC-2021-38"],"risk_score":3.4,"exploitability":"0.5","weighted_severity":"6.8","resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-vxh1-8rvt-kkak"},{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/6468?format=json","vulnerability_id":"VCID-vyzt-df2u-h3cc","summary":"An issue was discovered in Pillow before 8.2.0. For BLP data, BlpImagePlugin did not properly check that reads (after jumping to file offsets) returned data. This could lead to a DoS where the decoder could be run a large number of times on empty data.","references":[{"reference_url":"https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2021-28678.json","reference_id":"","reference_type":"","scores":[{"value":"7.5","scoring_system":"cvssv3","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"url":"https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2021-28678.json"},{"reference_url":"https://api.first.org/data/v1/epss?cve=CVE-2021-28678","reference_id":"","reference_type":"","scores":[{"value":"0.0011","scoring_system":"epss","scoring_elements":"0.28902","published_at":"2026-05-05T12:55:00Z"},{"value":"0.0011","scoring_system":"epss","scoring_elements":"0.2905","published_at":"2026-04-29T12:55:00Z"},{"value":"0.0011","scoring_system":"epss","scoring_elements":"0.29119","published_at":"2026-04-26T12:55:00Z"},{"value":"0.0011","scoring_system":"epss","scoring_elements":"0.29231","published_at":"2026-04-24T12:55:00Z"},{"value":"0.0011","scoring_system":"epss","scoring_elements":"0.29345","published_at":"2026-04-21T12:55:00Z"},{"value":"0.0011","scoring_system":"epss","scoring_elements":"0.2939","published_at":"2026-04-18T12:55:00Z"},{"value":"0.0011","scoring_system":"epss","scoring_elements":"0.29417","published_at":"2026-04-16T12:55:00Z"},{"value":"0.0011","scoring_system":"epss","scoring_elements":"0.29397","published_at":"2026-04-13T12:55:00Z"},{"value":"0.0011","scoring_system":"epss","scoring_elements":"0.29449","published_at":"2026-04-12T12:55:00Z"},{"value":"0.0011","scoring_system":"epss","scoring_elements":"0.29494","published_at":"2026-04-11T12:55:00Z"},{"value":"0.0011","scoring_system":"epss","scoring_elements":"0.29492","published_at":"2026-04-09T12:55:00Z"},{"value":"0.0011","scoring_system":"epss","scoring_elements":"0.29451","published_at":"2026-04-08T12:55:00Z"},{"value":"0.0011","scoring_system":"epss","scoring_elements":"0.29388","published_at":"2026-04-07T12:55:00Z"},{"value":"0.0011","scoring_system":"epss","scoring_elements":"0.29453","published_at":"2026-04-01T12:55:00Z"},{"value":"0.0011","scoring_system":"epss","scoring_elements":"0.29567","published_at":"2026-04-04T12:55:00Z"},{"value":"0.0011","scoring_system":"epss","scoring_elements":"0.29518","published_at":"2026-04-02T12:55:00Z"}],"url":"https://api.first.org/data/v1/epss?cve=CVE-2021-28678"},{"reference_url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-28678","reference_id":"","reference_type":"","scores":[],"url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-28678"},{"reference_url":"https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml","reference_id":"","reference_type":"","scores":[{"value":"7.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"url":"https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml"},{"reference_url":"https://github.com/advisories/GHSA-hjfx-8p6c-g7gx","reference_id":"","reference_type":"","scores":[{"value":"5.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H"},{"value":"MODERATE","scoring_system":"cvssv3.1_qr","scoring_elements":""},{"value":"6.8","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/advisories/GHSA-hjfx-8p6c-g7gx"},{"reference_url":"https://github.com/pypa/advisory-database/tree/main/vulns/pillow/PYSEC-2021-94.yaml","reference_id":"","reference_type":"","scores":[{"value":"5.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H"},{"value":"6.8","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/pypa/advisory-database/tree/main/vulns/pillow/PYSEC-2021-94.yaml"},{"reference_url":"https://github.com/python-pillow/Pillow","reference_id":"","reference_type":"","scores":[{"value":"5.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H"},{"value":"6.8","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/python-pillow/Pillow"},{"reference_url":"https://github.com/python-pillow/Pillow/pull/5377","reference_id":"","reference_type":"","scores":[{"value":"5.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H"},{"value":"6.8","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/python-pillow/Pillow/pull/5377"},{"reference_url":"https://github.com/python-pillow/Pillow/pull/5377/commits/496245aa4365d0827390bd0b6fbd11287453b3a1","reference_id":"","reference_type":"","scores":[{"value":"5.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H"},{"value":"6.8","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/python-pillow/Pillow/pull/5377/commits/496245aa4365d0827390bd0b6fbd11287453b3a1"},{"reference_url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/MQHA5HAIBOYI3R6HDWCLAGFTIQP767FL","reference_id":"","reference_type":"","scores":[{"value":"5.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H"},{"value":"6.8","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/MQHA5HAIBOYI3R6HDWCLAGFTIQP767FL"},{"reference_url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/MQHA5HAIBOYI3R6HDWCLAGFTIQP767FL/","reference_id":"","reference_type":"","scores":[],"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/MQHA5HAIBOYI3R6HDWCLAGFTIQP767FL/"},{"reference_url":"https://nvd.nist.gov/vuln/detail/CVE-2021-28678","reference_id":"","reference_type":"","scores":[{"value":"5.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H"},{"value":"6.8","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-28678"},{"reference_url":"https://pillow.readthedocs.io/en/stable/releasenotes/8.2.0.html#cve-2021-28678-fix-blp-dos","reference_id":"","reference_type":"","scores":[{"value":"5.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H"},{"value":"6.8","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://pillow.readthedocs.io/en/stable/releasenotes/8.2.0.html#cve-2021-28678-fix-blp-dos"},{"reference_url":"https://security.gentoo.org/glsa/202107-33","reference_id":"","reference_type":"","scores":[{"value":"5.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H"},{"value":"6.8","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://security.gentoo.org/glsa/202107-33"},{"reference_url":"https://bugzilla.redhat.com/show_bug.cgi?id=1958263","reference_id":"1958263","reference_type":"","scores":[],"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1958263"},{"reference_url":"https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=989062","reference_id":"989062","reference_type":"","scores":[],"url":"https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=989062"},{"reference_url":"https://access.redhat.com/errata/RHSA-2021:4149","reference_id":"RHSA-2021:4149","reference_type":"","scores":[],"url":"https://access.redhat.com/errata/RHSA-2021:4149"},{"reference_url":"https://usn.ubuntu.com/4963-1/","reference_id":"USN-4963-1","reference_type":"","scores":[],"url":"https://usn.ubuntu.com/4963-1/"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/17188?format=json","purl":"pkg:pypi/pillow@8.2.0","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-19e1-19hk-duet"},{"vulnerability":"VCID-1vt7-c6e3-7qc8"},{"vulnerability":"VCID-5rv4-k1q9-zue2"},{"vulnerability":"VCID-64n5-pugj-vue8"},{"vulnerability":"VCID-9ckw-ra54-z3b7"},{"vulnerability":"VCID-brp2-dtrf-jyfr"},{"vulnerability":"VCID-d7uf-zdbv-sba1"},{"vulnerability":"VCID-df4x-jt3h-17hx"},{"vulnerability":"VCID-dpc3-td9q-dyee"},{"vulnerability":"VCID-g46h-p8jk-cuhc"},{"vulnerability":"VCID-n1hp-atex-ubh4"},{"vulnerability":"VCID-q4bb-qnxe-8bfa"},{"vulnerability":"VCID-vdzj-kqfy-d3b7"},{"vulnerability":"VCID-w9uy-fnpm-cbak"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:pypi/pillow@8.2.0"}],"aliases":["BIT-pillow-2021-28678","CVE-2021-28678","GHSA-hjfx-8p6c-g7gx","PYSEC-2021-94"],"risk_score":3.4,"exploitability":"0.5","weighted_severity":"6.8","resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-vyzt-df2u-h3cc"},{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/5410?format=json","vulnerability_id":"VCID-vz9s-jqpb-2ybf","summary":"PIL/IcnsImagePlugin.py in Python Imaging Library (PIL) and Pillow before 2.3.2 and 2.5.x before 2.5.2 allows remote attackers to cause a denial of service via a crafted block size.","references":[{"reference_url":"http://lists.opensuse.org/opensuse-updates/2015-04/msg00056.html","reference_id":"","reference_type":"","scores":[{"value":"7.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"},{"value":"8.7","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"http://lists.opensuse.org/opensuse-updates/2015-04/msg00056.html"},{"reference_url":"http://osvdb.org/show/osvdb/110128","reference_id":"","reference_type":"","scores":[],"url":"http://osvdb.org/show/osvdb/110128"},{"reference_url":"https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2014-3589.json","reference_id":"","reference_type":"","scores":[],"url":"https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2014-3589.json"},{"reference_url":"https://api.first.org/data/v1/epss?cve=CVE-2014-3589","reference_id":"","reference_type":"","scores":[{"value":"0.00808","scoring_system":"epss","scoring_elements":"0.74187","published_at":"2026-04-04T12:55:00Z"},{"value":"0.00808","scoring_system":"epss","scoring_elements":"0.7416","published_at":"2026-04-02T12:55:00Z"},{"value":"0.00808","scoring_system":"epss","scoring_elements":"0.74154","published_at":"2026-04-01T12:55:00Z"},{"value":"0.01389","scoring_system":"epss","scoring_elements":"0.80441","published_at":"2026-05-05T12:55:00Z"},{"value":"0.01389","scoring_system":"epss","scoring_elements":"0.80304","published_at":"2026-04-07T12:55:00Z"},{"value":"0.01389","scoring_system":"epss","scoring_elements":"0.80332","published_at":"2026-04-08T12:55:00Z"},{"value":"0.01389","scoring_system":"epss","scoring_elements":"0.80343","published_at":"2026-04-09T12:55:00Z"},{"value":"0.01389","scoring_system":"epss","scoring_elements":"0.80361","published_at":"2026-04-11T12:55:00Z"},{"value":"0.01389","scoring_system":"epss","scoring_elements":"0.80347","published_at":"2026-04-12T12:55:00Z"},{"value":"0.01389","scoring_system":"epss","scoring_elements":"0.8034","published_at":"2026-04-13T12:55:00Z"},{"value":"0.01389","scoring_system":"epss","scoring_elements":"0.8037","published_at":"2026-04-16T12:55:00Z"},{"value":"0.01389","scoring_system":"epss","scoring_elements":"0.80371","published_at":"2026-04-18T12:55:00Z"},{"value":"0.01389","scoring_system":"epss","scoring_elements":"0.80376","published_at":"2026-04-21T12:55:00Z"},{"value":"0.01389","scoring_system":"epss","scoring_elements":"0.80402","published_at":"2026-04-24T12:55:00Z"},{"value":"0.01389","scoring_system":"epss","scoring_elements":"0.80409","published_at":"2026-04-26T12:55:00Z"},{"value":"0.01389","scoring_system":"epss","scoring_elements":"0.80426","published_at":"2026-04-29T12:55:00Z"}],"url":"https://api.first.org/data/v1/epss?cve=CVE-2014-3589"},{"reference_url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3589","reference_id":"","reference_type":"","scores":[],"url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3589"},{"reference_url":"http://seclists.org/bugtraq/2014/Sep/25","reference_id":"","reference_type":"","scores":[],"url":"http://seclists.org/bugtraq/2014/Sep/25"},{"reference_url":"http://secunia.com/advisories/59825","reference_id":"","reference_type":"","scores":[],"url":"http://secunia.com/advisories/59825"},{"reference_url":"https://github.com/pypa/advisory-database/tree/main/vulns/pillow/PYSEC-2014-10.yaml","reference_id":"","reference_type":"","scores":[{"value":"7.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"},{"value":"8.7","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/pypa/advisory-database/tree/main/vulns/pillow/PYSEC-2014-10.yaml"},{"reference_url":"https://github.com/python-pillow/Pillow","reference_id":"","reference_type":"","scores":[{"value":"7.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"},{"value":"8.7","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/python-pillow/Pillow"},{"reference_url":"https://github.com/python-pillow/Pillow/commit/205e056f8f9b06ed7b925cf8aa0874bc4aaf8a7d","reference_id":"","reference_type":"","scores":[{"value":"7.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"},{"value":"8.7","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/python-pillow/Pillow/commit/205e056f8f9b06ed7b925cf8aa0874bc4aaf8a7d"},{"reference_url":"https://github.com/python-pillow/Pillow/commit/5efeed77666bfd17708f3434b1d2daa9db1e1335","reference_id":"","reference_type":"","scores":[{"value":"7.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"},{"value":"8.7","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/python-pillow/Pillow/commit/5efeed77666bfd17708f3434b1d2daa9db1e1335"},{"reference_url":"https://github.com/python-pillow/Pillow/commit/d47611e6fbb808ea109366781dd76559ffb80bcd","reference_id":"","reference_type":"","scores":[{"value":"7.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"},{"value":"8.7","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/python-pillow/Pillow/commit/d47611e6fbb808ea109366781dd76559ffb80bcd"},{"reference_url":"https://pypi.python.org/pypi/Pillow/2.3.2","reference_id":"","reference_type":"","scores":[{"value":"7.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"},{"value":"8.7","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://pypi.python.org/pypi/Pillow/2.3.2"},{"reference_url":"https://pypi.python.org/pypi/Pillow/2.5.2","reference_id":"","reference_type":"","scores":[{"value":"7.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"},{"value":"8.7","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://pypi.python.org/pypi/Pillow/2.5.2"},{"reference_url":"http://www.debian.org/security/2014/dsa-3009","reference_id":"","reference_type":"","scores":[{"value":"7.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"},{"value":"8.7","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"http://www.debian.org/security/2014/dsa-3009"},{"reference_url":"https://bugzilla.redhat.com/show_bug.cgi?id=1130711","reference_id":"1130711","reference_type":"","scores":[],"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1130711"},{"reference_url":"https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=758772","reference_id":"758772","reference_type":"","scores":[],"url":"https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=758772"},{"reference_url":"https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:debian:python-imaging:-:*:*:*:*:*:*:*","reference_id":"cpe:2.3:a:debian:python-imaging:-:*:*:*:*:*:*:*","reference_type":"","scores":[],"url":"https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:debian:python-imaging:-:*:*:*:*:*:*:*"},{"reference_url":"https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:python:pillow:*:*:*:*:*:*:*:*","reference_id":"cpe:2.3:a:python:pillow:*:*:*:*:*:*:*:*","reference_type":"","scores":[],"url":"https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:python:pillow:*:*:*:*:*:*:*:*"},{"reference_url":"https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:python:pillow:2.3.0:*:*:*:*:*:*:*","reference_id":"cpe:2.3:a:python:pillow:2.3.0:*:*:*:*:*:*:*","reference_type":"","scores":[],"url":"https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:python:pillow:2.3.0:*:*:*:*:*:*:*"},{"reference_url":"https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:python:pillow:2.5.0:*:*:*:*:*:*:*","reference_id":"cpe:2.3:a:python:pillow:2.5.0:*:*:*:*:*:*:*","reference_type":"","scores":[],"url":"https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:python:pillow:2.5.0:*:*:*:*:*:*:*"},{"reference_url":"https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:python:pillow:2.5.1:*:*:*:*:*:*:*","reference_id":"cpe:2.3:a:python:pillow:2.5.1:*:*:*:*:*:*:*","reference_type":"","scores":[],"url":"https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:python:pillow:2.5.1:*:*:*:*:*:*:*"},{"reference_url":"https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:python:pillow:2.5.2:*:*:*:*:*:*:*","reference_id":"cpe:2.3:a:python:pillow:2.5.2:*:*:*:*:*:*:*","reference_type":"","scores":[],"url":"https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:python:pillow:2.5.2:*:*:*:*:*:*:*"},{"reference_url":"https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:o:opensuse:opensuse:13.2:*:*:*:*:*:*:*","reference_id":"cpe:2.3:o:opensuse:opensuse:13.2:*:*:*:*:*:*:*","reference_type":"","scores":[],"url":"https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:o:opensuse:opensuse:13.2:*:*:*:*:*:*:*"},{"reference_url":"https://nvd.nist.gov/vuln/detail/CVE-2014-3589","reference_id":"CVE-2014-3589","reference_type":"","scores":[{"value":"5.0","scoring_system":"cvssv2","scoring_elements":"AV:N/AC:L/Au:N/C:N/I:N/A:P"},{"value":"7.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"},{"value":"8.7","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://nvd.nist.gov/vuln/detail/CVE-2014-3589"},{"reference_url":"https://github.com/advisories/GHSA-cfmr-38g9-f2h7","reference_id":"GHSA-cfmr-38g9-f2h7","reference_type":"","scores":[{"value":"HIGH","scoring_system":"cvssv3.1_qr","scoring_elements":""}],"url":"https://github.com/advisories/GHSA-cfmr-38g9-f2h7"},{"reference_url":"https://usn.ubuntu.com/3080-1/","reference_id":"USN-3080-1","reference_type":"","scores":[],"url":"https://usn.ubuntu.com/3080-1/"},{"reference_url":"https://usn.ubuntu.com/3090-1/","reference_id":"USN-3090-1","reference_type":"","scores":[],"url":"https://usn.ubuntu.com/3090-1/"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/3059?format=json","purl":"pkg:pypi/pillow@2.3.2","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-19e1-19hk-duet"},{"vulnerability":"VCID-1vt7-c6e3-7qc8"},{"vulnerability":"VCID-366h-8f99-r7at"},{"vulnerability":"VCID-3qb5-8p8w-gkad"},{"vulnerability":"VCID-3uk9-eds5-rkgc"},{"vulnerability":"VCID-53ac-ceq4-qkhf"},{"vulnerability":"VCID-5rv4-k1q9-zue2"},{"vulnerability":"VCID-64n5-pugj-vue8"},{"vulnerability":"VCID-6gyu-fzpg-c3bn"},{"vulnerability":"VCID-8n2b-wvya-53e1"},{"vulnerability":"VCID-9ckw-ra54-z3b7"},{"vulnerability":"VCID-and9-6jty-pyeq"},{"vulnerability":"VCID-aubw-tsmn-ffcq"},{"vulnerability":"VCID-avx2-mahw-mqes"},{"vulnerability":"VCID-b3au-rcgp-2fag"},{"vulnerability":"VCID-b5a2-83ej-puaw"},{"vulnerability":"VCID-brp2-dtrf-jyfr"},{"vulnerability":"VCID-cas2-jb3y-vyhz"},{"vulnerability":"VCID-d7uf-zdbv-sba1"},{"vulnerability":"VCID-df4x-jt3h-17hx"},{"vulnerability":"VCID-dgds-v95g-pbcv"},{"vulnerability":"VCID-dpc3-td9q-dyee"},{"vulnerability":"VCID-e3gp-zc2b-budg"},{"vulnerability":"VCID-en6t-uxtq-bfek"},{"vulnerability":"VCID-g46h-p8jk-cuhc"},{"vulnerability":"VCID-gmd5-pbxc-a3gd"},{"vulnerability":"VCID-gvjw-funa-sqak"},{"vulnerability":"VCID-h4x7-7fke-mqgp"},{"vulnerability":"VCID-haum-8zpg-6kgf"},{"vulnerability":"VCID-hmmq-5772-bycm"},{"vulnerability":"VCID-khp6-9hfx-1kge"},{"vulnerability":"VCID-m3tm-h4q9-9yay"},{"vulnerability":"VCID-ma2g-2f8d-dqa9"},{"vulnerability":"VCID-n1hp-atex-ubh4"},{"vulnerability":"VCID-n1w5-f5p7-xuhb"},{"vulnerability":"VCID-p6r3-puh1-zyg6"},{"vulnerability":"VCID-q4bb-qnxe-8bfa"},{"vulnerability":"VCID-qjqr-jyjn-xfh9"},{"vulnerability":"VCID-rncf-9nf8-wud3"},{"vulnerability":"VCID-sns1-ksqr-vbhr"},{"vulnerability":"VCID-stft-hsk9-zfdy"},{"vulnerability":"VCID-u1en-t8ux-uube"},{"vulnerability":"VCID-ue18-zzau-x7hy"},{"vulnerability":"VCID-uf5t-asns-tudp"},{"vulnerability":"VCID-vdzj-kqfy-d3b7"},{"vulnerability":"VCID-vwbu-ruxm-tbh4"},{"vulnerability":"VCID-vxh1-8rvt-kkak"},{"vulnerability":"VCID-vyzt-df2u-h3cc"},{"vulnerability":"VCID-w9uy-fnpm-cbak"},{"vulnerability":"VCID-x15z-dejc-9ba6"},{"vulnerability":"VCID-xesd-d294-7fcx"},{"vulnerability":"VCID-xk66-1d31-2qbk"},{"vulnerability":"VCID-zmd3-henq-r7bd"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:pypi/pillow@2.3.2"},{"url":"http://public2.vulnerablecode.io/api/packages/3521?format=json","purl":"pkg:pypi/pillow@2.5.2","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-19e1-19hk-duet"},{"vulnerability":"VCID-1vt7-c6e3-7qc8"},{"vulnerability":"VCID-366h-8f99-r7at"},{"vulnerability":"VCID-3qb5-8p8w-gkad"},{"vulnerability":"VCID-3uk9-eds5-rkgc"},{"vulnerability":"VCID-53ac-ceq4-qkhf"},{"vulnerability":"VCID-5rv4-k1q9-zue2"},{"vulnerability":"VCID-64n5-pugj-vue8"},{"vulnerability":"VCID-6gyu-fzpg-c3bn"},{"vulnerability":"VCID-8n2b-wvya-53e1"},{"vulnerability":"VCID-9ckw-ra54-z3b7"},{"vulnerability":"VCID-and9-6jty-pyeq"},{"vulnerability":"VCID-aubw-tsmn-ffcq"},{"vulnerability":"VCID-avx2-mahw-mqes"},{"vulnerability":"VCID-b3au-rcgp-2fag"},{"vulnerability":"VCID-b5a2-83ej-puaw"},{"vulnerability":"VCID-brp2-dtrf-jyfr"},{"vulnerability":"VCID-cas2-jb3y-vyhz"},{"vulnerability":"VCID-d7uf-zdbv-sba1"},{"vulnerability":"VCID-df4x-jt3h-17hx"},{"vulnerability":"VCID-dgds-v95g-pbcv"},{"vulnerability":"VCID-dpc3-td9q-dyee"},{"vulnerability":"VCID-e3gp-zc2b-budg"},{"vulnerability":"VCID-en6t-uxtq-bfek"},{"vulnerability":"VCID-g46h-p8jk-cuhc"},{"vulnerability":"VCID-gvjw-funa-sqak"},{"vulnerability":"VCID-h4x7-7fke-mqgp"},{"vulnerability":"VCID-haum-8zpg-6kgf"},{"vulnerability":"VCID-hmmq-5772-bycm"},{"vulnerability":"VCID-khp6-9hfx-1kge"},{"vulnerability":"VCID-m3tm-h4q9-9yay"},{"vulnerability":"VCID-ma2g-2f8d-dqa9"},{"vulnerability":"VCID-n1hp-atex-ubh4"},{"vulnerability":"VCID-n1w5-f5p7-xuhb"},{"vulnerability":"VCID-p6r3-puh1-zyg6"},{"vulnerability":"VCID-q4bb-qnxe-8bfa"},{"vulnerability":"VCID-qjqr-jyjn-xfh9"},{"vulnerability":"VCID-rncf-9nf8-wud3"},{"vulnerability":"VCID-sns1-ksqr-vbhr"},{"vulnerability":"VCID-stft-hsk9-zfdy"},{"vulnerability":"VCID-u1en-t8ux-uube"},{"vulnerability":"VCID-ue18-zzau-x7hy"},{"vulnerability":"VCID-uf5t-asns-tudp"},{"vulnerability":"VCID-vdzj-kqfy-d3b7"},{"vulnerability":"VCID-vwbu-ruxm-tbh4"},{"vulnerability":"VCID-vxh1-8rvt-kkak"},{"vulnerability":"VCID-vyzt-df2u-h3cc"},{"vulnerability":"VCID-w9uy-fnpm-cbak"},{"vulnerability":"VCID-x15z-dejc-9ba6"},{"vulnerability":"VCID-xesd-d294-7fcx"},{"vulnerability":"VCID-xk66-1d31-2qbk"},{"vulnerability":"VCID-yccg-zw89-vqff"},{"vulnerability":"VCID-zmd3-henq-r7bd"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:pypi/pillow@2.5.2"}],"aliases":["CVE-2014-3589","GHSA-cfmr-38g9-f2h7","PYSEC-2014-10"],"risk_score":4.0,"exploitability":"0.5","weighted_severity":"8.0","resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-vz9s-jqpb-2ybf"},{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/6487?format=json","vulnerability_id":"VCID-w9uy-fnpm-cbak","summary":"Pillow through 8.2.0 and PIL (aka Python Imaging Library) through 1.1.7 allow an attacker to pass controlled parameters directly into a convert function to trigger a buffer overflow in Convert.c.","references":[{"reference_url":"https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2021-34552.json","reference_id":"","reference_type":"","scores":[{"value":"5.9","scoring_system":"cvssv3","scoring_elements":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"url":"https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2021-34552.json"},{"reference_url":"https://api.first.org/data/v1/epss?cve=CVE-2021-34552","reference_id":"","reference_type":"","scores":[{"value":"0.00337","scoring_system":"epss","scoring_elements":"0.56424","published_at":"2026-05-05T12:55:00Z"},{"value":"0.00337","scoring_system":"epss","scoring_elements":"0.56468","published_at":"2026-04-29T12:55:00Z"},{"value":"0.00337","scoring_system":"epss","scoring_elements":"0.56489","published_at":"2026-04-26T12:55:00Z"},{"value":"0.00337","scoring_system":"epss","scoring_elements":"0.5647","published_at":"2026-04-24T12:55:00Z"},{"value":"0.00337","scoring_system":"epss","scoring_elements":"0.56536","published_at":"2026-04-21T12:55:00Z"},{"value":"0.00337","scoring_system":"epss","scoring_elements":"0.56566","published_at":"2026-04-18T12:55:00Z"},{"value":"0.00337","scoring_system":"epss","scoring_elements":"0.56532","published_at":"2026-04-13T12:55:00Z"},{"value":"0.00337","scoring_system":"epss","scoring_elements":"0.56551","published_at":"2026-04-12T12:55:00Z"},{"value":"0.00337","scoring_system":"epss","scoring_elements":"0.56575","published_at":"2026-04-11T12:55:00Z"},{"value":"0.00337","scoring_system":"epss","scoring_elements":"0.56565","published_at":"2026-04-16T12:55:00Z"},{"value":"0.00337","scoring_system":"epss","scoring_elements":"0.5656","published_at":"2026-04-08T12:55:00Z"},{"value":"0.00337","scoring_system":"epss","scoring_elements":"0.5641","published_at":"2026-04-01T12:55:00Z"},{"value":"0.00337","scoring_system":"epss","scoring_elements":"0.5651","published_at":"2026-04-07T12:55:00Z"},{"value":"0.00337","scoring_system":"epss","scoring_elements":"0.5653","published_at":"2026-04-04T12:55:00Z"},{"value":"0.00337","scoring_system":"epss","scoring_elements":"0.56508","published_at":"2026-04-02T12:55:00Z"}],"url":"https://api.first.org/data/v1/epss?cve=CVE-2021-34552"},{"reference_url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-34552","reference_id":"","reference_type":"","scores":[],"url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-34552"},{"reference_url":"https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml","reference_id":"","reference_type":"","scores":[{"value":"7.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"url":"https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml"},{"reference_url":"https://github.com/advisories/GHSA-7534-mm45-c74v","reference_id":"","reference_type":"","scores":[{"value":"9.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},{"value":"CRITICAL","scoring_system":"cvssv3.1_qr","scoring_elements":""},{"value":"9.3","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N"},{"value":"CRITICAL","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/advisories/GHSA-7534-mm45-c74v"},{"reference_url":"https://github.com/pypa/advisory-database/tree/main/vulns/pillow/PYSEC-2021-331.yaml","reference_id":"","reference_type":"","scores":[{"value":"9.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},{"value":"9.3","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N"},{"value":"CRITICAL","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/pypa/advisory-database/tree/main/vulns/pillow/PYSEC-2021-331.yaml"},{"reference_url":"https://github.com/python-pillow/Pillow","reference_id":"","reference_type":"","scores":[{"value":"9.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},{"value":"9.3","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N"},{"value":"CRITICAL","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/python-pillow/Pillow"},{"reference_url":"https://github.com/python-pillow/Pillow/commit/31c473898c29d1b7cb6555ce67d9503a4906b83f","reference_id":"","reference_type":"","scores":[{"value":"9.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},{"value":"9.3","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N"},{"value":"CRITICAL","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/python-pillow/Pillow/commit/31c473898c29d1b7cb6555ce67d9503a4906b83f"},{"reference_url":"https://github.com/python-pillow/Pillow/pull/5567","reference_id":"","reference_type":"","scores":[{"value":"9.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},{"value":"9.3","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N"},{"value":"CRITICAL","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/python-pillow/Pillow/pull/5567"},{"reference_url":"https://lists.debian.org/debian-lts-announce/2021/07/msg00018.html","reference_id":"","reference_type":"","scores":[{"value":"9.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},{"value":"9.3","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N"},{"value":"CRITICAL","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://lists.debian.org/debian-lts-announce/2021/07/msg00018.html"},{"reference_url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/7V6LCG525ARIX6LX5QRYNAWVDD2MD2SV","reference_id":"","reference_type":"","scores":[{"value":"9.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},{"value":"9.3","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N"},{"value":"CRITICAL","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/7V6LCG525ARIX6LX5QRYNAWVDD2MD2SV"},{"reference_url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/7V6LCG525ARIX6LX5QRYNAWVDD2MD2SV/","reference_id":"","reference_type":"","scores":[],"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/7V6LCG525ARIX6LX5QRYNAWVDD2MD2SV/"},{"reference_url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/VUGBBT63VL7G4JNOEIPDJIOC34ZFBKNJ","reference_id":"","reference_type":"","scores":[{"value":"9.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},{"value":"9.3","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N"},{"value":"CRITICAL","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/VUGBBT63VL7G4JNOEIPDJIOC34ZFBKNJ"},{"reference_url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/VUGBBT63VL7G4JNOEIPDJIOC34ZFBKNJ/","reference_id":"","reference_type":"","scores":[],"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/VUGBBT63VL7G4JNOEIPDJIOC34ZFBKNJ/"},{"reference_url":"https://pillow.readthedocs.io/en/stable/releasenotes/8.3.0.html#buffer-overflow","reference_id":"","reference_type":"","scores":[{"value":"9.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},{"value":"9.3","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N"},{"value":"CRITICAL","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://pillow.readthedocs.io/en/stable/releasenotes/8.3.0.html#buffer-overflow"},{"reference_url":"https://pillow.readthedocs.io/en/stable/releasenotes/index.html","reference_id":"","reference_type":"","scores":[{"value":"9.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},{"value":"9.3","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N"},{"value":"CRITICAL","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://pillow.readthedocs.io/en/stable/releasenotes/index.html"},{"reference_url":"https://security.gentoo.org/glsa/202211-10","reference_id":"","reference_type":"","scores":[{"value":"9.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},{"value":"9.3","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N"},{"value":"CRITICAL","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://security.gentoo.org/glsa/202211-10"},{"reference_url":"https://bugzilla.redhat.com/show_bug.cgi?id=1982378","reference_id":"1982378","reference_type":"","scores":[],"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1982378"},{"reference_url":"https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=991293","reference_id":"991293","reference_type":"","scores":[],"url":"https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=991293"},{"reference_url":"https://security.archlinux.org/ASA-202107-26","reference_id":"ASA-202107-26","reference_type":"","scores":[],"url":"https://security.archlinux.org/ASA-202107-26"},{"reference_url":"https://security.archlinux.org/AVG-2150","reference_id":"AVG-2150","reference_type":"","scores":[{"value":"Medium","scoring_system":"archlinux","scoring_elements":""}],"url":"https://security.archlinux.org/AVG-2150"},{"reference_url":"https://nvd.nist.gov/vuln/detail/CVE-2021-34552","reference_id":"CVE-2021-34552","reference_type":"","scores":[{"value":"9.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},{"value":"9.3","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N"},{"value":"CRITICAL","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-34552"},{"reference_url":"https://access.redhat.com/errata/RHSA-2021:3917","reference_id":"RHSA-2021:3917","reference_type":"","scores":[],"url":"https://access.redhat.com/errata/RHSA-2021:3917"},{"reference_url":"https://access.redhat.com/errata/RHSA-2021:4149","reference_id":"RHSA-2021:4149","reference_type":"","scores":[],"url":"https://access.redhat.com/errata/RHSA-2021:4149"},{"reference_url":"https://usn.ubuntu.com/5227-1/","reference_id":"USN-5227-1","reference_type":"","scores":[],"url":"https://usn.ubuntu.com/5227-1/"},{"reference_url":"https://usn.ubuntu.com/5227-2/","reference_id":"USN-5227-2","reference_type":"","scores":[],"url":"https://usn.ubuntu.com/5227-2/"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/17853?format=json","purl":"pkg:pypi/pillow@8.3.0","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-19e1-19hk-duet"},{"vulnerability":"VCID-1vt7-c6e3-7qc8"},{"vulnerability":"VCID-5rv4-k1q9-zue2"},{"vulnerability":"VCID-64n5-pugj-vue8"},{"vulnerability":"VCID-9ckw-ra54-z3b7"},{"vulnerability":"VCID-brp2-dtrf-jyfr"},{"vulnerability":"VCID-d7uf-zdbv-sba1"},{"vulnerability":"VCID-df4x-jt3h-17hx"},{"vulnerability":"VCID-dpc3-td9q-dyee"},{"vulnerability":"VCID-g46h-p8jk-cuhc"},{"vulnerability":"VCID-n1hp-atex-ubh4"},{"vulnerability":"VCID-q4bb-qnxe-8bfa"},{"vulnerability":"VCID-vdzj-kqfy-d3b7"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:pypi/pillow@8.3.0"}],"aliases":["BIT-pillow-2021-34552","CVE-2021-34552","GHSA-7534-mm45-c74v","PYSEC-2021-331"],"risk_score":4.5,"exploitability":"0.5","weighted_severity":"9.0","resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-w9uy-fnpm-cbak"},{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/6245?format=json","vulnerability_id":"VCID-x15z-dejc-9ba6","summary":"In Pillow before 8.1.0, PcxDecode has a buffer over-read when decoding a crafted PCX file because the user-supplied stride value is trusted for buffer calculations.","references":[{"reference_url":"https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2020-35653.json","reference_id":"","reference_type":"","scores":[{"value":"7.1","scoring_system":"cvssv3","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H"}],"url":"https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2020-35653.json"},{"reference_url":"https://api.first.org/data/v1/epss?cve=CVE-2020-35653","reference_id":"","reference_type":"","scores":[{"value":"0.00293","scoring_system":"epss","scoring_elements":"0.52536","published_at":"2026-04-01T12:55:00Z"},{"value":"0.00293","scoring_system":"epss","scoring_elements":"0.52534","published_at":"2026-05-05T12:55:00Z"},{"value":"0.00293","scoring_system":"epss","scoring_elements":"0.52592","published_at":"2026-04-29T12:55:00Z"},{"value":"0.00293","scoring_system":"epss","scoring_elements":"0.52629","published_at":"2026-04-26T12:55:00Z"},{"value":"0.00293","scoring_system":"epss","scoring_elements":"0.52619","published_at":"2026-04-24T12:55:00Z"},{"value":"0.00293","scoring_system":"epss","scoring_elements":"0.52668","published_at":"2026-04-21T12:55:00Z"},{"value":"0.00293","scoring_system":"epss","scoring_elements":"0.52684","published_at":"2026-04-18T12:55:00Z"},{"value":"0.00293","scoring_system":"epss","scoring_elements":"0.52581","published_at":"2026-04-02T12:55:00Z"},{"value":"0.00293","scoring_system":"epss","scoring_elements":"0.52608","published_at":"2026-04-04T12:55:00Z"},{"value":"0.00293","scoring_system":"epss","scoring_elements":"0.52676","published_at":"2026-04-16T12:55:00Z"},{"value":"0.00293","scoring_system":"epss","scoring_elements":"0.52575","published_at":"2026-04-07T12:55:00Z"},{"value":"0.00293","scoring_system":"epss","scoring_elements":"0.52626","published_at":"2026-04-08T12:55:00Z"},{"value":"0.00293","scoring_system":"epss","scoring_elements":"0.5262","published_at":"2026-04-09T12:55:00Z"},{"value":"0.00293","scoring_system":"epss","scoring_elements":"0.52671","published_at":"2026-04-11T12:55:00Z"},{"value":"0.00293","scoring_system":"epss","scoring_elements":"0.52639","published_at":"2026-04-13T12:55:00Z"},{"value":"0.00293","scoring_system":"epss","scoring_elements":"0.52654","published_at":"2026-04-12T12:55:00Z"}],"url":"https://api.first.org/data/v1/epss?cve=CVE-2020-35653"},{"reference_url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-35653","reference_id":"","reference_type":"","scores":[],"url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-35653"},{"reference_url":"https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml","reference_id":"","reference_type":"","scores":[{"value":"8.1","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H"}],"url":"https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml"},{"reference_url":"https://github.com/advisories/GHSA-f5g8-5qq7-938w","reference_id":"","reference_type":"","scores":[{"value":"7.1","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H"},{"value":"HIGH","scoring_system":"cvssv3.1_qr","scoring_elements":""},{"value":"8.3","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/advisories/GHSA-f5g8-5qq7-938w"},{"reference_url":"https://github.com/pypa/advisory-database/tree/main/vulns/pillow/PYSEC-2021-69.yaml","reference_id":"","reference_type":"","scores":[{"value":"7.1","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H"},{"value":"8.3","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/pypa/advisory-database/tree/main/vulns/pillow/PYSEC-2021-69.yaml"},{"reference_url":"https://github.com/python-pillow/Pillow","reference_id":"","reference_type":"","scores":[{"value":"7.1","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H"},{"value":"8.3","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/python-pillow/Pillow"},{"reference_url":"https://github.com/python-pillow/Pillow/commit/2f409261eb1228e166868f8f0b5da5cda52e55bf","reference_id":"","reference_type":"","scores":[{"value":"7.1","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H"},{"value":"8.3","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/python-pillow/Pillow/commit/2f409261eb1228e166868f8f0b5da5cda52e55bf"},{"reference_url":"https://lists.debian.org/debian-lts-announce/2021/07/msg00018.html","reference_id":"","reference_type":"","scores":[{"value":"7.1","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H"},{"value":"8.3","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://lists.debian.org/debian-lts-announce/2021/07/msg00018.html"},{"reference_url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6BYVI5G44MRIPERKYDQEL3S3YQCZTVHE","reference_id":"","reference_type":"","scores":[{"value":"7.1","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H"},{"value":"8.3","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6BYVI5G44MRIPERKYDQEL3S3YQCZTVHE"},{"reference_url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6BYVI5G44MRIPERKYDQEL3S3YQCZTVHE/","reference_id":"","reference_type":"","scores":[],"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6BYVI5G44MRIPERKYDQEL3S3YQCZTVHE/"},{"reference_url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/BF553AMNNNBW7SH4IM4MNE4M6GNZQ7YD","reference_id":"","reference_type":"","scores":[{"value":"7.1","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H"},{"value":"8.3","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/BF553AMNNNBW7SH4IM4MNE4M6GNZQ7YD"},{"reference_url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/BF553AMNNNBW7SH4IM4MNE4M6GNZQ7YD/","reference_id":"","reference_type":"","scores":[],"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/BF553AMNNNBW7SH4IM4MNE4M6GNZQ7YD/"},{"reference_url":"https://nvd.nist.gov/vuln/detail/CVE-2020-35653","reference_id":"","reference_type":"","scores":[{"value":"7.1","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H"},{"value":"8.3","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://nvd.nist.gov/vuln/detail/CVE-2020-35653"},{"reference_url":"https://pillow.readthedocs.io/en/stable/releasenotes/index.html","reference_id":"","reference_type":"","scores":[{"value":"7.1","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H"},{"value":"8.3","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://pillow.readthedocs.io/en/stable/releasenotes/index.html"},{"reference_url":"https://bugzilla.redhat.com/show_bug.cgi?id=1915420","reference_id":"1915420","reference_type":"","scores":[],"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1915420"},{"reference_url":"https://security.archlinux.org/ASA-202101-11","reference_id":"ASA-202101-11","reference_type":"","scores":[],"url":"https://security.archlinux.org/ASA-202101-11"},{"reference_url":"https://security.archlinux.org/AVG-1438","reference_id":"AVG-1438","reference_type":"","scores":[{"value":"Medium","scoring_system":"archlinux","scoring_elements":""}],"url":"https://security.archlinux.org/AVG-1438"},{"reference_url":"https://security.gentoo.org/glsa/202101-08","reference_id":"GLSA-202101-08","reference_type":"","scores":[],"url":"https://security.gentoo.org/glsa/202101-08"},{"reference_url":"https://access.redhat.com/errata/RHSA-2021:3917","reference_id":"RHSA-2021:3917","reference_type":"","scores":[],"url":"https://access.redhat.com/errata/RHSA-2021:3917"},{"reference_url":"https://access.redhat.com/errata/RHSA-2021:4149","reference_id":"RHSA-2021:4149","reference_type":"","scores":[],"url":"https://access.redhat.com/errata/RHSA-2021:4149"},{"reference_url":"https://usn.ubuntu.com/4697-1/","reference_id":"USN-4697-1","reference_type":"","scores":[],"url":"https://usn.ubuntu.com/4697-1/"},{"reference_url":"https://usn.ubuntu.com/4697-2/","reference_id":"USN-4697-2","reference_type":"","scores":[],"url":"https://usn.ubuntu.com/4697-2/"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/14775?format=json","purl":"pkg:pypi/pillow@8.1.0","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-19e1-19hk-duet"},{"vulnerability":"VCID-1vt7-c6e3-7qc8"},{"vulnerability":"VCID-3qb5-8p8w-gkad"},{"vulnerability":"VCID-3uk9-eds5-rkgc"},{"vulnerability":"VCID-53ac-ceq4-qkhf"},{"vulnerability":"VCID-5rv4-k1q9-zue2"},{"vulnerability":"VCID-64n5-pugj-vue8"},{"vulnerability":"VCID-9ckw-ra54-z3b7"},{"vulnerability":"VCID-aubw-tsmn-ffcq"},{"vulnerability":"VCID-brp2-dtrf-jyfr"},{"vulnerability":"VCID-d7uf-zdbv-sba1"},{"vulnerability":"VCID-df4x-jt3h-17hx"},{"vulnerability":"VCID-dpc3-td9q-dyee"},{"vulnerability":"VCID-en6t-uxtq-bfek"},{"vulnerability":"VCID-g46h-p8jk-cuhc"},{"vulnerability":"VCID-gvjw-funa-sqak"},{"vulnerability":"VCID-khp6-9hfx-1kge"},{"vulnerability":"VCID-n1hp-atex-ubh4"},{"vulnerability":"VCID-n1w5-f5p7-xuhb"},{"vulnerability":"VCID-p6r3-puh1-zyg6"},{"vulnerability":"VCID-q4bb-qnxe-8bfa"},{"vulnerability":"VCID-rncf-9nf8-wud3"},{"vulnerability":"VCID-ue18-zzau-x7hy"},{"vulnerability":"VCID-vdzj-kqfy-d3b7"},{"vulnerability":"VCID-vwbu-ruxm-tbh4"},{"vulnerability":"VCID-vxh1-8rvt-kkak"},{"vulnerability":"VCID-vyzt-df2u-h3cc"},{"vulnerability":"VCID-w9uy-fnpm-cbak"},{"vulnerability":"VCID-xesd-d294-7fcx"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:pypi/pillow@8.1.0"}],"aliases":["BIT-pillow-2020-35653","CVE-2020-35653","GHSA-f5g8-5qq7-938w","PYSEC-2021-69"],"risk_score":4.0,"exploitability":"0.5","weighted_severity":"8.0","resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-x15z-dejc-9ba6"},{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/6464?format=json","vulnerability_id":"VCID-xesd-d294-7fcx","summary":"An issue was discovered in Pillow before 8.2.0. For FLI data, FliDecode did not properly check that the block advance was non-zero, potentially leading to an infinite loop on load.","references":[{"reference_url":"https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2021-28676.json","reference_id":"","reference_type":"","scores":[{"value":"7.5","scoring_system":"cvssv3","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"url":"https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2021-28676.json"},{"reference_url":"https://api.first.org/data/v1/epss?cve=CVE-2021-28676","reference_id":"","reference_type":"","scores":[{"value":"0.00366","scoring_system":"epss","scoring_elements":"0.58666","published_at":"2026-04-11T12:55:00Z"},{"value":"0.00366","scoring_system":"epss","scoring_elements":"0.58516","published_at":"2026-04-01T12:55:00Z"},{"value":"0.00366","scoring_system":"epss","scoring_elements":"0.58575","published_at":"2026-05-05T12:55:00Z"},{"value":"0.00366","scoring_system":"epss","scoring_elements":"0.58608","published_at":"2026-04-29T12:55:00Z"},{"value":"0.00366","scoring_system":"epss","scoring_elements":"0.58623","published_at":"2026-04-26T12:55:00Z"},{"value":"0.00366","scoring_system":"epss","scoring_elements":"0.586","published_at":"2026-04-02T12:55:00Z"},{"value":"0.00366","scoring_system":"epss","scoring_elements":"0.58621","published_at":"2026-04-04T12:55:00Z"},{"value":"0.00366","scoring_system":"epss","scoring_elements":"0.58647","published_at":"2026-04-12T12:55:00Z"},{"value":"0.00366","scoring_system":"epss","scoring_elements":"0.58627","published_at":"2026-04-13T12:55:00Z"},{"value":"0.00366","scoring_system":"epss","scoring_elements":"0.58665","published_at":"2026-04-18T12:55:00Z"},{"value":"0.00366","scoring_system":"epss","scoring_elements":"0.5866","published_at":"2026-04-16T12:55:00Z"},{"value":"0.00366","scoring_system":"epss","scoring_elements":"0.5859","published_at":"2026-04-07T12:55:00Z"},{"value":"0.00366","scoring_system":"epss","scoring_elements":"0.58648","published_at":"2026-04-09T12:55:00Z"},{"value":"0.00366","scoring_system":"epss","scoring_elements":"0.58642","published_at":"2026-04-08T12:55:00Z"},{"value":"0.00377","scoring_system":"epss","scoring_elements":"0.59242","published_at":"2026-04-24T12:55:00Z"},{"value":"0.00377","scoring_system":"epss","scoring_elements":"0.59261","published_at":"2026-04-21T12:55:00Z"}],"url":"https://api.first.org/data/v1/epss?cve=CVE-2021-28676"},{"reference_url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-28676","reference_id":"","reference_type":"","scores":[],"url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-28676"},{"reference_url":"https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml","reference_id":"","reference_type":"","scores":[{"value":"7.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"url":"https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml"},{"reference_url":"https://github.com/advisories/GHSA-7r7m-5h27-29hp","reference_id":"","reference_type":"","scores":[{"value":"7.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"},{"value":"HIGH","scoring_system":"cvssv3.1_qr","scoring_elements":""},{"value":"8.7","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/advisories/GHSA-7r7m-5h27-29hp"},{"reference_url":"https://github.com/pypa/advisory-database/tree/main/vulns/pillow/PYSEC-2021-92.yaml","reference_id":"","reference_type":"","scores":[{"value":"7.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"},{"value":"8.7","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/pypa/advisory-database/tree/main/vulns/pillow/PYSEC-2021-92.yaml"},{"reference_url":"https://github.com/python-pillow/Pillow","reference_id":"","reference_type":"","scores":[{"value":"7.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"},{"value":"8.7","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/python-pillow/Pillow"},{"reference_url":"https://github.com/python-pillow/Pillow/commit/bb6c11fb889e6c11b0ee122b828132ee763b5856","reference_id":"","reference_type":"","scores":[{"value":"7.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"},{"value":"8.7","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/python-pillow/Pillow/commit/bb6c11fb889e6c11b0ee122b828132ee763b5856"},{"reference_url":"https://github.com/python-pillow/Pillow/pull/5377","reference_id":"","reference_type":"","scores":[{"value":"7.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"},{"value":"8.7","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/python-pillow/Pillow/pull/5377"},{"reference_url":"https://lists.debian.org/debian-lts-announce/2021/07/msg00018.html","reference_id":"","reference_type":"","scores":[{"value":"7.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"},{"value":"8.7","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://lists.debian.org/debian-lts-announce/2021/07/msg00018.html"},{"reference_url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/MQHA5HAIBOYI3R6HDWCLAGFTIQP767FL","reference_id":"","reference_type":"","scores":[{"value":"7.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"},{"value":"8.7","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/MQHA5HAIBOYI3R6HDWCLAGFTIQP767FL"},{"reference_url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/MQHA5HAIBOYI3R6HDWCLAGFTIQP767FL","reference_id":"","reference_type":"","scores":[{"value":"7.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"},{"value":"8.7","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/MQHA5HAIBOYI3R6HDWCLAGFTIQP767FL"},{"reference_url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/MQHA5HAIBOYI3R6HDWCLAGFTIQP767FL/","reference_id":"","reference_type":"","scores":[],"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/MQHA5HAIBOYI3R6HDWCLAGFTIQP767FL/"},{"reference_url":"https://nvd.nist.gov/vuln/detail/CVE-2021-28676","reference_id":"","reference_type":"","scores":[{"value":"7.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"},{"value":"8.7","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-28676"},{"reference_url":"https://pillow.readthedocs.io/en/stable/releasenotes/8.2.0.html#cve-2021-28676-fix-fli-dos","reference_id":"","reference_type":"","scores":[{"value":"7.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"},{"value":"8.7","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://pillow.readthedocs.io/en/stable/releasenotes/8.2.0.html#cve-2021-28676-fix-fli-dos"},{"reference_url":"https://security.gentoo.org/glsa/202107-33","reference_id":"","reference_type":"","scores":[{"value":"7.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"},{"value":"8.7","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://security.gentoo.org/glsa/202107-33"},{"reference_url":"https://bugzilla.redhat.com/show_bug.cgi?id=1958252","reference_id":"1958252","reference_type":"","scores":[],"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1958252"},{"reference_url":"https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=989062","reference_id":"989062","reference_type":"","scores":[],"url":"https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=989062"},{"reference_url":"https://access.redhat.com/errata/RHSA-2021:4149","reference_id":"RHSA-2021:4149","reference_type":"","scores":[],"url":"https://access.redhat.com/errata/RHSA-2021:4149"},{"reference_url":"https://usn.ubuntu.com/4963-1/","reference_id":"USN-4963-1","reference_type":"","scores":[],"url":"https://usn.ubuntu.com/4963-1/"},{"reference_url":"https://usn.ubuntu.com/8135-1/","reference_id":"USN-8135-1","reference_type":"","scores":[],"url":"https://usn.ubuntu.com/8135-1/"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/17188?format=json","purl":"pkg:pypi/pillow@8.2.0","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-19e1-19hk-duet"},{"vulnerability":"VCID-1vt7-c6e3-7qc8"},{"vulnerability":"VCID-5rv4-k1q9-zue2"},{"vulnerability":"VCID-64n5-pugj-vue8"},{"vulnerability":"VCID-9ckw-ra54-z3b7"},{"vulnerability":"VCID-brp2-dtrf-jyfr"},{"vulnerability":"VCID-d7uf-zdbv-sba1"},{"vulnerability":"VCID-df4x-jt3h-17hx"},{"vulnerability":"VCID-dpc3-td9q-dyee"},{"vulnerability":"VCID-g46h-p8jk-cuhc"},{"vulnerability":"VCID-n1hp-atex-ubh4"},{"vulnerability":"VCID-q4bb-qnxe-8bfa"},{"vulnerability":"VCID-vdzj-kqfy-d3b7"},{"vulnerability":"VCID-w9uy-fnpm-cbak"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:pypi/pillow@8.2.0"}],"aliases":["BIT-pillow-2021-28676","CVE-2021-28676","GHSA-7r7m-5h27-29hp","PYSEC-2021-92"],"risk_score":4.0,"exploitability":"0.5","weighted_severity":"8.0","resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-xesd-d294-7fcx"},{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/90069?format=json","vulnerability_id":"VCID-xk66-1d31-2qbk","summary":"An issue was discovered in Pillow before 6.2.0. When reading specially crafted invalid image files, the library can either allocate very large amounts of memory or take an extremely long period of time to process the image.","references":[{"reference_url":"https://access.redhat.com/errata/RHSA-2020:0566","reference_id":"","reference_type":"","scores":[],"url":"https://access.redhat.com/errata/RHSA-2020:0566"},{"reference_url":"https://access.redhat.com/errata/RHSA-2020:0578","reference_id":"","reference_type":"","scores":[],"url":"https://access.redhat.com/errata/RHSA-2020:0578"},{"reference_url":"https://access.redhat.com/errata/RHSA-2020:0580","reference_id":"","reference_type":"","scores":[],"url":"https://access.redhat.com/errata/RHSA-2020:0580"},{"reference_url":"https://access.redhat.com/errata/RHSA-2020:0681","reference_id":"","reference_type":"","scores":[],"url":"https://access.redhat.com/errata/RHSA-2020:0681"},{"reference_url":"https://access.redhat.com/errata/RHSA-2020:0683","reference_id":"","reference_type":"","scores":[],"url":"https://access.redhat.com/errata/RHSA-2020:0683"},{"reference_url":"https://access.redhat.com/errata/RHSA-2020:0694","reference_id":"","reference_type":"","scores":[],"url":"https://access.redhat.com/errata/RHSA-2020:0694"},{"reference_url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/EMJBUZQGQ2Q7HXYCQVRLU7OXNC7CAWWU/","reference_id":"","reference_type":"","scores":[],"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/EMJBUZQGQ2Q7HXYCQVRLU7OXNC7CAWWU/"},{"reference_url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/LYDXD7EE4YAEVSTNIFZKNVPRVJX5ZOG3/","reference_id":"","reference_type":"","scores":[],"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/LYDXD7EE4YAEVSTNIFZKNVPRVJX5ZOG3/"},{"reference_url":"https://pillow.readthedocs.io/en/latest/releasenotes/6.2.0.html","reference_id":"","reference_type":"","scores":[],"url":"https://pillow.readthedocs.io/en/latest/releasenotes/6.2.0.html"},{"reference_url":"https://usn.ubuntu.com/4272-1/","reference_id":"","reference_type":"","scores":[],"url":"https://usn.ubuntu.com/4272-1/"},{"reference_url":"https://www.debian.org/security/2020/dsa-4631","reference_id":"","reference_type":"","scores":[],"url":"https://www.debian.org/security/2020/dsa-4631"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/9387?format=json","purl":"pkg:pypi/pillow@6.2.0","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-19e1-19hk-duet"},{"vulnerability":"VCID-1vt7-c6e3-7qc8"},{"vulnerability":"VCID-3qb5-8p8w-gkad"},{"vulnerability":"VCID-3uk9-eds5-rkgc"},{"vulnerability":"VCID-53ac-ceq4-qkhf"},{"vulnerability":"VCID-5rv4-k1q9-zue2"},{"vulnerability":"VCID-64n5-pugj-vue8"},{"vulnerability":"VCID-6gyu-fzpg-c3bn"},{"vulnerability":"VCID-7bjx-gkf7-cke9"},{"vulnerability":"VCID-8n2b-wvya-53e1"},{"vulnerability":"VCID-9ckw-ra54-z3b7"},{"vulnerability":"VCID-and9-6jty-pyeq"},{"vulnerability":"VCID-aubw-tsmn-ffcq"},{"vulnerability":"VCID-b3au-rcgp-2fag"},{"vulnerability":"VCID-b5a2-83ej-puaw"},{"vulnerability":"VCID-brp2-dtrf-jyfr"},{"vulnerability":"VCID-d7uf-zdbv-sba1"},{"vulnerability":"VCID-df4x-jt3h-17hx"},{"vulnerability":"VCID-dpc3-td9q-dyee"},{"vulnerability":"VCID-en6t-uxtq-bfek"},{"vulnerability":"VCID-g46h-p8jk-cuhc"},{"vulnerability":"VCID-gvjw-funa-sqak"},{"vulnerability":"VCID-h4x7-7fke-mqgp"},{"vulnerability":"VCID-haum-8zpg-6kgf"},{"vulnerability":"VCID-hmmq-5772-bycm"},{"vulnerability":"VCID-khp6-9hfx-1kge"},{"vulnerability":"VCID-m3tm-h4q9-9yay"},{"vulnerability":"VCID-n1hp-atex-ubh4"},{"vulnerability":"VCID-n1w5-f5p7-xuhb"},{"vulnerability":"VCID-p6r3-puh1-zyg6"},{"vulnerability":"VCID-q4bb-qnxe-8bfa"},{"vulnerability":"VCID-rncf-9nf8-wud3"},{"vulnerability":"VCID-sns1-ksqr-vbhr"},{"vulnerability":"VCID-stft-hsk9-zfdy"},{"vulnerability":"VCID-ue18-zzau-x7hy"},{"vulnerability":"VCID-uf5t-asns-tudp"},{"vulnerability":"VCID-vdzj-kqfy-d3b7"},{"vulnerability":"VCID-vwbu-ruxm-tbh4"},{"vulnerability":"VCID-vxh1-8rvt-kkak"},{"vulnerability":"VCID-vyzt-df2u-h3cc"},{"vulnerability":"VCID-w9uy-fnpm-cbak"},{"vulnerability":"VCID-x15z-dejc-9ba6"},{"vulnerability":"VCID-xesd-d294-7fcx"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:pypi/pillow@6.2.0"}],"aliases":["PYSEC-2019-40"],"risk_score":null,"exploitability":"0.5","weighted_severity":"0.0","resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-xk66-1d31-2qbk"},{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/5509?format=json","vulnerability_id":"VCID-zmd3-henq-r7bd","summary":"Buffer overflow in the ImagingPcdDecode function in PcdDecode.c in Pillow before 3.1.1 and Python Imaging Library (PIL) 1.1.7 and earlier allows remote attackers to cause a denial of service (crash) via a crafted PhotoCD file.","references":[{"reference_url":"https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2016-2533.json","reference_id":"","reference_type":"","scores":[],"url":"https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2016-2533.json"},{"reference_url":"https://api.first.org/data/v1/epss?cve=CVE-2016-2533","reference_id":"","reference_type":"","scores":[{"value":"0.02195","scoring_system":"epss","scoring_elements":"0.8433","published_at":"2026-04-01T12:55:00Z"},{"value":"0.02195","scoring_system":"epss","scoring_elements":"0.84465","published_at":"2026-04-29T12:55:00Z"},{"value":"0.02195","scoring_system":"epss","scoring_elements":"0.84461","published_at":"2026-04-26T12:55:00Z"},{"value":"0.02195","scoring_system":"epss","scoring_elements":"0.84452","published_at":"2026-04-24T12:55:00Z"},{"value":"0.02195","scoring_system":"epss","scoring_elements":"0.84426","published_at":"2026-04-21T12:55:00Z"},{"value":"0.02195","scoring_system":"epss","scoring_elements":"0.84424","published_at":"2026-04-18T12:55:00Z"},{"value":"0.02195","scoring_system":"epss","scoring_elements":"0.84401","published_at":"2026-04-13T12:55:00Z"},{"value":"0.02195","scoring_system":"epss","scoring_elements":"0.84405","published_at":"2026-04-12T12:55:00Z"},{"value":"0.02195","scoring_system":"epss","scoring_elements":"0.84411","published_at":"2026-04-11T12:55:00Z"},{"value":"0.02195","scoring_system":"epss","scoring_elements":"0.84394","published_at":"2026-04-09T12:55:00Z"},{"value":"0.02195","scoring_system":"epss","scoring_elements":"0.84388","published_at":"2026-04-08T12:55:00Z"},{"value":"0.02195","scoring_system":"epss","scoring_elements":"0.84366","published_at":"2026-04-07T12:55:00Z"},{"value":"0.02195","scoring_system":"epss","scoring_elements":"0.84364","published_at":"2026-04-04T12:55:00Z"},{"value":"0.02195","scoring_system":"epss","scoring_elements":"0.84344","published_at":"2026-04-02T12:55:00Z"},{"value":"0.02207","scoring_system":"epss","scoring_elements":"0.84531","published_at":"2026-05-05T12:55:00Z"}],"url":"https://api.first.org/data/v1/epss?cve=CVE-2016-2533"},{"reference_url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-0740","reference_id":"","reference_type":"","scores":[],"url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-0740"},{"reference_url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-0775","reference_id":"","reference_type":"","scores":[],"url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-0775"},{"reference_url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-2533","reference_id":"","reference_type":"","scores":[],"url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-2533"},{"reference_url":"https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml","reference_id":"","reference_type":"","scores":[{"value":"5.1","scoring_system":"cvssv2","scoring_elements":"AV:N/AC:H/Au:N/C:P/I:P/A:P"}],"url":"https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml"},{"reference_url":"https://github.com/advisories/GHSA-3c5c-7235-994j","reference_id":"","reference_type":"","scores":[{"value":"6.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H"},{"value":"HIGH","scoring_system":"cvssv3.1_qr","scoring_elements":""},{"value":"7.1","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/advisories/GHSA-3c5c-7235-994j"},{"reference_url":"https://github.com/pypa/advisory-database/tree/main/vulns/pillow/PYSEC-2016-19.yaml","reference_id":"","reference_type":"","scores":[{"value":"6.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H"},{"value":"7.1","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/pypa/advisory-database/tree/main/vulns/pillow/PYSEC-2016-19.yaml"},{"reference_url":"https://github.com/python-pillow/Pillow","reference_id":"","reference_type":"","scores":[{"value":"6.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H"},{"value":"7.1","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/python-pillow/Pillow"},{"reference_url":"https://github.com/python-pillow/Pillow/blob/c3cb690fed5d4bf0c45576759de55d054916c165/CHANGES.rst","reference_id":"","reference_type":"","scores":[{"value":"6.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H"},{"value":"7.1","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/python-pillow/Pillow/blob/c3cb690fed5d4bf0c45576759de55d054916c165/CHANGES.rst"},{"reference_url":"https://github.com/python-pillow/Pillow/blob/c3cb690fed5d4bf0c45576759de55d054916c165/CHANGES.rst?plain=1#L53","reference_id":"","reference_type":"","scores":[{"value":"6.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H"},{"value":"7.1","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/python-pillow/Pillow/blob/c3cb690fed5d4bf0c45576759de55d054916c165/CHANGES.rst?plain=1#L53"},{"reference_url":"https://github.com/python-pillow/Pillow/commit/5bdf54b5a76b54fb00bd05f2d733e0a4173eefc9","reference_id":"","reference_type":"","scores":[],"url":"https://github.com/python-pillow/Pillow/commit/5bdf54b5a76b54fb00bd05f2d733e0a4173eefc9"},{"reference_url":"https://github.com/python-pillow/Pillow/commit/5bdf54b5a76b54fb00bd05f2d733e0a4173eefc9#diff-8ff6909c159597e22288ad818938fd6b","reference_id":"","reference_type":"","scores":[{"value":"6.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H"},{"value":"7.1","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/python-pillow/Pillow/commit/5bdf54b5a76b54fb00bd05f2d733e0a4173eefc9#diff-8ff6909c159597e22288ad818938fd6b"},{"reference_url":"https://github.com/python-pillow/Pillow/commit/ae453aa18b66af54e7ff716f4ccb33adca60afd4#diff-8ff6909c159597e22288ad818938fd6b","reference_id":"","reference_type":"","scores":[{"value":"6.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H"},{"value":"7.1","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/python-pillow/Pillow/commit/ae453aa18b66af54e7ff716f4ccb33adca60afd4#diff-8ff6909c159597e22288ad818938fd6b"},{"reference_url":"https://github.com/python-pillow/Pillow/pull/1706","reference_id":"","reference_type":"","scores":[{"value":"6.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H"},{"value":"7.1","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/python-pillow/Pillow/pull/1706"},{"reference_url":"https://security.gentoo.org/glsa/201612-52","reference_id":"","reference_type":"","scores":[{"value":"6.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H"},{"value":"7.1","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://security.gentoo.org/glsa/201612-52"},{"reference_url":"http://www.debian.org/security/2016/dsa-3499","reference_id":"","reference_type":"","scores":[{"value":"6.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H"},{"value":"7.1","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"http://www.debian.org/security/2016/dsa-3499"},{"reference_url":"http://www.openwall.com/lists/oss-security/2016/02/02/5","reference_id":"","reference_type":"","scores":[{"value":"6.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H"},{"value":"7.1","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"http://www.openwall.com/lists/oss-security/2016/02/02/5"},{"reference_url":"http://www.openwall.com/lists/oss-security/2016/02/22/2","reference_id":"","reference_type":"","scores":[{"value":"6.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H"},{"value":"7.1","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"http://www.openwall.com/lists/oss-security/2016/02/22/2"},{"reference_url":"http://www.oracle.com/technetwork/topics/security/bulletinjan2016-2867206.html","reference_id":"","reference_type":"","scores":[{"value":"6.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H"},{"value":"7.1","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"http://www.oracle.com/technetwork/topics/security/bulletinjan2016-2867206.html"},{"reference_url":"https://bugzilla.redhat.com/show_bug.cgi?id=1304504","reference_id":"1304504","reference_type":"","scores":[],"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1304504"},{"reference_url":"https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:python_imaging_project:python_imaging:*:*:*:*:*:*:*:*","reference_id":"cpe:2.3:a:python_imaging_project:python_imaging:*:*:*:*:*:*:*:*","reference_type":"","scores":[],"url":"https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:python_imaging_project:python_imaging:*:*:*:*:*:*:*:*"},{"reference_url":"https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:python:pillow:*:*:*:*:*:*:*:*","reference_id":"cpe:2.3:a:python:pillow:*:*:*:*:*:*:*:*","reference_type":"","scores":[],"url":"https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:python:pillow:*:*:*:*:*:*:*:*"},{"reference_url":"https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:o:debian:debian_linux:7.0:*:*:*:*:*:*:*","reference_id":"cpe:2.3:o:debian:debian_linux:7.0:*:*:*:*:*:*:*","reference_type":"","scores":[],"url":"https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:o:debian:debian_linux:7.0:*:*:*:*:*:*:*"},{"reference_url":"https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*","reference_id":"cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*","reference_type":"","scores":[],"url":"https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*"},{"reference_url":"https://nvd.nist.gov/vuln/detail/CVE-2016-2533","reference_id":"CVE-2016-2533","reference_type":"","scores":[{"value":"4.3","scoring_system":"cvssv2","scoring_elements":"AV:N/AC:M/Au:N/C:N/I:N/A:P"},{"value":"6.5","scoring_system":"cvssv3","scoring_elements":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H"},{"value":"6.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H"},{"value":"7.1","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://nvd.nist.gov/vuln/detail/CVE-2016-2533"},{"reference_url":"http://www.cvedetails.com/cve/CVE-2016-2533/","reference_id":"CVE-2016-2533","reference_type":"","scores":[],"url":"http://www.cvedetails.com/cve/CVE-2016-2533/"},{"reference_url":"https://usn.ubuntu.com/3080-1/","reference_id":"USN-3080-1","reference_type":"","scores":[],"url":"https://usn.ubuntu.com/3080-1/"},{"reference_url":"https://usn.ubuntu.com/3090-1/","reference_id":"USN-3090-1","reference_type":"","scores":[],"url":"https://usn.ubuntu.com/3090-1/"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/4257?format=json","purl":"pkg:pypi/pillow@3.1.1","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-19e1-19hk-duet"},{"vulnerability":"VCID-1vt7-c6e3-7qc8"},{"vulnerability":"VCID-3qb5-8p8w-gkad"},{"vulnerability":"VCID-3uk9-eds5-rkgc"},{"vulnerability":"VCID-53ac-ceq4-qkhf"},{"vulnerability":"VCID-5rv4-k1q9-zue2"},{"vulnerability":"VCID-64n5-pugj-vue8"},{"vulnerability":"VCID-6gyu-fzpg-c3bn"},{"vulnerability":"VCID-8n2b-wvya-53e1"},{"vulnerability":"VCID-9ckw-ra54-z3b7"},{"vulnerability":"VCID-and9-6jty-pyeq"},{"vulnerability":"VCID-aubw-tsmn-ffcq"},{"vulnerability":"VCID-b3au-rcgp-2fag"},{"vulnerability":"VCID-b5a2-83ej-puaw"},{"vulnerability":"VCID-brp2-dtrf-jyfr"},{"vulnerability":"VCID-cas2-jb3y-vyhz"},{"vulnerability":"VCID-d7uf-zdbv-sba1"},{"vulnerability":"VCID-df4x-jt3h-17hx"},{"vulnerability":"VCID-dpc3-td9q-dyee"},{"vulnerability":"VCID-e3gp-zc2b-budg"},{"vulnerability":"VCID-en6t-uxtq-bfek"},{"vulnerability":"VCID-g46h-p8jk-cuhc"},{"vulnerability":"VCID-gvjw-funa-sqak"},{"vulnerability":"VCID-h4x7-7fke-mqgp"},{"vulnerability":"VCID-haum-8zpg-6kgf"},{"vulnerability":"VCID-hmmq-5772-bycm"},{"vulnerability":"VCID-khp6-9hfx-1kge"},{"vulnerability":"VCID-m3tm-h4q9-9yay"},{"vulnerability":"VCID-n1hp-atex-ubh4"},{"vulnerability":"VCID-n1w5-f5p7-xuhb"},{"vulnerability":"VCID-p6r3-puh1-zyg6"},{"vulnerability":"VCID-q4bb-qnxe-8bfa"},{"vulnerability":"VCID-rncf-9nf8-wud3"},{"vulnerability":"VCID-sns1-ksqr-vbhr"},{"vulnerability":"VCID-stft-hsk9-zfdy"},{"vulnerability":"VCID-u1en-t8ux-uube"},{"vulnerability":"VCID-ue18-zzau-x7hy"},{"vulnerability":"VCID-uf5t-asns-tudp"},{"vulnerability":"VCID-vdzj-kqfy-d3b7"},{"vulnerability":"VCID-vwbu-ruxm-tbh4"},{"vulnerability":"VCID-vxh1-8rvt-kkak"},{"vulnerability":"VCID-vyzt-df2u-h3cc"},{"vulnerability":"VCID-w9uy-fnpm-cbak"},{"vulnerability":"VCID-x15z-dejc-9ba6"},{"vulnerability":"VCID-xesd-d294-7fcx"},{"vulnerability":"VCID-xk66-1d31-2qbk"},{"vulnerability":"VCID-yccg-zw89-vqff"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:pypi/pillow@3.1.1"}],"aliases":["CVE-2016-2533","GHSA-3c5c-7235-994j","PYSEC-2016-19"],"risk_score":4.0,"exploitability":"0.5","weighted_severity":"8.0","resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-zmd3-henq-r7bd"}],"fixing_vulnerabilities":[],"risk_score":"10.0","resource_url":"http://public2.vulnerablecode.io/packages/pkg:pypi/pillow@1.6"}