{"url":"http://public2.vulnerablecode.io/api/packages/9210?format=json","purl":"pkg:pypi/pillow@3.1.1","type":"pypi","namespace":"","name":"pillow","version":"3.1.1","qualifiers":{},"subpath":"","is_vulnerable":true,"next_non_vulnerable_version":"12.2.0","latest_non_vulnerable_version":"12.2.0","affected_by_vulnerabilities":[{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/35949?format=json","vulnerability_id":"VCID-2gpf-94cu-6fcd","summary":"PIL.ImageMath.eval in Pillow before 9.0.0 allows evaluation of arbitrary expressions, such as ones that use the Python exec method.","references":[{"reference_url":"https://github.com/advisories/GHSA-8vj2-vxx3-667w","reference_id":"","reference_type":"","scores":[],"url":"https://github.com/advisories/GHSA-8vj2-vxx3-667w"},{"reference_url":"https://github.com/pypa/advisory-database/tree/main/vulns/pillow/PYSEC-2022-10.yaml","reference_id":"","reference_type":"","scores":[],"url":"https://github.com/pypa/advisory-database/tree/main/vulns/pillow/PYSEC-2022-10.yaml"},{"reference_url":"https://github.com/python-pillow/Pillow","reference_id":"","reference_type":"","scores":[],"url":"https://github.com/python-pillow/Pillow"},{"reference_url":"https://github.com/python-pillow/Pillow/commit/8531b01d6cdf0b70f256f93092caa2a5d91afc11","reference_id":"","reference_type":"","scores":[],"url":"https://github.com/python-pillow/Pillow/commit/8531b01d6cdf0b70f256f93092caa2a5d91afc11"},{"reference_url":"https://lists.debian.org/debian-lts-announce/2022/01/msg00018.html","reference_id":"","reference_type":"","scores":[],"url":"https://lists.debian.org/debian-lts-announce/2022/01/msg00018.html"},{"reference_url":"https://lists.debian.org/debian-lts-announce/2024/03/msg00021.html","reference_id":"","reference_type":"","scores":[],"url":"https://lists.debian.org/debian-lts-announce/2024/03/msg00021.html"},{"reference_url":"https://pillow.readthedocs.io/en/stable/releasenotes/9.0.0.html#restrict-builtins-available-to-imagemath-eval","reference_id":"","reference_type":"","scores":[],"url":"https://pillow.readthedocs.io/en/stable/releasenotes/9.0.0.html#restrict-builtins-available-to-imagemath-eval"},{"reference_url":"https://pillow.readthedocs.io/en/stable/releasenotes/9.0.1.html#security","reference_id":"","reference_type":"","scores":[],"url":"https://pillow.readthedocs.io/en/stable/releasenotes/9.0.1.html#security"},{"reference_url":"https://security.gentoo.org/glsa/202211-10","reference_id":"","reference_type":"","scores":[],"url":"https://security.gentoo.org/glsa/202211-10"},{"reference_url":"https://www.debian.org/security/2022/dsa-5053","reference_id":"","reference_type":"","scores":[],"url":"https://www.debian.org/security/2022/dsa-5053"},{"reference_url":"https://nvd.nist.gov/vuln/detail/CVE-2022-22817","reference_id":"CVE-2022-22817","reference_type":"","scores":[],"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-22817"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/26297?format=json","purl":"pkg:pypi/pillow@9.0.0","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-4tub-w66m-uyfu"},{"vulnerability":"VCID-9hza-srk7-sucy"},{"vulnerability":"VCID-q8fz-36n2-vfh2"},{"vulnerability":"VCID-vx7b-mwfx-5fg2"},{"vulnerability":"VCID-x3bz-ehvb-jyfs"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:pypi/pillow@9.0.0"},{"url":"http://public2.vulnerablecode.io/api/packages/27388?format=json","purl":"pkg:pypi/pillow@9.0.1","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-4tub-w66m-uyfu"},{"vulnerability":"VCID-9hza-srk7-sucy"},{"vulnerability":"VCID-vx7b-mwfx-5fg2"},{"vulnerability":"VCID-x3bz-ehvb-jyfs"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:pypi/pillow@9.0.1"}],"aliases":["CVE-2022-22817","GHSA-8vj2-vxx3-667w","PYSEC-2022-10"],"risk_score":null,"exploitability":null,"weighted_severity":null,"resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-2gpf-94cu-6fcd"},{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/35743?format=json","vulnerability_id":"VCID-3gam-zy4w-2ucr","summary":"Pillow before 8.1.1 allows attackers to cause a denial of service (memory consumption) because the reported size of a contained image is not properly checked for an ICO container, and thus an attempted memory allocation can be very large.","references":[{"reference_url":"https://github.com/advisories/GHSA-95q3-8gr9-gm8w","reference_id":"","reference_type":"","scores":[],"url":"https://github.com/advisories/GHSA-95q3-8gr9-gm8w"},{"reference_url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/S7G44Z33J4BNI2DPDROHWGVG2U7ZH5JU/","reference_id":"","reference_type":"","scores":[],"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/S7G44Z33J4BNI2DPDROHWGVG2U7ZH5JU/"},{"reference_url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/TQQY6472RX4J2SUJENWDZAWKTJJGP2ML/","reference_id":"","reference_type":"","scores":[],"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/TQQY6472RX4J2SUJENWDZAWKTJJGP2ML/"},{"reference_url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZTSY25UJU7NJUFHH3HWT575LT4TDFWBZ/","reference_id":"","reference_type":"","scores":[],"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZTSY25UJU7NJUFHH3HWT575LT4TDFWBZ/"},{"reference_url":"https://pillow.readthedocs.io/en/stable/releasenotes/8.1.1.html","reference_id":"","reference_type":"","scores":[],"url":"https://pillow.readthedocs.io/en/stable/releasenotes/8.1.1.html"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/20203?format=json","purl":"pkg:pypi/pillow@8.1.1","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-2gpf-94cu-6fcd"},{"vulnerability":"VCID-4tub-w66m-uyfu"},{"vulnerability":"VCID-7ya3-j9fa-zugj"},{"vulnerability":"VCID-9hza-srk7-sucy"},{"vulnerability":"VCID-d4dx-wbrv-gqaa"},{"vulnerability":"VCID-dkcx-xcb8-3fgj"},{"vulnerability":"VCID-fq9j-ntxd-t3b3"},{"vulnerability":"VCID-gve2-x5zh-gqha"},{"vulnerability":"VCID-htee-x1mv-sfhh"},{"vulnerability":"VCID-prvn-bejg-kufb"},{"vulnerability":"VCID-q8fz-36n2-vfh2"},{"vulnerability":"VCID-qbfa-rky7-juh5"},{"vulnerability":"VCID-tcda-8txy-7ygn"},{"vulnerability":"VCID-vx7b-mwfx-5fg2"},{"vulnerability":"VCID-wfzw-3x26-tucg"},{"vulnerability":"VCID-x3bz-ehvb-jyfs"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:pypi/pillow@8.1.1"}],"aliases":["CVE-2021-27923","GHSA-95q3-8gr9-gm8w","PYSEC-2021-42"],"risk_score":null,"exploitability":null,"weighted_severity":null,"resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-3gam-zy4w-2ucr"},{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/37349?format=json","vulnerability_id":"VCID-4tub-w66m-uyfu","summary":"Pillow versions before v10.0.1 bundled libwebp binaries in wheels that are vulnerable to CVE-2023-5129 (previously CVE-2023-4863). Pillow v10.0.1 upgrades the bundled libwebp binary to v1.3.2.","references":[{"reference_url":"https://github.com/python-pillow/Pillow/blob/main/CHANGES.rst#1001-2023-09-15","reference_id":"","reference_type":"","scores":[],"url":"https://github.com/python-pillow/Pillow/blob/main/CHANGES.rst#1001-2023-09-15"},{"reference_url":"https://nvd.nist.gov/vuln/detail/CVE-2023-4863","reference_id":"","reference_type":"","scores":[],"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-4863"},{"reference_url":"https://nvd.nist.gov/vuln/detail/CVE-2023-5129","reference_id":"","reference_type":"","scores":[],"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-5129"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/50048?format=json","purl":"pkg:pypi/pillow@10.0.1","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-9hza-srk7-sucy"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:pypi/pillow@10.0.1"}],"aliases":["PYSEC-2023-175"],"risk_score":null,"exploitability":null,"weighted_severity":null,"resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-4tub-w66m-uyfu"},{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/35753?format=json","vulnerability_id":"VCID-5h45-rcpb-q7bz","summary":"An issue was discovered in Pillow before 8.1.1. TiffDecode has a heap-based buffer overflow when decoding crafted YCbCr files because of certain interpretation conflicts with LibTIFF in RGBA mode. NOTE: this issue exists because of an incomplete fix for CVE-2020-35654.","references":[{"reference_url":"https://github.com/advisories/GHSA-57h3-9rgr-c24m","reference_id":"","reference_type":"","scores":[],"url":"https://github.com/advisories/GHSA-57h3-9rgr-c24m"},{"reference_url":"https://pillow.readthedocs.io/en/stable/releasenotes/8.1.1.html","reference_id":"","reference_type":"","scores":[],"url":"https://pillow.readthedocs.io/en/stable/releasenotes/8.1.1.html"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/20203?format=json","purl":"pkg:pypi/pillow@8.1.1","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-2gpf-94cu-6fcd"},{"vulnerability":"VCID-4tub-w66m-uyfu"},{"vulnerability":"VCID-7ya3-j9fa-zugj"},{"vulnerability":"VCID-9hza-srk7-sucy"},{"vulnerability":"VCID-d4dx-wbrv-gqaa"},{"vulnerability":"VCID-dkcx-xcb8-3fgj"},{"vulnerability":"VCID-fq9j-ntxd-t3b3"},{"vulnerability":"VCID-gve2-x5zh-gqha"},{"vulnerability":"VCID-htee-x1mv-sfhh"},{"vulnerability":"VCID-prvn-bejg-kufb"},{"vulnerability":"VCID-q8fz-36n2-vfh2"},{"vulnerability":"VCID-qbfa-rky7-juh5"},{"vulnerability":"VCID-tcda-8txy-7ygn"},{"vulnerability":"VCID-vx7b-mwfx-5fg2"},{"vulnerability":"VCID-wfzw-3x26-tucg"},{"vulnerability":"VCID-x3bz-ehvb-jyfs"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:pypi/pillow@8.1.1"}],"aliases":["CVE-2021-25289","GHSA-57h3-9rgr-c24m","PYSEC-2021-35"],"risk_score":null,"exploitability":null,"weighted_severity":null,"resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-5h45-rcpb-q7bz"},{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/35007?format=json","vulnerability_id":"VCID-6qkd-kgxx-dyeq","summary":"Pillow before 3.3.2 allows context-dependent attackers to obtain sensitive information by using the \"crafted image file\" approach, related to an \"Integer Overflow\" issue affecting the Image.core.map_buffer in map.c component.","references":[{"reference_url":"http://pillow.readthedocs.io/en/3.4.x/releasenotes/3.3.2.html","reference_id":"","reference_type":"","scores":[],"url":"http://pillow.readthedocs.io/en/3.4.x/releasenotes/3.3.2.html"},{"reference_url":"https://github.com/advisories/GHSA-rwr3-c2q8-gm56","reference_id":"","reference_type":"","scores":[],"url":"https://github.com/advisories/GHSA-rwr3-c2q8-gm56"},{"reference_url":"https://github.com/pypa/advisory-database/tree/main/vulns/pillow/PYSEC-2016-8.yaml","reference_id":"","reference_type":"","scores":[],"url":"https://github.com/pypa/advisory-database/tree/main/vulns/pillow/PYSEC-2016-8.yaml"},{"reference_url":"https://github.com/python-pillow/Pillow","reference_id":"","reference_type":"","scores":[],"url":"https://github.com/python-pillow/Pillow"},{"reference_url":"https://github.com/python-pillow/Pillow/issues/2105","reference_id":"","reference_type":"","scores":[],"url":"https://github.com/python-pillow/Pillow/issues/2105"},{"reference_url":"https://github.com/python-pillow/Pillow/pull/2146/commits/c50ebe6459a131a1ea8ca531f10da616d3ceaa0f","reference_id":"","reference_type":"","scores":[],"url":"https://github.com/python-pillow/Pillow/pull/2146/commits/c50ebe6459a131a1ea8ca531f10da616d3ceaa0f"},{"reference_url":"https://security.gentoo.org/glsa/201612-52","reference_id":"","reference_type":"","scores":[],"url":"https://security.gentoo.org/glsa/201612-52"},{"reference_url":"http://www.debian.org/security/2016/dsa-3710","reference_id":"","reference_type":"","scores":[],"url":"http://www.debian.org/security/2016/dsa-3710"},{"reference_url":"http://www.securityfocus.com/bid/94234","reference_id":"","reference_type":"","scores":[],"url":"http://www.securityfocus.com/bid/94234"},{"reference_url":"https://nvd.nist.gov/vuln/detail/CVE-2016-9189","reference_id":"CVE-2016-9189","reference_type":"","scores":[],"url":"https://nvd.nist.gov/vuln/detail/CVE-2016-9189"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/9450?format=json","purl":"pkg:pypi/pillow@3.3.2","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-2gpf-94cu-6fcd"},{"vulnerability":"VCID-3gam-zy4w-2ucr"},{"vulnerability":"VCID-4tub-w66m-uyfu"},{"vulnerability":"VCID-5h45-rcpb-q7bz"},{"vulnerability":"VCID-7sps-ppua-ubb2"},{"vulnerability":"VCID-7v6e-3dxw-aubu"},{"vulnerability":"VCID-7ya3-j9fa-zugj"},{"vulnerability":"VCID-8z6g-5td3-g7ej"},{"vulnerability":"VCID-9hza-srk7-sucy"},{"vulnerability":"VCID-9qm6-cbz9-b7c8"},{"vulnerability":"VCID-9v9s-wbu3-cqc7"},{"vulnerability":"VCID-cb58-eehb-j7cv"},{"vulnerability":"VCID-d4dx-wbrv-gqaa"},{"vulnerability":"VCID-dkcx-xcb8-3fgj"},{"vulnerability":"VCID-fq9j-ntxd-t3b3"},{"vulnerability":"VCID-g48w-36yx-tue3"},{"vulnerability":"VCID-gve2-x5zh-gqha"},{"vulnerability":"VCID-htee-x1mv-sfhh"},{"vulnerability":"VCID-jtq6-eykc-ykbz"},{"vulnerability":"VCID-kjxw-f4f4-dydb"},{"vulnerability":"VCID-mph7-qmm8-1fan"},{"vulnerability":"VCID-p66f-cwf8-tfdr"},{"vulnerability":"VCID-prvn-bejg-kufb"},{"vulnerability":"VCID-q8fz-36n2-vfh2"},{"vulnerability":"VCID-qbfa-rky7-juh5"},{"vulnerability":"VCID-qz6s-pjqj-7uet"},{"vulnerability":"VCID-t3rz-wf43-a3bf"},{"vulnerability":"VCID-tcda-8txy-7ygn"},{"vulnerability":"VCID-vx7b-mwfx-5fg2"},{"vulnerability":"VCID-vxtq-wjad-3ue3"},{"vulnerability":"VCID-wfzw-3x26-tucg"},{"vulnerability":"VCID-whh3-qs36-pqfq"},{"vulnerability":"VCID-wuv4-qn69-zygh"},{"vulnerability":"VCID-x3bz-ehvb-jyfs"},{"vulnerability":"VCID-xbur-n6na-d7g1"},{"vulnerability":"VCID-yk5x-nt2m-5kgy"},{"vulnerability":"VCID-zsxq-dasb-qyex"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:pypi/pillow@3.3.2"}],"aliases":["CVE-2016-9189","GHSA-rwr3-c2q8-gm56","PYSEC-2016-8"],"risk_score":null,"exploitability":null,"weighted_severity":null,"resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-6qkd-kgxx-dyeq"},{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/35054?format=json","vulnerability_id":"VCID-6wqw-esat-2ua2","summary":"Heap-based buffer overflow in the j2k_encode_entry function in Pillow 2.5.0 through 3.1.1 allows remote attackers to cause a denial of service (memory corruption) via a crafted Jpeg2000 file.","references":[{"reference_url":"http://pillow.readthedocs.io/en/4.1.x/releasenotes/3.1.2.html","reference_id":"","reference_type":"","scores":[],"url":"http://pillow.readthedocs.io/en/4.1.x/releasenotes/3.1.2.html"},{"reference_url":"https://bugzilla.redhat.com/show_bug.cgi?id=1321929","reference_id":"","reference_type":"","scores":[],"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1321929"},{"reference_url":"http://www.securityfocus.com/bid/98042","reference_id":"","reference_type":"","scores":[],"url":"http://www.securityfocus.com/bid/98042"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/9446?format=json","purl":"pkg:pypi/pillow@3.1.2","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-2gpf-94cu-6fcd"},{"vulnerability":"VCID-3gam-zy4w-2ucr"},{"vulnerability":"VCID-4tub-w66m-uyfu"},{"vulnerability":"VCID-5h45-rcpb-q7bz"},{"vulnerability":"VCID-6qkd-kgxx-dyeq"},{"vulnerability":"VCID-7sps-ppua-ubb2"},{"vulnerability":"VCID-7v6e-3dxw-aubu"},{"vulnerability":"VCID-7ya3-j9fa-zugj"},{"vulnerability":"VCID-8z6g-5td3-g7ej"},{"vulnerability":"VCID-9hza-srk7-sucy"},{"vulnerability":"VCID-9qm6-cbz9-b7c8"},{"vulnerability":"VCID-9v9s-wbu3-cqc7"},{"vulnerability":"VCID-cb58-eehb-j7cv"},{"vulnerability":"VCID-d4dx-wbrv-gqaa"},{"vulnerability":"VCID-dkcx-xcb8-3fgj"},{"vulnerability":"VCID-fq9j-ntxd-t3b3"},{"vulnerability":"VCID-g48w-36yx-tue3"},{"vulnerability":"VCID-gve2-x5zh-gqha"},{"vulnerability":"VCID-htee-x1mv-sfhh"},{"vulnerability":"VCID-jtq6-eykc-ykbz"},{"vulnerability":"VCID-kjxw-f4f4-dydb"},{"vulnerability":"VCID-mph7-qmm8-1fan"},{"vulnerability":"VCID-p66f-cwf8-tfdr"},{"vulnerability":"VCID-prvn-bejg-kufb"},{"vulnerability":"VCID-px2q-ph74-1ue6"},{"vulnerability":"VCID-q8fz-36n2-vfh2"},{"vulnerability":"VCID-qbfa-rky7-juh5"},{"vulnerability":"VCID-qz6s-pjqj-7uet"},{"vulnerability":"VCID-t3rz-wf43-a3bf"},{"vulnerability":"VCID-tcda-8txy-7ygn"},{"vulnerability":"VCID-vx7b-mwfx-5fg2"},{"vulnerability":"VCID-vxtq-wjad-3ue3"},{"vulnerability":"VCID-wfzw-3x26-tucg"},{"vulnerability":"VCID-whh3-qs36-pqfq"},{"vulnerability":"VCID-wuv4-qn69-zygh"},{"vulnerability":"VCID-x3bz-ehvb-jyfs"},{"vulnerability":"VCID-xbur-n6na-d7g1"},{"vulnerability":"VCID-yk5x-nt2m-5kgy"},{"vulnerability":"VCID-zsxq-dasb-qyex"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:pypi/pillow@3.1.2"}],"aliases":["CVE-2016-3076","PYSEC-2017-92"],"risk_score":null,"exploitability":null,"weighted_severity":null,"resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-6wqw-esat-2ua2"},{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/35474?format=json","vulnerability_id":"VCID-7sps-ppua-ubb2","summary":"libImaging/TiffDecode.c in Pillow before 6.2.2 has a TIFF decoding integer overflow, related to realloc.","references":[{"reference_url":"https://github.com/advisories/GHSA-vcqg-3p29-xw73","reference_id":"","reference_type":"","scores":[],"url":"https://github.com/advisories/GHSA-vcqg-3p29-xw73"},{"reference_url":"https://github.com/pypa/advisory-database/tree/main/vulns/pillow/PYSEC-2020-81.yaml","reference_id":"","reference_type":"","scores":[],"url":"https://github.com/pypa/advisory-database/tree/main/vulns/pillow/PYSEC-2020-81.yaml"},{"reference_url":"https://github.com/pypa/advisory-db/blob/7872b0a91b4d980f749e6d75a81f8cc1af32829f/vulns/pillow/PYSEC-2020-81.yaml","reference_id":"","reference_type":"","scores":[],"url":"https://github.com/pypa/advisory-db/blob/7872b0a91b4d980f749e6d75a81f8cc1af32829f/vulns/pillow/PYSEC-2020-81.yaml"},{"reference_url":"https://github.com/python-pillow/Pillow","reference_id":"","reference_type":"","scores":[],"url":"https://github.com/python-pillow/Pillow"},{"reference_url":"https://github.com/python-pillow/Pillow/commit/4e2def2539ec13e53a82e06c4b3daf00454100c4","reference_id":"","reference_type":"","scores":[],"url":"https://github.com/python-pillow/Pillow/commit/4e2def2539ec13e53a82e06c4b3daf00454100c4"},{"reference_url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/2MMU3WT2X64GS5WHDPKKC2WZA7UIIQ3A","reference_id":"","reference_type":"","scores":[],"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/2MMU3WT2X64GS5WHDPKKC2WZA7UIIQ3A"},{"reference_url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/2MMU3WT2X64GS5WHDPKKC2WZA7UIIQ3A/","reference_id":"","reference_type":"","scores":[],"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/2MMU3WT2X64GS5WHDPKKC2WZA7UIIQ3A/"},{"reference_url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/3DUMIBUYGJRAVJCTFUWBRLVQKOUTVX5P","reference_id":"","reference_type":"","scores":[],"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/3DUMIBUYGJRAVJCTFUWBRLVQKOUTVX5P"},{"reference_url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/3DUMIBUYGJRAVJCTFUWBRLVQKOUTVX5P/","reference_id":"","reference_type":"","scores":[],"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/3DUMIBUYGJRAVJCTFUWBRLVQKOUTVX5P/"},{"reference_url":"https://pillow.readthedocs.io/en/stable/releasenotes/6.2.2.html","reference_id":"","reference_type":"","scores":[],"url":"https://pillow.readthedocs.io/en/stable/releasenotes/6.2.2.html"},{"reference_url":"https://usn.ubuntu.com/4272-1","reference_id":"","reference_type":"","scores":[],"url":"https://usn.ubuntu.com/4272-1"},{"reference_url":"https://usn.ubuntu.com/4272-1/","reference_id":"","reference_type":"","scores":[],"url":"https://usn.ubuntu.com/4272-1/"},{"reference_url":"https://nvd.nist.gov/vuln/detail/CVE-2020-5310","reference_id":"CVE-2020-5310","reference_type":"","scores":[],"url":"https://nvd.nist.gov/vuln/detail/CVE-2020-5310"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/14798?format=json","purl":"pkg:pypi/pillow@6.2.2","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-2gpf-94cu-6fcd"},{"vulnerability":"VCID-3gam-zy4w-2ucr"},{"vulnerability":"VCID-4tub-w66m-uyfu"},{"vulnerability":"VCID-5h45-rcpb-q7bz"},{"vulnerability":"VCID-7hcs-pkze-6ba4"},{"vulnerability":"VCID-7v6e-3dxw-aubu"},{"vulnerability":"VCID-7ya3-j9fa-zugj"},{"vulnerability":"VCID-8z6g-5td3-g7ej"},{"vulnerability":"VCID-9hza-srk7-sucy"},{"vulnerability":"VCID-9v9s-wbu3-cqc7"},{"vulnerability":"VCID-d4dx-wbrv-gqaa"},{"vulnerability":"VCID-dkcx-xcb8-3fgj"},{"vulnerability":"VCID-fq9j-ntxd-t3b3"},{"vulnerability":"VCID-g48w-36yx-tue3"},{"vulnerability":"VCID-gve2-x5zh-gqha"},{"vulnerability":"VCID-htee-x1mv-sfhh"},{"vulnerability":"VCID-jtq6-eykc-ykbz"},{"vulnerability":"VCID-kjxw-f4f4-dydb"},{"vulnerability":"VCID-prvn-bejg-kufb"},{"vulnerability":"VCID-q8fz-36n2-vfh2"},{"vulnerability":"VCID-qbfa-rky7-juh5"},{"vulnerability":"VCID-qz6s-pjqj-7uet"},{"vulnerability":"VCID-t3rz-wf43-a3bf"},{"vulnerability":"VCID-tcda-8txy-7ygn"},{"vulnerability":"VCID-vx7b-mwfx-5fg2"},{"vulnerability":"VCID-wfzw-3x26-tucg"},{"vulnerability":"VCID-whh3-qs36-pqfq"},{"vulnerability":"VCID-wuv4-qn69-zygh"},{"vulnerability":"VCID-x3bz-ehvb-jyfs"},{"vulnerability":"VCID-xbur-n6na-d7g1"},{"vulnerability":"VCID-yk5x-nt2m-5kgy"},{"vulnerability":"VCID-zsxq-dasb-qyex"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:pypi/pillow@6.2.2"}],"aliases":["CVE-2020-5310","GHSA-vcqg-3p29-xw73","PYSEC-2020-81"],"risk_score":null,"exploitability":null,"weighted_severity":null,"resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-7sps-ppua-ubb2"},{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/35710?format=json","vulnerability_id":"VCID-7v6e-3dxw-aubu","summary":"In Pillow before 8.1.0, PcxDecode has a buffer over-read when decoding a crafted PCX file because the user-supplied stride value is trusted for buffer calculations.","references":[{"reference_url":"https://github.com/advisories/GHSA-f5g8-5qq7-938w","reference_id":"","reference_type":"","scores":[],"url":"https://github.com/advisories/GHSA-f5g8-5qq7-938w"},{"reference_url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6BYVI5G44MRIPERKYDQEL3S3YQCZTVHE/","reference_id":"","reference_type":"","scores":[],"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6BYVI5G44MRIPERKYDQEL3S3YQCZTVHE/"},{"reference_url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/BF553AMNNNBW7SH4IM4MNE4M6GNZQ7YD/","reference_id":"","reference_type":"","scores":[],"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/BF553AMNNNBW7SH4IM4MNE4M6GNZQ7YD/"},{"reference_url":"https://pillow.readthedocs.io/en/stable/releasenotes/index.html","reference_id":"","reference_type":"","scores":[],"url":"https://pillow.readthedocs.io/en/stable/releasenotes/index.html"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/19728?format=json","purl":"pkg:pypi/pillow@8.1.0","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-2gpf-94cu-6fcd"},{"vulnerability":"VCID-3gam-zy4w-2ucr"},{"vulnerability":"VCID-4tub-w66m-uyfu"},{"vulnerability":"VCID-5h45-rcpb-q7bz"},{"vulnerability":"VCID-7ya3-j9fa-zugj"},{"vulnerability":"VCID-8z6g-5td3-g7ej"},{"vulnerability":"VCID-9hza-srk7-sucy"},{"vulnerability":"VCID-d4dx-wbrv-gqaa"},{"vulnerability":"VCID-dkcx-xcb8-3fgj"},{"vulnerability":"VCID-fq9j-ntxd-t3b3"},{"vulnerability":"VCID-g48w-36yx-tue3"},{"vulnerability":"VCID-gve2-x5zh-gqha"},{"vulnerability":"VCID-htee-x1mv-sfhh"},{"vulnerability":"VCID-prvn-bejg-kufb"},{"vulnerability":"VCID-q8fz-36n2-vfh2"},{"vulnerability":"VCID-qbfa-rky7-juh5"},{"vulnerability":"VCID-qz6s-pjqj-7uet"},{"vulnerability":"VCID-tcda-8txy-7ygn"},{"vulnerability":"VCID-vx7b-mwfx-5fg2"},{"vulnerability":"VCID-wfzw-3x26-tucg"},{"vulnerability":"VCID-wuv4-qn69-zygh"},{"vulnerability":"VCID-x3bz-ehvb-jyfs"},{"vulnerability":"VCID-yk5x-nt2m-5kgy"},{"vulnerability":"VCID-zsxq-dasb-qyex"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:pypi/pillow@8.1.0"}],"aliases":["CVE-2020-35653","GHSA-f5g8-5qq7-938w","PYSEC-2021-69"],"risk_score":null,"exploitability":null,"weighted_severity":null,"resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-7v6e-3dxw-aubu"},{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/7258?format=json","vulnerability_id":"VCID-7ya3-j9fa-zugj","summary":"arbitrary code execution","references":[{"reference_url":"https://github.com/advisories/GHSA-7534-mm45-c74v","reference_id":"","reference_type":"","scores":[],"url":"https://github.com/advisories/GHSA-7534-mm45-c74v"},{"reference_url":"https://github.com/pypa/advisory-database/tree/main/vulns/pillow/PYSEC-2021-331.yaml","reference_id":"","reference_type":"","scores":[],"url":"https://github.com/pypa/advisory-database/tree/main/vulns/pillow/PYSEC-2021-331.yaml"},{"reference_url":"https://github.com/python-pillow/Pillow","reference_id":"","reference_type":"","scores":[],"url":"https://github.com/python-pillow/Pillow"},{"reference_url":"https://github.com/python-pillow/Pillow/commit/31c473898c29d1b7cb6555ce67d9503a4906b83f","reference_id":"","reference_type":"","scores":[],"url":"https://github.com/python-pillow/Pillow/commit/31c473898c29d1b7cb6555ce67d9503a4906b83f"},{"reference_url":"https://github.com/python-pillow/Pillow/pull/5567","reference_id":"","reference_type":"","scores":[],"url":"https://github.com/python-pillow/Pillow/pull/5567"},{"reference_url":"https://lists.debian.org/debian-lts-announce/2021/07/msg00018.html","reference_id":"","reference_type":"","scores":[],"url":"https://lists.debian.org/debian-lts-announce/2021/07/msg00018.html"},{"reference_url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/7V6LCG525ARIX6LX5QRYNAWVDD2MD2SV","reference_id":"","reference_type":"","scores":[],"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/7V6LCG525ARIX6LX5QRYNAWVDD2MD2SV"},{"reference_url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/7V6LCG525ARIX6LX5QRYNAWVDD2MD2SV/","reference_id":"","reference_type":"","scores":[],"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/7V6LCG525ARIX6LX5QRYNAWVDD2MD2SV/"},{"reference_url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/VUGBBT63VL7G4JNOEIPDJIOC34ZFBKNJ","reference_id":"","reference_type":"","scores":[],"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/VUGBBT63VL7G4JNOEIPDJIOC34ZFBKNJ"},{"reference_url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/VUGBBT63VL7G4JNOEIPDJIOC34ZFBKNJ/","reference_id":"","reference_type":"","scores":[],"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/VUGBBT63VL7G4JNOEIPDJIOC34ZFBKNJ/"},{"reference_url":"https://pillow.readthedocs.io/en/stable/releasenotes/8.3.0.html#buffer-overflow","reference_id":"","reference_type":"","scores":[],"url":"https://pillow.readthedocs.io/en/stable/releasenotes/8.3.0.html#buffer-overflow"},{"reference_url":"https://pillow.readthedocs.io/en/stable/releasenotes/index.html","reference_id":"","reference_type":"","scores":[],"url":"https://pillow.readthedocs.io/en/stable/releasenotes/index.html"},{"reference_url":"https://security.gentoo.org/glsa/202211-10","reference_id":"","reference_type":"","scores":[],"url":"https://security.gentoo.org/glsa/202211-10"},{"reference_url":"https://security.archlinux.org/ASA-202107-26","reference_id":"ASA-202107-26","reference_type":"","scores":[],"url":"https://security.archlinux.org/ASA-202107-26"},{"reference_url":"https://security.archlinux.org/AVG-2150","reference_id":"AVG-2150","reference_type":"","scores":[{"value":"Medium","scoring_system":"archlinux","scoring_elements":""}],"url":"https://security.archlinux.org/AVG-2150"},{"reference_url":"https://nvd.nist.gov/vuln/detail/CVE-2021-34552","reference_id":"CVE-2021-34552","reference_type":"","scores":[],"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-34552"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/22806?format=json","purl":"pkg:pypi/pillow@8.3.0","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-2gpf-94cu-6fcd"},{"vulnerability":"VCID-4tub-w66m-uyfu"},{"vulnerability":"VCID-9hza-srk7-sucy"},{"vulnerability":"VCID-d4dx-wbrv-gqaa"},{"vulnerability":"VCID-dkcx-xcb8-3fgj"},{"vulnerability":"VCID-q8fz-36n2-vfh2"},{"vulnerability":"VCID-vx7b-mwfx-5fg2"},{"vulnerability":"VCID-wfzw-3x26-tucg"},{"vulnerability":"VCID-x3bz-ehvb-jyfs"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:pypi/pillow@8.3.0"}],"aliases":["CVE-2021-34552","GHSA-7534-mm45-c74v","PYSEC-2021-331"],"risk_score":null,"exploitability":null,"weighted_severity":null,"resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-7ya3-j9fa-zugj"},{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/35752?format=json","vulnerability_id":"VCID-8z6g-5td3-g7ej","summary":"An issue was discovered in Pillow before 8.1.1. There is an out-of-bounds read in SGIRleDecode.c.","references":[{"reference_url":"https://github.com/advisories/GHSA-p43w-g3c5-g5mq","reference_id":"","reference_type":"","scores":[],"url":"https://github.com/advisories/GHSA-p43w-g3c5-g5mq"},{"reference_url":"https://pillow.readthedocs.io/en/stable/releasenotes/8.1.1.html","reference_id":"","reference_type":"","scores":[],"url":"https://pillow.readthedocs.io/en/stable/releasenotes/8.1.1.html"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/20203?format=json","purl":"pkg:pypi/pillow@8.1.1","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-2gpf-94cu-6fcd"},{"vulnerability":"VCID-4tub-w66m-uyfu"},{"vulnerability":"VCID-7ya3-j9fa-zugj"},{"vulnerability":"VCID-9hza-srk7-sucy"},{"vulnerability":"VCID-d4dx-wbrv-gqaa"},{"vulnerability":"VCID-dkcx-xcb8-3fgj"},{"vulnerability":"VCID-fq9j-ntxd-t3b3"},{"vulnerability":"VCID-gve2-x5zh-gqha"},{"vulnerability":"VCID-htee-x1mv-sfhh"},{"vulnerability":"VCID-prvn-bejg-kufb"},{"vulnerability":"VCID-q8fz-36n2-vfh2"},{"vulnerability":"VCID-qbfa-rky7-juh5"},{"vulnerability":"VCID-tcda-8txy-7ygn"},{"vulnerability":"VCID-vx7b-mwfx-5fg2"},{"vulnerability":"VCID-wfzw-3x26-tucg"},{"vulnerability":"VCID-x3bz-ehvb-jyfs"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:pypi/pillow@8.1.1"}],"aliases":["CVE-2021-25293","GHSA-p43w-g3c5-g5mq","PYSEC-2021-39"],"risk_score":null,"exploitability":null,"weighted_severity":null,"resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-8z6g-5td3-g7ej"},{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/37317?format=json","vulnerability_id":"VCID-9hza-srk7-sucy","summary":"Pillow is a Python imaging library. Prior to version 12.2.0, if a font advances for each glyph by an exceeding large amount, when Pillow keeps track of the current position, it may lead to an integer overflow. This issue has been patched in version 12.2.0.","references":[{"reference_url":"https://github.com/python-pillow/Pillow/releases/tag/12.2.0","reference_id":"","reference_type":"","scores":[{"value":"5.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"}],"url":"https://github.com/python-pillow/Pillow/releases/tag/12.2.0"},{"reference_url":"https://github.com/python-pillow/Pillow/security/advisories/GHSA-wjx4-4jcj-g98j","reference_id":"","reference_type":"","scores":[{"value":"5.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"}],"url":"https://github.com/python-pillow/Pillow/security/advisories/GHSA-wjx4-4jcj-g98j"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/50058?format=json","purl":"pkg:pypi/pillow@12.2.0","is_vulnerable":false,"affected_by_vulnerabilities":[],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:pypi/pillow@12.2.0"}],"aliases":["CVE-2026-42308","GHSA-wjx4-4jcj-g98j","PYSEC-2026-165"],"risk_score":null,"exploitability":null,"weighted_severity":null,"resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-9hza-srk7-sucy"},{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/35477?format=json","vulnerability_id":"VCID-9qm6-cbz9-b7c8","summary":"There is a DoS vulnerability in Pillow before 6.2.2 caused by FpxImagePlugin.py calling the range function on an unvalidated 32-bit integer if the number of bands is large. On Windows running 32-bit Python, this results in an OverflowError or MemoryError due to the 2 GB limit. However, on Linux running 64-bit Python this results in the process being terminated by the OOM killer.","references":[{"reference_url":"https://github.com/advisories/GHSA-5gm3-px64-rw72","reference_id":"","reference_type":"","scores":[],"url":"https://github.com/advisories/GHSA-5gm3-px64-rw72"},{"reference_url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/3DUMIBUYGJRAVJCTFUWBRLVQKOUTVX5P/","reference_id":"","reference_type":"","scores":[],"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/3DUMIBUYGJRAVJCTFUWBRLVQKOUTVX5P/"},{"reference_url":"https://pillow.readthedocs.io/en/stable/releasenotes/6.2.2.html","reference_id":"","reference_type":"","scores":[],"url":"https://pillow.readthedocs.io/en/stable/releasenotes/6.2.2.html"},{"reference_url":"https://usn.ubuntu.com/4272-1/","reference_id":"","reference_type":"","scores":[],"url":"https://usn.ubuntu.com/4272-1/"},{"reference_url":"https://www.debian.org/security/2020/dsa-4631","reference_id":"","reference_type":"","scores":[],"url":"https://www.debian.org/security/2020/dsa-4631"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/14798?format=json","purl":"pkg:pypi/pillow@6.2.2","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-2gpf-94cu-6fcd"},{"vulnerability":"VCID-3gam-zy4w-2ucr"},{"vulnerability":"VCID-4tub-w66m-uyfu"},{"vulnerability":"VCID-5h45-rcpb-q7bz"},{"vulnerability":"VCID-7hcs-pkze-6ba4"},{"vulnerability":"VCID-7v6e-3dxw-aubu"},{"vulnerability":"VCID-7ya3-j9fa-zugj"},{"vulnerability":"VCID-8z6g-5td3-g7ej"},{"vulnerability":"VCID-9hza-srk7-sucy"},{"vulnerability":"VCID-9v9s-wbu3-cqc7"},{"vulnerability":"VCID-d4dx-wbrv-gqaa"},{"vulnerability":"VCID-dkcx-xcb8-3fgj"},{"vulnerability":"VCID-fq9j-ntxd-t3b3"},{"vulnerability":"VCID-g48w-36yx-tue3"},{"vulnerability":"VCID-gve2-x5zh-gqha"},{"vulnerability":"VCID-htee-x1mv-sfhh"},{"vulnerability":"VCID-jtq6-eykc-ykbz"},{"vulnerability":"VCID-kjxw-f4f4-dydb"},{"vulnerability":"VCID-prvn-bejg-kufb"},{"vulnerability":"VCID-q8fz-36n2-vfh2"},{"vulnerability":"VCID-qbfa-rky7-juh5"},{"vulnerability":"VCID-qz6s-pjqj-7uet"},{"vulnerability":"VCID-t3rz-wf43-a3bf"},{"vulnerability":"VCID-tcda-8txy-7ygn"},{"vulnerability":"VCID-vx7b-mwfx-5fg2"},{"vulnerability":"VCID-wfzw-3x26-tucg"},{"vulnerability":"VCID-whh3-qs36-pqfq"},{"vulnerability":"VCID-wuv4-qn69-zygh"},{"vulnerability":"VCID-x3bz-ehvb-jyfs"},{"vulnerability":"VCID-xbur-n6na-d7g1"},{"vulnerability":"VCID-yk5x-nt2m-5kgy"},{"vulnerability":"VCID-zsxq-dasb-qyex"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:pypi/pillow@6.2.2"}],"aliases":["CVE-2019-19911","GHSA-5gm3-px64-rw72","PYSEC-2020-172"],"risk_score":null,"exploitability":null,"weighted_severity":null,"resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-9qm6-cbz9-b7c8"},{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/35582?format=json","vulnerability_id":"VCID-9v9s-wbu3-cqc7","summary":"Pillow before 7.1.0 has multiple out-of-bounds reads in libImaging/FliDecode.c.","references":[{"reference_url":"https://github.com/advisories/GHSA-cqhg-xjhh-p8hf","reference_id":"","reference_type":"","scores":[],"url":"https://github.com/advisories/GHSA-cqhg-xjhh-p8hf"},{"reference_url":"https://github.com/python-pillow/Pillow/commits/master/src/libImaging","reference_id":"","reference_type":"","scores":[],"url":"https://github.com/python-pillow/Pillow/commits/master/src/libImaging"},{"reference_url":"https://github.com/python-pillow/Pillow/pull/4503","reference_id":"","reference_type":"","scores":[],"url":"https://github.com/python-pillow/Pillow/pull/4503"},{"reference_url":"https://github.com/python-pillow/Pillow/pull/4538","reference_id":"","reference_type":"","scores":[],"url":"https://github.com/python-pillow/Pillow/pull/4538"},{"reference_url":"https://lists.debian.org/debian-lts-announce/2020/08/msg00012.html","reference_id":"","reference_type":"","scores":[],"url":"https://lists.debian.org/debian-lts-announce/2020/08/msg00012.html"},{"reference_url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/BEBCPE4F2VHTIT6EZA2YZQZLPVDEBJGD/","reference_id":"","reference_type":"","scores":[],"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/BEBCPE4F2VHTIT6EZA2YZQZLPVDEBJGD/"},{"reference_url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/HOKHNWV2VS5GESY7IBD237E7C6T3I427/","reference_id":"","reference_type":"","scores":[],"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/HOKHNWV2VS5GESY7IBD237E7C6T3I427/"},{"reference_url":"https://pillow.readthedocs.io/en/stable/releasenotes/7.1.0.html","reference_id":"","reference_type":"","scores":[],"url":"https://pillow.readthedocs.io/en/stable/releasenotes/7.1.0.html"},{"reference_url":"https://usn.ubuntu.com/4430-1/","reference_id":"","reference_type":"","scores":[],"url":"https://usn.ubuntu.com/4430-1/"},{"reference_url":"https://usn.ubuntu.com/4430-2/","reference_id":"","reference_type":"","scores":[],"url":"https://usn.ubuntu.com/4430-2/"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/17728?format=json","purl":"pkg:pypi/pillow@7.1.0","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-2gpf-94cu-6fcd"},{"vulnerability":"VCID-3gam-zy4w-2ucr"},{"vulnerability":"VCID-4tub-w66m-uyfu"},{"vulnerability":"VCID-5h45-rcpb-q7bz"},{"vulnerability":"VCID-7hcs-pkze-6ba4"},{"vulnerability":"VCID-7v6e-3dxw-aubu"},{"vulnerability":"VCID-7ya3-j9fa-zugj"},{"vulnerability":"VCID-8z6g-5td3-g7ej"},{"vulnerability":"VCID-9hza-srk7-sucy"},{"vulnerability":"VCID-d4dx-wbrv-gqaa"},{"vulnerability":"VCID-dkcx-xcb8-3fgj"},{"vulnerability":"VCID-fq9j-ntxd-t3b3"},{"vulnerability":"VCID-g48w-36yx-tue3"},{"vulnerability":"VCID-gve2-x5zh-gqha"},{"vulnerability":"VCID-htee-x1mv-sfhh"},{"vulnerability":"VCID-kjxw-f4f4-dydb"},{"vulnerability":"VCID-prvn-bejg-kufb"},{"vulnerability":"VCID-q8fz-36n2-vfh2"},{"vulnerability":"VCID-qbfa-rky7-juh5"},{"vulnerability":"VCID-qz6s-pjqj-7uet"},{"vulnerability":"VCID-tcda-8txy-7ygn"},{"vulnerability":"VCID-vx7b-mwfx-5fg2"},{"vulnerability":"VCID-wfzw-3x26-tucg"},{"vulnerability":"VCID-wuv4-qn69-zygh"},{"vulnerability":"VCID-x3bz-ehvb-jyfs"},{"vulnerability":"VCID-yk5x-nt2m-5kgy"},{"vulnerability":"VCID-zsxq-dasb-qyex"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:pypi/pillow@7.1.0"}],"aliases":["CVE-2020-10177","GHSA-cqhg-xjhh-p8hf","PYSEC-2020-76"],"risk_score":null,"exploitability":null,"weighted_severity":null,"resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-9v9s-wbu3-cqc7"},{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/35473?format=json","vulnerability_id":"VCID-cb58-eehb-j7cv","summary":"libImaging/SgiRleDecode.c in Pillow before 6.2.2 has an SGI buffer overflow.","references":[{"reference_url":"https://access.redhat.com/errata/RHSA-2020:0566","reference_id":"","reference_type":"","scores":[],"url":"https://access.redhat.com/errata/RHSA-2020:0566"},{"reference_url":"https://access.redhat.com/errata/RHSA-2020:0580","reference_id":"","reference_type":"","scores":[],"url":"https://access.redhat.com/errata/RHSA-2020:0580"},{"reference_url":"https://github.com/advisories/GHSA-r7rm-8j6h-r933","reference_id":"","reference_type":"","scores":[],"url":"https://github.com/advisories/GHSA-r7rm-8j6h-r933"},{"reference_url":"https://github.com/python-pillow/Pillow/commit/a79b65c47c7dc6fe623aadf09aa6192fc54548f3","reference_id":"","reference_type":"","scores":[],"url":"https://github.com/python-pillow/Pillow/commit/a79b65c47c7dc6fe623aadf09aa6192fc54548f3"},{"reference_url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/2MMU3WT2X64GS5WHDPKKC2WZA7UIIQ3A/","reference_id":"","reference_type":"","scores":[],"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/2MMU3WT2X64GS5WHDPKKC2WZA7UIIQ3A/"},{"reference_url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/3DUMIBUYGJRAVJCTFUWBRLVQKOUTVX5P/","reference_id":"","reference_type":"","scores":[],"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/3DUMIBUYGJRAVJCTFUWBRLVQKOUTVX5P/"},{"reference_url":"https://pillow.readthedocs.io/en/stable/releasenotes/6.2.2.html","reference_id":"","reference_type":"","scores":[],"url":"https://pillow.readthedocs.io/en/stable/releasenotes/6.2.2.html"},{"reference_url":"https://usn.ubuntu.com/4272-1/","reference_id":"","reference_type":"","scores":[],"url":"https://usn.ubuntu.com/4272-1/"},{"reference_url":"https://www.debian.org/security/2020/dsa-4631","reference_id":"","reference_type":"","scores":[],"url":"https://www.debian.org/security/2020/dsa-4631"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/14798?format=json","purl":"pkg:pypi/pillow@6.2.2","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-2gpf-94cu-6fcd"},{"vulnerability":"VCID-3gam-zy4w-2ucr"},{"vulnerability":"VCID-4tub-w66m-uyfu"},{"vulnerability":"VCID-5h45-rcpb-q7bz"},{"vulnerability":"VCID-7hcs-pkze-6ba4"},{"vulnerability":"VCID-7v6e-3dxw-aubu"},{"vulnerability":"VCID-7ya3-j9fa-zugj"},{"vulnerability":"VCID-8z6g-5td3-g7ej"},{"vulnerability":"VCID-9hza-srk7-sucy"},{"vulnerability":"VCID-9v9s-wbu3-cqc7"},{"vulnerability":"VCID-d4dx-wbrv-gqaa"},{"vulnerability":"VCID-dkcx-xcb8-3fgj"},{"vulnerability":"VCID-fq9j-ntxd-t3b3"},{"vulnerability":"VCID-g48w-36yx-tue3"},{"vulnerability":"VCID-gve2-x5zh-gqha"},{"vulnerability":"VCID-htee-x1mv-sfhh"},{"vulnerability":"VCID-jtq6-eykc-ykbz"},{"vulnerability":"VCID-kjxw-f4f4-dydb"},{"vulnerability":"VCID-prvn-bejg-kufb"},{"vulnerability":"VCID-q8fz-36n2-vfh2"},{"vulnerability":"VCID-qbfa-rky7-juh5"},{"vulnerability":"VCID-qz6s-pjqj-7uet"},{"vulnerability":"VCID-t3rz-wf43-a3bf"},{"vulnerability":"VCID-tcda-8txy-7ygn"},{"vulnerability":"VCID-vx7b-mwfx-5fg2"},{"vulnerability":"VCID-wfzw-3x26-tucg"},{"vulnerability":"VCID-whh3-qs36-pqfq"},{"vulnerability":"VCID-wuv4-qn69-zygh"},{"vulnerability":"VCID-x3bz-ehvb-jyfs"},{"vulnerability":"VCID-xbur-n6na-d7g1"},{"vulnerability":"VCID-yk5x-nt2m-5kgy"},{"vulnerability":"VCID-zsxq-dasb-qyex"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:pypi/pillow@6.2.2"}],"aliases":["CVE-2020-5311","GHSA-r7rm-8j6h-r933","PYSEC-2020-82"],"risk_score":null,"exploitability":null,"weighted_severity":null,"resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-cb58-eehb-j7cv"},{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/35952?format=json","vulnerability_id":"VCID-d4dx-wbrv-gqaa","summary":"path_getbbox in path.c in Pillow before 9.0.0 improperly initializes ImagePath.Path.","references":[{"reference_url":"https://github.com/advisories/GHSA-pw3c-h7wp-cvhx","reference_id":"","reference_type":"","scores":[],"url":"https://github.com/advisories/GHSA-pw3c-h7wp-cvhx"},{"reference_url":"https://github.com/pypa/advisory-database/tree/main/vulns/pillow/PYSEC-2022-8.yaml","reference_id":"","reference_type":"","scores":[],"url":"https://github.com/pypa/advisory-database/tree/main/vulns/pillow/PYSEC-2022-8.yaml"},{"reference_url":"https://github.com/python-pillow/Pillow","reference_id":"","reference_type":"","scores":[],"url":"https://github.com/python-pillow/Pillow"},{"reference_url":"https://github.com/python-pillow/Pillow/blob/c5d9223a8b5e9295d15b5a9b1ef1dae44c8499f3/src/path.c#L331","reference_id":"","reference_type":"","scores":[],"url":"https://github.com/python-pillow/Pillow/blob/c5d9223a8b5e9295d15b5a9b1ef1dae44c8499f3/src/path.c#L331"},{"reference_url":"https://github.com/python-pillow/Pillow/blob/e8ab5640774716c5486d3cb05167f74f742ad6ef/CHANGES.rst?plain=1#L1187","reference_id":"","reference_type":"","scores":[],"url":"https://github.com/python-pillow/Pillow/blob/e8ab5640774716c5486d3cb05167f74f742ad6ef/CHANGES.rst?plain=1#L1187"},{"reference_url":"https://github.com/python-pillow/Pillow/commit/1e092419b6806495c683043ab3feb6ce264f3b9c","reference_id":"","reference_type":"","scores":[],"url":"https://github.com/python-pillow/Pillow/commit/1e092419b6806495c683043ab3feb6ce264f3b9c"},{"reference_url":"https://github.com/python-pillow/Pillow/commit/c48271ab354db49cdbd740bc45e13be4f0f7993c","reference_id":"","reference_type":"","scores":[],"url":"https://github.com/python-pillow/Pillow/commit/c48271ab354db49cdbd740bc45e13be4f0f7993c"},{"reference_url":"https://github.com/python-pillow/Pillow/pull/5920","reference_id":"","reference_type":"","scores":[],"url":"https://github.com/python-pillow/Pillow/pull/5920"},{"reference_url":"https://lists.debian.org/debian-lts-announce/2022/01/msg00018.html","reference_id":"","reference_type":"","scores":[],"url":"https://lists.debian.org/debian-lts-announce/2022/01/msg00018.html"},{"reference_url":"https://pillow.readthedocs.io/en/stable/releasenotes/9.0.0.html#fixed-imagepath-path-array-handling","reference_id":"","reference_type":"","scores":[],"url":"https://pillow.readthedocs.io/en/stable/releasenotes/9.0.0.html#fixed-imagepath-path-array-handling"},{"reference_url":"https://www.debian.org/security/2022/dsa-5053","reference_id":"","reference_type":"","scores":[],"url":"https://www.debian.org/security/2022/dsa-5053"},{"reference_url":"https://nvd.nist.gov/vuln/detail/CVE-2022-22815","reference_id":"CVE-2022-22815","reference_type":"","scores":[],"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-22815"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/26297?format=json","purl":"pkg:pypi/pillow@9.0.0","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-4tub-w66m-uyfu"},{"vulnerability":"VCID-9hza-srk7-sucy"},{"vulnerability":"VCID-q8fz-36n2-vfh2"},{"vulnerability":"VCID-vx7b-mwfx-5fg2"},{"vulnerability":"VCID-x3bz-ehvb-jyfs"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:pypi/pillow@9.0.0"}],"aliases":["CVE-2022-22815","GHSA-pw3c-h7wp-cvhx","PYSEC-2022-8"],"risk_score":null,"exploitability":null,"weighted_severity":null,"resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-d4dx-wbrv-gqaa"},{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/35858?format=json","vulnerability_id":"VCID-dkcx-xcb8-3fgj","summary":"The package pillow from 0 and before 8.3.2 are vulnerable to Regular Expression Denial of Service (ReDoS) via the getrgb function.","references":[{"reference_url":"https://github.com/advisories/GHSA-98vv-pw6r-q6q4","reference_id":"","reference_type":"","scores":[],"url":"https://github.com/advisories/GHSA-98vv-pw6r-q6q4"},{"reference_url":"https://github.com/pypa/advisory-database/tree/main/vulns/pillow/PYSEC-2021-317.yaml","reference_id":"","reference_type":"","scores":[],"url":"https://github.com/pypa/advisory-database/tree/main/vulns/pillow/PYSEC-2021-317.yaml"},{"reference_url":"https://github.com/python-pillow/Pillow","reference_id":"","reference_type":"","scores":[],"url":"https://github.com/python-pillow/Pillow"},{"reference_url":"https://github.com/python-pillow/Pillow/commit/9e08eb8f78fdfd2f476e1b20b7cf38683754866b","reference_id":"","reference_type":"","scores":[],"url":"https://github.com/python-pillow/Pillow/commit/9e08eb8f78fdfd2f476e1b20b7cf38683754866b"},{"reference_url":"https://lists.debian.org/debian-lts-announce/2024/03/msg00021.html","reference_id":"","reference_type":"","scores":[],"url":"https://lists.debian.org/debian-lts-announce/2024/03/msg00021.html"},{"reference_url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/RNSG6VFXTAROGF7ACYLMAZNQV4EJ6I2C","reference_id":"","reference_type":"","scores":[],"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/RNSG6VFXTAROGF7ACYLMAZNQV4EJ6I2C"},{"reference_url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VKRCL7KKAKOXCVD7M6WC5OKFGL4L3SJT","reference_id":"","reference_type":"","scores":[],"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VKRCL7KKAKOXCVD7M6WC5OKFGL4L3SJT"},{"reference_url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/RNSG6VFXTAROGF7ACYLMAZNQV4EJ6I2C","reference_id":"","reference_type":"","scores":[],"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/RNSG6VFXTAROGF7ACYLMAZNQV4EJ6I2C"},{"reference_url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/VKRCL7KKAKOXCVD7M6WC5OKFGL4L3SJT","reference_id":"","reference_type":"","scores":[],"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/VKRCL7KKAKOXCVD7M6WC5OKFGL4L3SJT"},{"reference_url":"https://pillow.readthedocs.io/en/stable/releasenotes/8.3.2.html","reference_id":"","reference_type":"","scores":[],"url":"https://pillow.readthedocs.io/en/stable/releasenotes/8.3.2.html"},{"reference_url":"https://security.gentoo.org/glsa/202211-10","reference_id":"","reference_type":"","scores":[],"url":"https://security.gentoo.org/glsa/202211-10"},{"reference_url":"https://snyk.io/vuln/SNYK-PYTHON-PILLOW-1319443","reference_id":"","reference_type":"","scores":[],"url":"https://snyk.io/vuln/SNYK-PYTHON-PILLOW-1319443"},{"reference_url":"https://nvd.nist.gov/vuln/detail/CVE-2021-23437","reference_id":"CVE-2021-23437","reference_type":"","scores":[],"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-23437"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/23504?format=json","purl":"pkg:pypi/pillow@8.3.2","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-2gpf-94cu-6fcd"},{"vulnerability":"VCID-4tub-w66m-uyfu"},{"vulnerability":"VCID-9hza-srk7-sucy"},{"vulnerability":"VCID-d4dx-wbrv-gqaa"},{"vulnerability":"VCID-q8fz-36n2-vfh2"},{"vulnerability":"VCID-vx7b-mwfx-5fg2"},{"vulnerability":"VCID-wfzw-3x26-tucg"},{"vulnerability":"VCID-x3bz-ehvb-jyfs"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:pypi/pillow@8.3.2"}],"aliases":["CVE-2021-23437","GHSA-98vv-pw6r-q6q4","PYSEC-2021-317","SNYK-PYTHON-PILLOW-1319443"],"risk_score":null,"exploitability":null,"weighted_severity":null,"resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-dkcx-xcb8-3fgj"},{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/35816?format=json","vulnerability_id":"VCID-fq9j-ntxd-t3b3","summary":"An issue was discovered in Pillow before 8.2.0. There is an out-of-bounds read in J2kDecode, in j2ku_graya_la.","references":[{"reference_url":"https://github.com/advisories/GHSA-77gc-v2xv-rvvh","reference_id":"","reference_type":"","scores":[],"url":"https://github.com/advisories/GHSA-77gc-v2xv-rvvh"},{"reference_url":"https://github.com/python-pillow/Pillow/pull/5377#issuecomment-833821470","reference_id":"","reference_type":"","scores":[],"url":"https://github.com/python-pillow/Pillow/pull/5377#issuecomment-833821470"},{"reference_url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/MQHA5HAIBOYI3R6HDWCLAGFTIQP767FL/","reference_id":"","reference_type":"","scores":[],"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/MQHA5HAIBOYI3R6HDWCLAGFTIQP767FL/"},{"reference_url":"https://pillow.readthedocs.io/en/stable/releasenotes/8.2.0.html#cve-2021-25287-cve-2021-25288-fix-oob-read-in-jpeg2kdecode","reference_id":"","reference_type":"","scores":[],"url":"https://pillow.readthedocs.io/en/stable/releasenotes/8.2.0.html#cve-2021-25287-cve-2021-25288-fix-oob-read-in-jpeg2kdecode"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/22141?format=json","purl":"pkg:pypi/pillow@8.2.0","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-2gpf-94cu-6fcd"},{"vulnerability":"VCID-4tub-w66m-uyfu"},{"vulnerability":"VCID-7ya3-j9fa-zugj"},{"vulnerability":"VCID-9hza-srk7-sucy"},{"vulnerability":"VCID-d4dx-wbrv-gqaa"},{"vulnerability":"VCID-dkcx-xcb8-3fgj"},{"vulnerability":"VCID-q8fz-36n2-vfh2"},{"vulnerability":"VCID-vx7b-mwfx-5fg2"},{"vulnerability":"VCID-wfzw-3x26-tucg"},{"vulnerability":"VCID-x3bz-ehvb-jyfs"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:pypi/pillow@8.2.0"}],"aliases":["CVE-2021-25287","GHSA-77gc-v2xv-rvvh","PYSEC-2021-137"],"risk_score":null,"exploitability":null,"weighted_severity":null,"resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-fq9j-ntxd-t3b3"},{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/35741?format=json","vulnerability_id":"VCID-g48w-36yx-tue3","summary":"Pillow before 8.1.1 allows attackers to cause a denial of service (memory consumption) because the reported size of a contained image is not properly checked for a BLP container, and thus an attempted memory allocation can be very large.","references":[{"reference_url":"https://github.com/advisories/GHSA-f4w8-cv6p-x6r5","reference_id":"","reference_type":"","scores":[],"url":"https://github.com/advisories/GHSA-f4w8-cv6p-x6r5"},{"reference_url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/S7G44Z33J4BNI2DPDROHWGVG2U7ZH5JU/","reference_id":"","reference_type":"","scores":[],"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/S7G44Z33J4BNI2DPDROHWGVG2U7ZH5JU/"},{"reference_url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/TQQY6472RX4J2SUJENWDZAWKTJJGP2ML/","reference_id":"","reference_type":"","scores":[],"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/TQQY6472RX4J2SUJENWDZAWKTJJGP2ML/"},{"reference_url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZTSY25UJU7NJUFHH3HWT575LT4TDFWBZ/","reference_id":"","reference_type":"","scores":[],"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZTSY25UJU7NJUFHH3HWT575LT4TDFWBZ/"},{"reference_url":"https://pillow.readthedocs.io/en/stable/releasenotes/8.1.1.html","reference_id":"","reference_type":"","scores":[],"url":"https://pillow.readthedocs.io/en/stable/releasenotes/8.1.1.html"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/20203?format=json","purl":"pkg:pypi/pillow@8.1.1","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-2gpf-94cu-6fcd"},{"vulnerability":"VCID-4tub-w66m-uyfu"},{"vulnerability":"VCID-7ya3-j9fa-zugj"},{"vulnerability":"VCID-9hza-srk7-sucy"},{"vulnerability":"VCID-d4dx-wbrv-gqaa"},{"vulnerability":"VCID-dkcx-xcb8-3fgj"},{"vulnerability":"VCID-fq9j-ntxd-t3b3"},{"vulnerability":"VCID-gve2-x5zh-gqha"},{"vulnerability":"VCID-htee-x1mv-sfhh"},{"vulnerability":"VCID-prvn-bejg-kufb"},{"vulnerability":"VCID-q8fz-36n2-vfh2"},{"vulnerability":"VCID-qbfa-rky7-juh5"},{"vulnerability":"VCID-tcda-8txy-7ygn"},{"vulnerability":"VCID-vx7b-mwfx-5fg2"},{"vulnerability":"VCID-wfzw-3x26-tucg"},{"vulnerability":"VCID-x3bz-ehvb-jyfs"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:pypi/pillow@8.1.1"}],"aliases":["CVE-2021-27921","GHSA-f4w8-cv6p-x6r5","PYSEC-2021-40"],"risk_score":null,"exploitability":null,"weighted_severity":null,"resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-g48w-36yx-tue3"},{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/35813?format=json","vulnerability_id":"VCID-gve2-x5zh-gqha","summary":"An issue was discovered in Pillow before 8.2.0. PSDImagePlugin.PsdImageFile lacked a sanity check on the number of input layers relative to the size of the data block. This could lead to a DoS on Image.open prior to Image.load.","references":[{"reference_url":"https://github.com/advisories/GHSA-g6rj-rv7j-xwp4","reference_id":"","reference_type":"","scores":[],"url":"https://github.com/advisories/GHSA-g6rj-rv7j-xwp4"},{"reference_url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/MQHA5HAIBOYI3R6HDWCLAGFTIQP767FL/","reference_id":"","reference_type":"","scores":[],"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/MQHA5HAIBOYI3R6HDWCLAGFTIQP767FL/"},{"reference_url":"https://pillow.readthedocs.io/en/stable/releasenotes/8.2.0.html#cve-2021-28675-fix-dos-in-psdimageplugin","reference_id":"","reference_type":"","scores":[],"url":"https://pillow.readthedocs.io/en/stable/releasenotes/8.2.0.html#cve-2021-28675-fix-dos-in-psdimageplugin"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/22141?format=json","purl":"pkg:pypi/pillow@8.2.0","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-2gpf-94cu-6fcd"},{"vulnerability":"VCID-4tub-w66m-uyfu"},{"vulnerability":"VCID-7ya3-j9fa-zugj"},{"vulnerability":"VCID-9hza-srk7-sucy"},{"vulnerability":"VCID-d4dx-wbrv-gqaa"},{"vulnerability":"VCID-dkcx-xcb8-3fgj"},{"vulnerability":"VCID-q8fz-36n2-vfh2"},{"vulnerability":"VCID-vx7b-mwfx-5fg2"},{"vulnerability":"VCID-wfzw-3x26-tucg"},{"vulnerability":"VCID-x3bz-ehvb-jyfs"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:pypi/pillow@8.2.0"}],"aliases":["CVE-2021-28675","GHSA-g6rj-rv7j-xwp4","PYSEC-2021-139"],"risk_score":null,"exploitability":null,"weighted_severity":null,"resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-gve2-x5zh-gqha"},{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/35817?format=json","vulnerability_id":"VCID-htee-x1mv-sfhh","summary":"An issue was discovered in Pillow before 8.2.0. For EPS data, the readline implementation used in EPSImageFile has to deal with any combination of \\r and \\n as line endings. It used an accidentally quadratic method of accumulating lines while looking for a line ending. A malicious EPS file could use this to perform a DoS of Pillow in the open phase, before an image was accepted for opening.","references":[{"reference_url":"https://github.com/advisories/GHSA-q5hq-fp76-qmrc","reference_id":"","reference_type":"","scores":[],"url":"https://github.com/advisories/GHSA-q5hq-fp76-qmrc"},{"reference_url":"https://github.com/python-pillow/Pillow/pull/5377","reference_id":"","reference_type":"","scores":[],"url":"https://github.com/python-pillow/Pillow/pull/5377"},{"reference_url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/MQHA5HAIBOYI3R6HDWCLAGFTIQP767FL/","reference_id":"","reference_type":"","scores":[],"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/MQHA5HAIBOYI3R6HDWCLAGFTIQP767FL/"},{"reference_url":"https://pillow.readthedocs.io/en/stable/releasenotes/8.2.0.html#cve-2021-28677-fix-eps-dos-on-open","reference_id":"","reference_type":"","scores":[],"url":"https://pillow.readthedocs.io/en/stable/releasenotes/8.2.0.html#cve-2021-28677-fix-eps-dos-on-open"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/22141?format=json","purl":"pkg:pypi/pillow@8.2.0","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-2gpf-94cu-6fcd"},{"vulnerability":"VCID-4tub-w66m-uyfu"},{"vulnerability":"VCID-7ya3-j9fa-zugj"},{"vulnerability":"VCID-9hza-srk7-sucy"},{"vulnerability":"VCID-d4dx-wbrv-gqaa"},{"vulnerability":"VCID-dkcx-xcb8-3fgj"},{"vulnerability":"VCID-q8fz-36n2-vfh2"},{"vulnerability":"VCID-vx7b-mwfx-5fg2"},{"vulnerability":"VCID-wfzw-3x26-tucg"},{"vulnerability":"VCID-x3bz-ehvb-jyfs"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:pypi/pillow@8.2.0"}],"aliases":["CVE-2021-28677","GHSA-q5hq-fp76-qmrc","PYSEC-2021-93"],"risk_score":null,"exploitability":null,"weighted_severity":null,"resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-htee-x1mv-sfhh"},{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/35580?format=json","vulnerability_id":"VCID-jtq6-eykc-ykbz","summary":"In Pillow before 7.1.0, there are two Buffer Overflows in libImaging/TiffDecode.c.","references":[{"reference_url":"https://github.com/advisories/GHSA-8843-m7mw-mxqm","reference_id":"","reference_type":"","scores":[],"url":"https://github.com/advisories/GHSA-8843-m7mw-mxqm"},{"reference_url":"https://github.com/python-pillow/Pillow/commit/46f4a349b88915787fea3fb91348bb1665831bbb#diff-9478f2787e3ae9668a15123b165c23ac","reference_id":"","reference_type":"","scores":[],"url":"https://github.com/python-pillow/Pillow/commit/46f4a349b88915787fea3fb91348bb1665831bbb#diff-9478f2787e3ae9668a15123b165c23ac"},{"reference_url":"https://github.com/python-pillow/Pillow/commits/master/src/libImaging","reference_id":"","reference_type":"","scores":[],"url":"https://github.com/python-pillow/Pillow/commits/master/src/libImaging"},{"reference_url":"https://github.com/python-pillow/Pillow/pull/4538","reference_id":"","reference_type":"","scores":[],"url":"https://github.com/python-pillow/Pillow/pull/4538"},{"reference_url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/BEBCPE4F2VHTIT6EZA2YZQZLPVDEBJGD/","reference_id":"","reference_type":"","scores":[],"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/BEBCPE4F2VHTIT6EZA2YZQZLPVDEBJGD/"},{"reference_url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/HOKHNWV2VS5GESY7IBD237E7C6T3I427/","reference_id":"","reference_type":"","scores":[],"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/HOKHNWV2VS5GESY7IBD237E7C6T3I427/"},{"reference_url":"https://pillow.readthedocs.io/en/stable/releasenotes/7.1.0.html","reference_id":"","reference_type":"","scores":[],"url":"https://pillow.readthedocs.io/en/stable/releasenotes/7.1.0.html"},{"reference_url":"https://usn.ubuntu.com/4430-2/","reference_id":"","reference_type":"","scores":[],"url":"https://usn.ubuntu.com/4430-2/"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/17728?format=json","purl":"pkg:pypi/pillow@7.1.0","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-2gpf-94cu-6fcd"},{"vulnerability":"VCID-3gam-zy4w-2ucr"},{"vulnerability":"VCID-4tub-w66m-uyfu"},{"vulnerability":"VCID-5h45-rcpb-q7bz"},{"vulnerability":"VCID-7hcs-pkze-6ba4"},{"vulnerability":"VCID-7v6e-3dxw-aubu"},{"vulnerability":"VCID-7ya3-j9fa-zugj"},{"vulnerability":"VCID-8z6g-5td3-g7ej"},{"vulnerability":"VCID-9hza-srk7-sucy"},{"vulnerability":"VCID-d4dx-wbrv-gqaa"},{"vulnerability":"VCID-dkcx-xcb8-3fgj"},{"vulnerability":"VCID-fq9j-ntxd-t3b3"},{"vulnerability":"VCID-g48w-36yx-tue3"},{"vulnerability":"VCID-gve2-x5zh-gqha"},{"vulnerability":"VCID-htee-x1mv-sfhh"},{"vulnerability":"VCID-kjxw-f4f4-dydb"},{"vulnerability":"VCID-prvn-bejg-kufb"},{"vulnerability":"VCID-q8fz-36n2-vfh2"},{"vulnerability":"VCID-qbfa-rky7-juh5"},{"vulnerability":"VCID-qz6s-pjqj-7uet"},{"vulnerability":"VCID-tcda-8txy-7ygn"},{"vulnerability":"VCID-vx7b-mwfx-5fg2"},{"vulnerability":"VCID-wfzw-3x26-tucg"},{"vulnerability":"VCID-wuv4-qn69-zygh"},{"vulnerability":"VCID-x3bz-ehvb-jyfs"},{"vulnerability":"VCID-yk5x-nt2m-5kgy"},{"vulnerability":"VCID-zsxq-dasb-qyex"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:pypi/pillow@7.1.0"}],"aliases":["CVE-2020-10379","GHSA-8843-m7mw-mxqm","PYSEC-2020-78"],"risk_score":null,"exploitability":null,"weighted_severity":null,"resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-jtq6-eykc-ykbz"},{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/35709?format=json","vulnerability_id":"VCID-kjxw-f4f4-dydb","summary":"In Pillow before 8.1.0, TiffDecode has a heap-based buffer overflow when decoding crafted YCbCr files because of certain interpretation conflicts with LibTIFF in RGBA mode.","references":[{"reference_url":"https://github.com/advisories/GHSA-vqcj-wrf2-7v73","reference_id":"","reference_type":"","scores":[],"url":"https://github.com/advisories/GHSA-vqcj-wrf2-7v73"},{"reference_url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6BYVI5G44MRIPERKYDQEL3S3YQCZTVHE/","reference_id":"","reference_type":"","scores":[],"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6BYVI5G44MRIPERKYDQEL3S3YQCZTVHE/"},{"reference_url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/BF553AMNNNBW7SH4IM4MNE4M6GNZQ7YD/","reference_id":"","reference_type":"","scores":[],"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/BF553AMNNNBW7SH4IM4MNE4M6GNZQ7YD/"},{"reference_url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/TQQY6472RX4J2SUJENWDZAWKTJJGP2ML/","reference_id":"","reference_type":"","scores":[],"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/TQQY6472RX4J2SUJENWDZAWKTJJGP2ML/"},{"reference_url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZTSY25UJU7NJUFHH3HWT575LT4TDFWBZ/","reference_id":"","reference_type":"","scores":[],"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZTSY25UJU7NJUFHH3HWT575LT4TDFWBZ/"},{"reference_url":"https://pillow.readthedocs.io/en/stable/releasenotes/index.html","reference_id":"","reference_type":"","scores":[],"url":"https://pillow.readthedocs.io/en/stable/releasenotes/index.html"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/19728?format=json","purl":"pkg:pypi/pillow@8.1.0","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-2gpf-94cu-6fcd"},{"vulnerability":"VCID-3gam-zy4w-2ucr"},{"vulnerability":"VCID-4tub-w66m-uyfu"},{"vulnerability":"VCID-5h45-rcpb-q7bz"},{"vulnerability":"VCID-7ya3-j9fa-zugj"},{"vulnerability":"VCID-8z6g-5td3-g7ej"},{"vulnerability":"VCID-9hza-srk7-sucy"},{"vulnerability":"VCID-d4dx-wbrv-gqaa"},{"vulnerability":"VCID-dkcx-xcb8-3fgj"},{"vulnerability":"VCID-fq9j-ntxd-t3b3"},{"vulnerability":"VCID-g48w-36yx-tue3"},{"vulnerability":"VCID-gve2-x5zh-gqha"},{"vulnerability":"VCID-htee-x1mv-sfhh"},{"vulnerability":"VCID-prvn-bejg-kufb"},{"vulnerability":"VCID-q8fz-36n2-vfh2"},{"vulnerability":"VCID-qbfa-rky7-juh5"},{"vulnerability":"VCID-qz6s-pjqj-7uet"},{"vulnerability":"VCID-tcda-8txy-7ygn"},{"vulnerability":"VCID-vx7b-mwfx-5fg2"},{"vulnerability":"VCID-wfzw-3x26-tucg"},{"vulnerability":"VCID-wuv4-qn69-zygh"},{"vulnerability":"VCID-x3bz-ehvb-jyfs"},{"vulnerability":"VCID-yk5x-nt2m-5kgy"},{"vulnerability":"VCID-zsxq-dasb-qyex"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:pypi/pillow@8.1.0"}],"aliases":["CVE-2020-35654","GHSA-vqcj-wrf2-7v73","PYSEC-2021-70"],"risk_score":null,"exploitability":null,"weighted_severity":null,"resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-kjxw-f4f4-dydb"},{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/35476?format=json","vulnerability_id":"VCID-mph7-qmm8-1fan","summary":"libImaging/FliDecode.c in Pillow before 6.2.2 has an FLI buffer overflow.","references":[{"reference_url":"https://github.com/advisories/GHSA-hj69-c76v-86wr","reference_id":"","reference_type":"","scores":[],"url":"https://github.com/advisories/GHSA-hj69-c76v-86wr"},{"reference_url":"https://github.com/python-pillow/Pillow/commit/a09acd0decd8a87ccce939d5ff65dab59e7d365b","reference_id":"","reference_type":"","scores":[],"url":"https://github.com/python-pillow/Pillow/commit/a09acd0decd8a87ccce939d5ff65dab59e7d365b"},{"reference_url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/2MMU3WT2X64GS5WHDPKKC2WZA7UIIQ3A/","reference_id":"","reference_type":"","scores":[],"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/2MMU3WT2X64GS5WHDPKKC2WZA7UIIQ3A/"},{"reference_url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/3DUMIBUYGJRAVJCTFUWBRLVQKOUTVX5P/","reference_id":"","reference_type":"","scores":[],"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/3DUMIBUYGJRAVJCTFUWBRLVQKOUTVX5P/"},{"reference_url":"https://pillow.readthedocs.io/en/stable/releasenotes/6.2.2.html","reference_id":"","reference_type":"","scores":[],"url":"https://pillow.readthedocs.io/en/stable/releasenotes/6.2.2.html"},{"reference_url":"https://usn.ubuntu.com/4272-1/","reference_id":"","reference_type":"","scores":[],"url":"https://usn.ubuntu.com/4272-1/"},{"reference_url":"https://www.debian.org/security/2020/dsa-4631","reference_id":"","reference_type":"","scores":[],"url":"https://www.debian.org/security/2020/dsa-4631"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/14798?format=json","purl":"pkg:pypi/pillow@6.2.2","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-2gpf-94cu-6fcd"},{"vulnerability":"VCID-3gam-zy4w-2ucr"},{"vulnerability":"VCID-4tub-w66m-uyfu"},{"vulnerability":"VCID-5h45-rcpb-q7bz"},{"vulnerability":"VCID-7hcs-pkze-6ba4"},{"vulnerability":"VCID-7v6e-3dxw-aubu"},{"vulnerability":"VCID-7ya3-j9fa-zugj"},{"vulnerability":"VCID-8z6g-5td3-g7ej"},{"vulnerability":"VCID-9hza-srk7-sucy"},{"vulnerability":"VCID-9v9s-wbu3-cqc7"},{"vulnerability":"VCID-d4dx-wbrv-gqaa"},{"vulnerability":"VCID-dkcx-xcb8-3fgj"},{"vulnerability":"VCID-fq9j-ntxd-t3b3"},{"vulnerability":"VCID-g48w-36yx-tue3"},{"vulnerability":"VCID-gve2-x5zh-gqha"},{"vulnerability":"VCID-htee-x1mv-sfhh"},{"vulnerability":"VCID-jtq6-eykc-ykbz"},{"vulnerability":"VCID-kjxw-f4f4-dydb"},{"vulnerability":"VCID-prvn-bejg-kufb"},{"vulnerability":"VCID-q8fz-36n2-vfh2"},{"vulnerability":"VCID-qbfa-rky7-juh5"},{"vulnerability":"VCID-qz6s-pjqj-7uet"},{"vulnerability":"VCID-t3rz-wf43-a3bf"},{"vulnerability":"VCID-tcda-8txy-7ygn"},{"vulnerability":"VCID-vx7b-mwfx-5fg2"},{"vulnerability":"VCID-wfzw-3x26-tucg"},{"vulnerability":"VCID-whh3-qs36-pqfq"},{"vulnerability":"VCID-wuv4-qn69-zygh"},{"vulnerability":"VCID-x3bz-ehvb-jyfs"},{"vulnerability":"VCID-xbur-n6na-d7g1"},{"vulnerability":"VCID-yk5x-nt2m-5kgy"},{"vulnerability":"VCID-zsxq-dasb-qyex"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:pypi/pillow@6.2.2"}],"aliases":["CVE-2020-5313","GHSA-hj69-c76v-86wr","PYSEC-2020-84"],"risk_score":null,"exploitability":null,"weighted_severity":null,"resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-mph7-qmm8-1fan"},{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/35475?format=json","vulnerability_id":"VCID-p66f-cwf8-tfdr","summary":"libImaging/PcxDecode.c in Pillow before 6.2.2 has a PCX P mode buffer overflow.","references":[{"reference_url":"https://access.redhat.com/errata/RHSA-2020:0566","reference_id":"","reference_type":"","scores":[],"url":"https://access.redhat.com/errata/RHSA-2020:0566"},{"reference_url":"https://access.redhat.com/errata/RHSA-2020:0578","reference_id":"","reference_type":"","scores":[],"url":"https://access.redhat.com/errata/RHSA-2020:0578"},{"reference_url":"https://access.redhat.com/errata/RHSA-2020:0580","reference_id":"","reference_type":"","scores":[],"url":"https://access.redhat.com/errata/RHSA-2020:0580"},{"reference_url":"https://access.redhat.com/errata/RHSA-2020:0681","reference_id":"","reference_type":"","scores":[],"url":"https://access.redhat.com/errata/RHSA-2020:0681"},{"reference_url":"https://access.redhat.com/errata/RHSA-2020:0683","reference_id":"","reference_type":"","scores":[],"url":"https://access.redhat.com/errata/RHSA-2020:0683"},{"reference_url":"https://access.redhat.com/errata/RHSA-2020:0694","reference_id":"","reference_type":"","scores":[],"url":"https://access.redhat.com/errata/RHSA-2020:0694"},{"reference_url":"https://github.com/advisories/GHSA-p49h-hjvm-jg3h","reference_id":"","reference_type":"","scores":[],"url":"https://github.com/advisories/GHSA-p49h-hjvm-jg3h"},{"reference_url":"https://github.com/pypa/advisory-database/tree/main/vulns/pillow/PYSEC-2020-83.yaml","reference_id":"","reference_type":"","scores":[],"url":"https://github.com/pypa/advisory-database/tree/main/vulns/pillow/PYSEC-2020-83.yaml"},{"reference_url":"https://github.com/pypa/advisory-db/blob/7872b0a91b4d980f749e6d75a81f8cc1af32829f/vulns/pillow/PYSEC-2020-83.yaml","reference_id":"","reference_type":"","scores":[],"url":"https://github.com/pypa/advisory-db/blob/7872b0a91b4d980f749e6d75a81f8cc1af32829f/vulns/pillow/PYSEC-2020-83.yaml"},{"reference_url":"https://github.com/python-pillow/Pillow","reference_id":"","reference_type":"","scores":[],"url":"https://github.com/python-pillow/Pillow"},{"reference_url":"https://github.com/python-pillow/Pillow/commit/93b22b846e0269ee9594ff71a72bec02d2bea8fd","reference_id":"","reference_type":"","scores":[],"url":"https://github.com/python-pillow/Pillow/commit/93b22b846e0269ee9594ff71a72bec02d2bea8fd"},{"reference_url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/2MMU3WT2X64GS5WHDPKKC2WZA7UIIQ3A","reference_id":"","reference_type":"","scores":[],"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/2MMU3WT2X64GS5WHDPKKC2WZA7UIIQ3A"},{"reference_url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/2MMU3WT2X64GS5WHDPKKC2WZA7UIIQ3A/","reference_id":"","reference_type":"","scores":[],"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/2MMU3WT2X64GS5WHDPKKC2WZA7UIIQ3A/"},{"reference_url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/3DUMIBUYGJRAVJCTFUWBRLVQKOUTVX5P","reference_id":"","reference_type":"","scores":[],"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/3DUMIBUYGJRAVJCTFUWBRLVQKOUTVX5P"},{"reference_url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/3DUMIBUYGJRAVJCTFUWBRLVQKOUTVX5P/","reference_id":"","reference_type":"","scores":[],"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/3DUMIBUYGJRAVJCTFUWBRLVQKOUTVX5P/"},{"reference_url":"https://pillow.readthedocs.io/en/stable/releasenotes/6.2.2.html","reference_id":"","reference_type":"","scores":[],"url":"https://pillow.readthedocs.io/en/stable/releasenotes/6.2.2.html"},{"reference_url":"https://usn.ubuntu.com/4272-1","reference_id":"","reference_type":"","scores":[],"url":"https://usn.ubuntu.com/4272-1"},{"reference_url":"https://usn.ubuntu.com/4272-1/","reference_id":"","reference_type":"","scores":[],"url":"https://usn.ubuntu.com/4272-1/"},{"reference_url":"https://www.debian.org/security/2020/dsa-4631","reference_id":"","reference_type":"","scores":[],"url":"https://www.debian.org/security/2020/dsa-4631"},{"reference_url":"https://nvd.nist.gov/vuln/detail/CVE-2020-5312","reference_id":"CVE-2020-5312","reference_type":"","scores":[],"url":"https://nvd.nist.gov/vuln/detail/CVE-2020-5312"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/14798?format=json","purl":"pkg:pypi/pillow@6.2.2","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-2gpf-94cu-6fcd"},{"vulnerability":"VCID-3gam-zy4w-2ucr"},{"vulnerability":"VCID-4tub-w66m-uyfu"},{"vulnerability":"VCID-5h45-rcpb-q7bz"},{"vulnerability":"VCID-7hcs-pkze-6ba4"},{"vulnerability":"VCID-7v6e-3dxw-aubu"},{"vulnerability":"VCID-7ya3-j9fa-zugj"},{"vulnerability":"VCID-8z6g-5td3-g7ej"},{"vulnerability":"VCID-9hza-srk7-sucy"},{"vulnerability":"VCID-9v9s-wbu3-cqc7"},{"vulnerability":"VCID-d4dx-wbrv-gqaa"},{"vulnerability":"VCID-dkcx-xcb8-3fgj"},{"vulnerability":"VCID-fq9j-ntxd-t3b3"},{"vulnerability":"VCID-g48w-36yx-tue3"},{"vulnerability":"VCID-gve2-x5zh-gqha"},{"vulnerability":"VCID-htee-x1mv-sfhh"},{"vulnerability":"VCID-jtq6-eykc-ykbz"},{"vulnerability":"VCID-kjxw-f4f4-dydb"},{"vulnerability":"VCID-prvn-bejg-kufb"},{"vulnerability":"VCID-q8fz-36n2-vfh2"},{"vulnerability":"VCID-qbfa-rky7-juh5"},{"vulnerability":"VCID-qz6s-pjqj-7uet"},{"vulnerability":"VCID-t3rz-wf43-a3bf"},{"vulnerability":"VCID-tcda-8txy-7ygn"},{"vulnerability":"VCID-vx7b-mwfx-5fg2"},{"vulnerability":"VCID-wfzw-3x26-tucg"},{"vulnerability":"VCID-whh3-qs36-pqfq"},{"vulnerability":"VCID-wuv4-qn69-zygh"},{"vulnerability":"VCID-x3bz-ehvb-jyfs"},{"vulnerability":"VCID-xbur-n6na-d7g1"},{"vulnerability":"VCID-yk5x-nt2m-5kgy"},{"vulnerability":"VCID-zsxq-dasb-qyex"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:pypi/pillow@6.2.2"}],"aliases":["CVE-2020-5312","GHSA-p49h-hjvm-jg3h","PYSEC-2020-83"],"risk_score":null,"exploitability":null,"weighted_severity":null,"resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-p66f-cwf8-tfdr"},{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/35815?format=json","vulnerability_id":"VCID-prvn-bejg-kufb","summary":"An issue was discovered in Pillow before 8.2.0. There is an out-of-bounds read in J2kDecode, in j2ku_gray_i.","references":[{"reference_url":"https://github.com/advisories/GHSA-rwv7-3v45-hg29","reference_id":"","reference_type":"","scores":[],"url":"https://github.com/advisories/GHSA-rwv7-3v45-hg29"},{"reference_url":"https://github.com/python-pillow/Pillow/pull/5377#issuecomment-833821470","reference_id":"","reference_type":"","scores":[],"url":"https://github.com/python-pillow/Pillow/pull/5377#issuecomment-833821470"},{"reference_url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/MQHA5HAIBOYI3R6HDWCLAGFTIQP767FL/","reference_id":"","reference_type":"","scores":[],"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/MQHA5HAIBOYI3R6HDWCLAGFTIQP767FL/"},{"reference_url":"https://pillow.readthedocs.io/en/stable/releasenotes/8.2.0.html#cve-2021-25287-cve-2021-25288-fix-oob-read-in-jpeg2kdecode","reference_id":"","reference_type":"","scores":[],"url":"https://pillow.readthedocs.io/en/stable/releasenotes/8.2.0.html#cve-2021-25287-cve-2021-25288-fix-oob-read-in-jpeg2kdecode"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/22141?format=json","purl":"pkg:pypi/pillow@8.2.0","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-2gpf-94cu-6fcd"},{"vulnerability":"VCID-4tub-w66m-uyfu"},{"vulnerability":"VCID-7ya3-j9fa-zugj"},{"vulnerability":"VCID-9hza-srk7-sucy"},{"vulnerability":"VCID-d4dx-wbrv-gqaa"},{"vulnerability":"VCID-dkcx-xcb8-3fgj"},{"vulnerability":"VCID-q8fz-36n2-vfh2"},{"vulnerability":"VCID-vx7b-mwfx-5fg2"},{"vulnerability":"VCID-wfzw-3x26-tucg"},{"vulnerability":"VCID-x3bz-ehvb-jyfs"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:pypi/pillow@8.2.0"}],"aliases":["CVE-2021-25288","GHSA-rwv7-3v45-hg29","PYSEC-2021-138"],"risk_score":null,"exploitability":null,"weighted_severity":null,"resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-prvn-bejg-kufb"},{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/35008?format=json","vulnerability_id":"VCID-px2q-ph74-1ue6","summary":"Pillow before 3.3.2 allows context-dependent attackers to execute arbitrary code by using the \"crafted image file\" approach, related to an \"Insecure Sign Extension\" issue affecting the ImagingNew in Storage.c component.","references":[{"reference_url":"http://pillow.readthedocs.io/en/3.4.x/releasenotes/3.3.2.html","reference_id":"","reference_type":"","scores":[],"url":"http://pillow.readthedocs.io/en/3.4.x/releasenotes/3.3.2.html"},{"reference_url":"https://github.com/advisories/GHSA-w4vg-rf63-f3j3","reference_id":"","reference_type":"","scores":[],"url":"https://github.com/advisories/GHSA-w4vg-rf63-f3j3"},{"reference_url":"https://github.com/pypa/advisory-database/tree/main/vulns/pillow/PYSEC-2016-9.yaml","reference_id":"","reference_type":"","scores":[],"url":"https://github.com/pypa/advisory-database/tree/main/vulns/pillow/PYSEC-2016-9.yaml"},{"reference_url":"https://github.com/python-pillow/Pillow","reference_id":"","reference_type":"","scores":[],"url":"https://github.com/python-pillow/Pillow"},{"reference_url":"https://github.com/python-pillow/Pillow/issues/2105","reference_id":"","reference_type":"","scores":[],"url":"https://github.com/python-pillow/Pillow/issues/2105"},{"reference_url":"https://github.com/python-pillow/Pillow/pull/2146/commits/5d8a0be45aad78c5a22c8d099118ee26ef8144af","reference_id":"","reference_type":"","scores":[],"url":"https://github.com/python-pillow/Pillow/pull/2146/commits/5d8a0be45aad78c5a22c8d099118ee26ef8144af"},{"reference_url":"https://security.gentoo.org/glsa/201612-52","reference_id":"","reference_type":"","scores":[],"url":"https://security.gentoo.org/glsa/201612-52"},{"reference_url":"http://www.debian.org/security/2016/dsa-3710","reference_id":"","reference_type":"","scores":[],"url":"http://www.debian.org/security/2016/dsa-3710"},{"reference_url":"http://www.securityfocus.com/bid/94234","reference_id":"","reference_type":"","scores":[],"url":"http://www.securityfocus.com/bid/94234"},{"reference_url":"https://nvd.nist.gov/vuln/detail/CVE-2016-9190","reference_id":"CVE-2016-9190","reference_type":"","scores":[],"url":"https://nvd.nist.gov/vuln/detail/CVE-2016-9190"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/9450?format=json","purl":"pkg:pypi/pillow@3.3.2","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-2gpf-94cu-6fcd"},{"vulnerability":"VCID-3gam-zy4w-2ucr"},{"vulnerability":"VCID-4tub-w66m-uyfu"},{"vulnerability":"VCID-5h45-rcpb-q7bz"},{"vulnerability":"VCID-7sps-ppua-ubb2"},{"vulnerability":"VCID-7v6e-3dxw-aubu"},{"vulnerability":"VCID-7ya3-j9fa-zugj"},{"vulnerability":"VCID-8z6g-5td3-g7ej"},{"vulnerability":"VCID-9hza-srk7-sucy"},{"vulnerability":"VCID-9qm6-cbz9-b7c8"},{"vulnerability":"VCID-9v9s-wbu3-cqc7"},{"vulnerability":"VCID-cb58-eehb-j7cv"},{"vulnerability":"VCID-d4dx-wbrv-gqaa"},{"vulnerability":"VCID-dkcx-xcb8-3fgj"},{"vulnerability":"VCID-fq9j-ntxd-t3b3"},{"vulnerability":"VCID-g48w-36yx-tue3"},{"vulnerability":"VCID-gve2-x5zh-gqha"},{"vulnerability":"VCID-htee-x1mv-sfhh"},{"vulnerability":"VCID-jtq6-eykc-ykbz"},{"vulnerability":"VCID-kjxw-f4f4-dydb"},{"vulnerability":"VCID-mph7-qmm8-1fan"},{"vulnerability":"VCID-p66f-cwf8-tfdr"},{"vulnerability":"VCID-prvn-bejg-kufb"},{"vulnerability":"VCID-q8fz-36n2-vfh2"},{"vulnerability":"VCID-qbfa-rky7-juh5"},{"vulnerability":"VCID-qz6s-pjqj-7uet"},{"vulnerability":"VCID-t3rz-wf43-a3bf"},{"vulnerability":"VCID-tcda-8txy-7ygn"},{"vulnerability":"VCID-vx7b-mwfx-5fg2"},{"vulnerability":"VCID-vxtq-wjad-3ue3"},{"vulnerability":"VCID-wfzw-3x26-tucg"},{"vulnerability":"VCID-whh3-qs36-pqfq"},{"vulnerability":"VCID-wuv4-qn69-zygh"},{"vulnerability":"VCID-x3bz-ehvb-jyfs"},{"vulnerability":"VCID-xbur-n6na-d7g1"},{"vulnerability":"VCID-yk5x-nt2m-5kgy"},{"vulnerability":"VCID-zsxq-dasb-qyex"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:pypi/pillow@3.3.2"}],"aliases":["CVE-2016-9190","GHSA-w4vg-rf63-f3j3","PYSEC-2016-9"],"risk_score":null,"exploitability":null,"weighted_severity":null,"resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-px2q-ph74-1ue6"},{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/36067?format=json","vulnerability_id":"VCID-q8fz-36n2-vfh2","summary":"Pillow before 9.0.1 allows attackers to delete files because spaces in temporary pathnames are mishandled.","references":[{"reference_url":"https://github.com/advisories/GHSA-9j59-75qj-795w","reference_id":"","reference_type":"","scores":[],"url":"https://github.com/advisories/GHSA-9j59-75qj-795w"},{"reference_url":"https://github.com/pypa/advisory-database/tree/main/vulns/pillow/PYSEC-2022-168.yaml","reference_id":"","reference_type":"","scores":[],"url":"https://github.com/pypa/advisory-database/tree/main/vulns/pillow/PYSEC-2022-168.yaml"},{"reference_url":"https://github.com/python-pillow/Pillow","reference_id":"","reference_type":"","scores":[],"url":"https://github.com/python-pillow/Pillow"},{"reference_url":"https://github.com/python-pillow/Pillow/blob/e8ab5640774716c5486d3cb05167f74f742ad6ef/CHANGES.rst?plain=1#L1172","reference_id":"","reference_type":"","scores":[],"url":"https://github.com/python-pillow/Pillow/blob/e8ab5640774716c5486d3cb05167f74f742ad6ef/CHANGES.rst?plain=1#L1172"},{"reference_url":"https://github.com/python-pillow/Pillow/commit/10c4f75aaa383bd9671e923e3b91d391ea12d781","reference_id":"","reference_type":"","scores":[],"url":"https://github.com/python-pillow/Pillow/commit/10c4f75aaa383bd9671e923e3b91d391ea12d781"},{"reference_url":"https://github.com/python-pillow/Pillow/commit/143032103c9f2d55a0a7960bd3e630cb72549e8a","reference_id":"","reference_type":"","scores":[],"url":"https://github.com/python-pillow/Pillow/commit/143032103c9f2d55a0a7960bd3e630cb72549e8a"},{"reference_url":"https://github.com/python-pillow/Pillow/commit/427221ef5f19157001bf8b1ad7cfe0b905ca8c26","reference_id":"","reference_type":"","scores":[],"url":"https://github.com/python-pillow/Pillow/commit/427221ef5f19157001bf8b1ad7cfe0b905ca8c26"},{"reference_url":"https://github.com/python-pillow/Pillow/pull/3450","reference_id":"","reference_type":"","scores":[],"url":"https://github.com/python-pillow/Pillow/pull/3450"},{"reference_url":"https://github.com/python-pillow/Pillow/pull/6010","reference_id":"","reference_type":"","scores":[],"url":"https://github.com/python-pillow/Pillow/pull/6010"},{"reference_url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/W4ZUXPKEX72O3E5IHBPVY5ZCPMJ4GHHV","reference_id":"","reference_type":"","scores":[],"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/W4ZUXPKEX72O3E5IHBPVY5ZCPMJ4GHHV"},{"reference_url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/XR6UP2XONXOVXI4446VY72R63YRO2YTP","reference_id":"","reference_type":"","scores":[],"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/XR6UP2XONXOVXI4446VY72R63YRO2YTP"},{"reference_url":"https://pillow.readthedocs.io/en/stable/releasenotes/9.0.1.html#security","reference_id":"","reference_type":"","scores":[],"url":"https://pillow.readthedocs.io/en/stable/releasenotes/9.0.1.html#security"},{"reference_url":"https://security.gentoo.org/glsa/202211-10","reference_id":"","reference_type":"","scores":[],"url":"https://security.gentoo.org/glsa/202211-10"},{"reference_url":"https://nvd.nist.gov/vuln/detail/CVE-2022-24303","reference_id":"CVE-2022-24303","reference_type":"","scores":[],"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-24303"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/27388?format=json","purl":"pkg:pypi/pillow@9.0.1","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-4tub-w66m-uyfu"},{"vulnerability":"VCID-9hza-srk7-sucy"},{"vulnerability":"VCID-vx7b-mwfx-5fg2"},{"vulnerability":"VCID-x3bz-ehvb-jyfs"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:pypi/pillow@9.0.1"}],"aliases":["CVE-2022-24303","GHSA-9j59-75qj-795w","GMS-2022-348","PYSEC-2022-168"],"risk_score":null,"exploitability":null,"weighted_severity":null,"resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-q8fz-36n2-vfh2"},{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/35814?format=json","vulnerability_id":"VCID-qbfa-rky7-juh5","summary":"An issue was discovered in Pillow before 8.2.0. For FLI data, FliDecode did not properly check that the block advance was non-zero, potentially leading to an infinite loop on load.","references":[{"reference_url":"https://github.com/advisories/GHSA-7r7m-5h27-29hp","reference_id":"","reference_type":"","scores":[],"url":"https://github.com/advisories/GHSA-7r7m-5h27-29hp"},{"reference_url":"https://github.com/python-pillow/Pillow/pull/5377","reference_id":"","reference_type":"","scores":[],"url":"https://github.com/python-pillow/Pillow/pull/5377"},{"reference_url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/MQHA5HAIBOYI3R6HDWCLAGFTIQP767FL/","reference_id":"","reference_type":"","scores":[],"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/MQHA5HAIBOYI3R6HDWCLAGFTIQP767FL/"},{"reference_url":"https://pillow.readthedocs.io/en/stable/releasenotes/8.2.0.html#cve-2021-28676-fix-fli-dos","reference_id":"","reference_type":"","scores":[],"url":"https://pillow.readthedocs.io/en/stable/releasenotes/8.2.0.html#cve-2021-28676-fix-fli-dos"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/22141?format=json","purl":"pkg:pypi/pillow@8.2.0","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-2gpf-94cu-6fcd"},{"vulnerability":"VCID-4tub-w66m-uyfu"},{"vulnerability":"VCID-7ya3-j9fa-zugj"},{"vulnerability":"VCID-9hza-srk7-sucy"},{"vulnerability":"VCID-d4dx-wbrv-gqaa"},{"vulnerability":"VCID-dkcx-xcb8-3fgj"},{"vulnerability":"VCID-q8fz-36n2-vfh2"},{"vulnerability":"VCID-vx7b-mwfx-5fg2"},{"vulnerability":"VCID-wfzw-3x26-tucg"},{"vulnerability":"VCID-x3bz-ehvb-jyfs"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:pypi/pillow@8.2.0"}],"aliases":["CVE-2021-28676","GHSA-7r7m-5h27-29hp","PYSEC-2021-92"],"risk_score":null,"exploitability":null,"weighted_severity":null,"resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-qbfa-rky7-juh5"},{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/35756?format=json","vulnerability_id":"VCID-qz6s-pjqj-7uet","summary":"An issue was discovered in Pillow before 8.1.1. In TiffDecode.c, there is a negative-offset memcpy with an invalid size.","references":[{"reference_url":"https://github.com/advisories/GHSA-8xjq-8fcg-g5hw","reference_id":"","reference_type":"","scores":[],"url":"https://github.com/advisories/GHSA-8xjq-8fcg-g5hw"},{"reference_url":"https://pillow.readthedocs.io/en/stable/releasenotes/8.1.1.html","reference_id":"","reference_type":"","scores":[],"url":"https://pillow.readthedocs.io/en/stable/releasenotes/8.1.1.html"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/20203?format=json","purl":"pkg:pypi/pillow@8.1.1","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-2gpf-94cu-6fcd"},{"vulnerability":"VCID-4tub-w66m-uyfu"},{"vulnerability":"VCID-7ya3-j9fa-zugj"},{"vulnerability":"VCID-9hza-srk7-sucy"},{"vulnerability":"VCID-d4dx-wbrv-gqaa"},{"vulnerability":"VCID-dkcx-xcb8-3fgj"},{"vulnerability":"VCID-fq9j-ntxd-t3b3"},{"vulnerability":"VCID-gve2-x5zh-gqha"},{"vulnerability":"VCID-htee-x1mv-sfhh"},{"vulnerability":"VCID-prvn-bejg-kufb"},{"vulnerability":"VCID-q8fz-36n2-vfh2"},{"vulnerability":"VCID-qbfa-rky7-juh5"},{"vulnerability":"VCID-tcda-8txy-7ygn"},{"vulnerability":"VCID-vx7b-mwfx-5fg2"},{"vulnerability":"VCID-wfzw-3x26-tucg"},{"vulnerability":"VCID-x3bz-ehvb-jyfs"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:pypi/pillow@8.1.1"}],"aliases":["CVE-2021-25290","GHSA-8xjq-8fcg-g5hw","PYSEC-2021-36"],"risk_score":null,"exploitability":null,"weighted_severity":null,"resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-qz6s-pjqj-7uet"},{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/35583?format=json","vulnerability_id":"VCID-t3rz-wf43-a3bf","summary":"In libImaging/SgiRleDecode.c in Pillow through 7.0.0, a number of out-of-bounds reads exist in the parsing of SGI image files, a different issue than CVE-2020-5311.","references":[{"reference_url":"https://github.com/advisories/GHSA-43fq-w8qq-v88h","reference_id":"","reference_type":"","scores":[],"url":"https://github.com/advisories/GHSA-43fq-w8qq-v88h"},{"reference_url":"https://github.com/python-pillow/Pillow/pull/4504","reference_id":"","reference_type":"","scores":[],"url":"https://github.com/python-pillow/Pillow/pull/4504"},{"reference_url":"https://github.com/python-pillow/Pillow/pull/4538","reference_id":"","reference_type":"","scores":[],"url":"https://github.com/python-pillow/Pillow/pull/4538"},{"reference_url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/BEBCPE4F2VHTIT6EZA2YZQZLPVDEBJGD/","reference_id":"","reference_type":"","scores":[],"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/BEBCPE4F2VHTIT6EZA2YZQZLPVDEBJGD/"},{"reference_url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/HOKHNWV2VS5GESY7IBD237E7C6T3I427/","reference_id":"","reference_type":"","scores":[],"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/HOKHNWV2VS5GESY7IBD237E7C6T3I427/"},{"reference_url":"https://pillow.readthedocs.io/en/stable/releasenotes/7.1.0.html","reference_id":"","reference_type":"","scores":[],"url":"https://pillow.readthedocs.io/en/stable/releasenotes/7.1.0.html"},{"reference_url":"https://pillow.readthedocs.io/en/stable/releasenotes/index.html","reference_id":"","reference_type":"","scores":[],"url":"https://pillow.readthedocs.io/en/stable/releasenotes/index.html"},{"reference_url":"https://usn.ubuntu.com/4430-1/","reference_id":"","reference_type":"","scores":[],"url":"https://usn.ubuntu.com/4430-1/"},{"reference_url":"https://usn.ubuntu.com/4430-2/","reference_id":"","reference_type":"","scores":[],"url":"https://usn.ubuntu.com/4430-2/"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/17728?format=json","purl":"pkg:pypi/pillow@7.1.0","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-2gpf-94cu-6fcd"},{"vulnerability":"VCID-3gam-zy4w-2ucr"},{"vulnerability":"VCID-4tub-w66m-uyfu"},{"vulnerability":"VCID-5h45-rcpb-q7bz"},{"vulnerability":"VCID-7hcs-pkze-6ba4"},{"vulnerability":"VCID-7v6e-3dxw-aubu"},{"vulnerability":"VCID-7ya3-j9fa-zugj"},{"vulnerability":"VCID-8z6g-5td3-g7ej"},{"vulnerability":"VCID-9hza-srk7-sucy"},{"vulnerability":"VCID-d4dx-wbrv-gqaa"},{"vulnerability":"VCID-dkcx-xcb8-3fgj"},{"vulnerability":"VCID-fq9j-ntxd-t3b3"},{"vulnerability":"VCID-g48w-36yx-tue3"},{"vulnerability":"VCID-gve2-x5zh-gqha"},{"vulnerability":"VCID-htee-x1mv-sfhh"},{"vulnerability":"VCID-kjxw-f4f4-dydb"},{"vulnerability":"VCID-prvn-bejg-kufb"},{"vulnerability":"VCID-q8fz-36n2-vfh2"},{"vulnerability":"VCID-qbfa-rky7-juh5"},{"vulnerability":"VCID-qz6s-pjqj-7uet"},{"vulnerability":"VCID-tcda-8txy-7ygn"},{"vulnerability":"VCID-vx7b-mwfx-5fg2"},{"vulnerability":"VCID-wfzw-3x26-tucg"},{"vulnerability":"VCID-wuv4-qn69-zygh"},{"vulnerability":"VCID-x3bz-ehvb-jyfs"},{"vulnerability":"VCID-yk5x-nt2m-5kgy"},{"vulnerability":"VCID-zsxq-dasb-qyex"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:pypi/pillow@7.1.0"}],"aliases":["CVE-2020-11538","GHSA-43fq-w8qq-v88h","PYSEC-2020-80"],"risk_score":null,"exploitability":null,"weighted_severity":null,"resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-t3rz-wf43-a3bf"},{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/35818?format=json","vulnerability_id":"VCID-tcda-8txy-7ygn","summary":"An issue was discovered in Pillow before 8.2.0. For BLP data, BlpImagePlugin did not properly check that reads (after jumping to file offsets) returned data. This could lead to a DoS where the decoder could be run a large number of times on empty data.","references":[{"reference_url":"https://github.com/advisories/GHSA-hjfx-8p6c-g7gx","reference_id":"","reference_type":"","scores":[],"url":"https://github.com/advisories/GHSA-hjfx-8p6c-g7gx"},{"reference_url":"https://github.com/python-pillow/Pillow/pull/5377","reference_id":"","reference_type":"","scores":[],"url":"https://github.com/python-pillow/Pillow/pull/5377"},{"reference_url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/MQHA5HAIBOYI3R6HDWCLAGFTIQP767FL/","reference_id":"","reference_type":"","scores":[],"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/MQHA5HAIBOYI3R6HDWCLAGFTIQP767FL/"},{"reference_url":"https://pillow.readthedocs.io/en/stable/releasenotes/8.2.0.html#cve-2021-28678-fix-blp-dos","reference_id":"","reference_type":"","scores":[],"url":"https://pillow.readthedocs.io/en/stable/releasenotes/8.2.0.html#cve-2021-28678-fix-blp-dos"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/22141?format=json","purl":"pkg:pypi/pillow@8.2.0","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-2gpf-94cu-6fcd"},{"vulnerability":"VCID-4tub-w66m-uyfu"},{"vulnerability":"VCID-7ya3-j9fa-zugj"},{"vulnerability":"VCID-9hza-srk7-sucy"},{"vulnerability":"VCID-d4dx-wbrv-gqaa"},{"vulnerability":"VCID-dkcx-xcb8-3fgj"},{"vulnerability":"VCID-q8fz-36n2-vfh2"},{"vulnerability":"VCID-vx7b-mwfx-5fg2"},{"vulnerability":"VCID-wfzw-3x26-tucg"},{"vulnerability":"VCID-x3bz-ehvb-jyfs"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:pypi/pillow@8.2.0"}],"aliases":["CVE-2021-28678","GHSA-hjfx-8p6c-g7gx","PYSEC-2021-94"],"risk_score":null,"exploitability":null,"weighted_severity":null,"resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-tcda-8txy-7ygn"},{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/36309?format=json","vulnerability_id":"VCID-vx7b-mwfx-5fg2","summary":"Pillow before 9.2.0 performs Improper Handling of Highly Compressed GIF Data (Data Amplification).","references":[{"reference_url":"https://bugs.gentoo.org/855683","reference_id":"","reference_type":"","scores":[],"url":"https://bugs.gentoo.org/855683"},{"reference_url":"https://cwe.mitre.org/data/definitions/409.html","reference_id":"","reference_type":"","scores":[],"url":"https://cwe.mitre.org/data/definitions/409.html"},{"reference_url":"https://github.com/python-pillow/Pillow/commit/11918eac0628ec8ac0812670d9838361ead2d6a4","reference_id":"","reference_type":"","scores":[],"url":"https://github.com/python-pillow/Pillow/commit/11918eac0628ec8ac0812670d9838361ead2d6a4"},{"reference_url":"https://github.com/python-pillow/Pillow/pull/6402","reference_id":"","reference_type":"","scores":[],"url":"https://github.com/python-pillow/Pillow/pull/6402"},{"reference_url":"https://github.com/python-pillow/Pillow/releases/tag/9.2.0","reference_id":"","reference_type":"","scores":[],"url":"https://github.com/python-pillow/Pillow/releases/tag/9.2.0"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/29762?format=json","purl":"pkg:pypi/pillow@9.2.0","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-4tub-w66m-uyfu"},{"vulnerability":"VCID-9hza-srk7-sucy"},{"vulnerability":"VCID-q325-dhha-83b2"},{"vulnerability":"VCID-x3bz-ehvb-jyfs"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:pypi/pillow@9.2.0"}],"aliases":["CVE-2022-45198","PYSEC-2022-42979"],"risk_score":null,"exploitability":null,"weighted_severity":null,"resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-vx7b-mwfx-5fg2"},{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/35416?format=json","vulnerability_id":"VCID-vxtq-wjad-3ue3","summary":"An issue was discovered in Pillow before 6.2.0. When reading specially crafted invalid image files, the library can either allocate very large amounts of memory or take an extremely long period of time to process the image.","references":[{"reference_url":"https://access.redhat.com/errata/RHSA-2020:0566","reference_id":"","reference_type":"","scores":[],"url":"https://access.redhat.com/errata/RHSA-2020:0566"},{"reference_url":"https://access.redhat.com/errata/RHSA-2020:0578","reference_id":"","reference_type":"","scores":[],"url":"https://access.redhat.com/errata/RHSA-2020:0578"},{"reference_url":"https://access.redhat.com/errata/RHSA-2020:0580","reference_id":"","reference_type":"","scores":[],"url":"https://access.redhat.com/errata/RHSA-2020:0580"},{"reference_url":"https://access.redhat.com/errata/RHSA-2020:0681","reference_id":"","reference_type":"","scores":[],"url":"https://access.redhat.com/errata/RHSA-2020:0681"},{"reference_url":"https://access.redhat.com/errata/RHSA-2020:0683","reference_id":"","reference_type":"","scores":[],"url":"https://access.redhat.com/errata/RHSA-2020:0683"},{"reference_url":"https://access.redhat.com/errata/RHSA-2020:0694","reference_id":"","reference_type":"","scores":[],"url":"https://access.redhat.com/errata/RHSA-2020:0694"},{"reference_url":"https://github.com/advisories/GHSA-j7mj-748x-7p78","reference_id":"","reference_type":"","scores":[],"url":"https://github.com/advisories/GHSA-j7mj-748x-7p78"},{"reference_url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/EMJBUZQGQ2Q7HXYCQVRLU7OXNC7CAWWU/","reference_id":"","reference_type":"","scores":[],"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/EMJBUZQGQ2Q7HXYCQVRLU7OXNC7CAWWU/"},{"reference_url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/LYDXD7EE4YAEVSTNIFZKNVPRVJX5ZOG3/","reference_id":"","reference_type":"","scores":[],"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/LYDXD7EE4YAEVSTNIFZKNVPRVJX5ZOG3/"},{"reference_url":"https://pillow.readthedocs.io/en/latest/releasenotes/6.2.0.html","reference_id":"","reference_type":"","scores":[],"url":"https://pillow.readthedocs.io/en/latest/releasenotes/6.2.0.html"},{"reference_url":"https://usn.ubuntu.com/4272-1/","reference_id":"","reference_type":"","scores":[],"url":"https://usn.ubuntu.com/4272-1/"},{"reference_url":"https://www.debian.org/security/2020/dsa-4631","reference_id":"","reference_type":"","scores":[],"url":"https://www.debian.org/security/2020/dsa-4631"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/14340?format=json","purl":"pkg:pypi/pillow@6.2.0","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-2gpf-94cu-6fcd"},{"vulnerability":"VCID-3gam-zy4w-2ucr"},{"vulnerability":"VCID-4tub-w66m-uyfu"},{"vulnerability":"VCID-5h45-rcpb-q7bz"},{"vulnerability":"VCID-7hcs-pkze-6ba4"},{"vulnerability":"VCID-7sps-ppua-ubb2"},{"vulnerability":"VCID-7v6e-3dxw-aubu"},{"vulnerability":"VCID-7ya3-j9fa-zugj"},{"vulnerability":"VCID-8z6g-5td3-g7ej"},{"vulnerability":"VCID-9hza-srk7-sucy"},{"vulnerability":"VCID-9qm6-cbz9-b7c8"},{"vulnerability":"VCID-9v9s-wbu3-cqc7"},{"vulnerability":"VCID-cb58-eehb-j7cv"},{"vulnerability":"VCID-d4dx-wbrv-gqaa"},{"vulnerability":"VCID-dkcx-xcb8-3fgj"},{"vulnerability":"VCID-fq9j-ntxd-t3b3"},{"vulnerability":"VCID-g48w-36yx-tue3"},{"vulnerability":"VCID-gve2-x5zh-gqha"},{"vulnerability":"VCID-htee-x1mv-sfhh"},{"vulnerability":"VCID-jtq6-eykc-ykbz"},{"vulnerability":"VCID-kjxw-f4f4-dydb"},{"vulnerability":"VCID-mph7-qmm8-1fan"},{"vulnerability":"VCID-p66f-cwf8-tfdr"},{"vulnerability":"VCID-prvn-bejg-kufb"},{"vulnerability":"VCID-q8fz-36n2-vfh2"},{"vulnerability":"VCID-qbfa-rky7-juh5"},{"vulnerability":"VCID-qz6s-pjqj-7uet"},{"vulnerability":"VCID-t3rz-wf43-a3bf"},{"vulnerability":"VCID-tcda-8txy-7ygn"},{"vulnerability":"VCID-vx7b-mwfx-5fg2"},{"vulnerability":"VCID-wfzw-3x26-tucg"},{"vulnerability":"VCID-whh3-qs36-pqfq"},{"vulnerability":"VCID-wuv4-qn69-zygh"},{"vulnerability":"VCID-x3bz-ehvb-jyfs"},{"vulnerability":"VCID-xbur-n6na-d7g1"},{"vulnerability":"VCID-yk5x-nt2m-5kgy"},{"vulnerability":"VCID-zsxq-dasb-qyex"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:pypi/pillow@6.2.0"}],"aliases":["CVE-2019-16865","GHSA-j7mj-748x-7p78","PYSEC-2019-110"],"risk_score":null,"exploitability":null,"weighted_severity":null,"resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-vxtq-wjad-3ue3"},{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/35950?format=json","vulnerability_id":"VCID-wfzw-3x26-tucg","summary":"path_getbbox in path.c in Pillow before 9.0.0 has a buffer over-read during initialization of ImagePath.Path.","references":[{"reference_url":"https://github.com/advisories/GHSA-xrcv-f9gm-v42c","reference_id":"","reference_type":"","scores":[],"url":"https://github.com/advisories/GHSA-xrcv-f9gm-v42c"},{"reference_url":"https://github.com/pypa/advisory-database/tree/main/vulns/pillow/PYSEC-2022-9.yaml","reference_id":"","reference_type":"","scores":[],"url":"https://github.com/pypa/advisory-database/tree/main/vulns/pillow/PYSEC-2022-9.yaml"},{"reference_url":"https://github.com/python-pillow/Pillow","reference_id":"","reference_type":"","scores":[],"url":"https://github.com/python-pillow/Pillow"},{"reference_url":"https://github.com/python-pillow/Pillow/blob/c5d9223a8b5e9295d15b5a9b1ef1dae44c8499f3/src/path.c#L331","reference_id":"","reference_type":"","scores":[],"url":"https://github.com/python-pillow/Pillow/blob/c5d9223a8b5e9295d15b5a9b1ef1dae44c8499f3/src/path.c#L331"},{"reference_url":"https://github.com/python-pillow/Pillow/commit/5543e4e2d409cd9e409bc64cdc77be0af007a31f","reference_id":"","reference_type":"","scores":[],"url":"https://github.com/python-pillow/Pillow/commit/5543e4e2d409cd9e409bc64cdc77be0af007a31f"},{"reference_url":"https://github.com/python-pillow/Pillow/pull/5920","reference_id":"","reference_type":"","scores":[],"url":"https://github.com/python-pillow/Pillow/pull/5920"},{"reference_url":"https://lists.debian.org/debian-lts-announce/2022/01/msg00018.html","reference_id":"","reference_type":"","scores":[],"url":"https://lists.debian.org/debian-lts-announce/2022/01/msg00018.html"},{"reference_url":"https://pillow.readthedocs.io/en/stable/releasenotes/9.0.0.html#fixed-imagepath-path-array-handling","reference_id":"","reference_type":"","scores":[],"url":"https://pillow.readthedocs.io/en/stable/releasenotes/9.0.0.html#fixed-imagepath-path-array-handling"},{"reference_url":"https://security.gentoo.org/glsa/202211-10","reference_id":"","reference_type":"","scores":[],"url":"https://security.gentoo.org/glsa/202211-10"},{"reference_url":"https://www.debian.org/security/2022/dsa-5053","reference_id":"","reference_type":"","scores":[],"url":"https://www.debian.org/security/2022/dsa-5053"},{"reference_url":"https://nvd.nist.gov/vuln/detail/CVE-2022-22816","reference_id":"CVE-2022-22816","reference_type":"","scores":[],"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-22816"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/26297?format=json","purl":"pkg:pypi/pillow@9.0.0","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-4tub-w66m-uyfu"},{"vulnerability":"VCID-9hza-srk7-sucy"},{"vulnerability":"VCID-q8fz-36n2-vfh2"},{"vulnerability":"VCID-vx7b-mwfx-5fg2"},{"vulnerability":"VCID-x3bz-ehvb-jyfs"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:pypi/pillow@9.0.0"}],"aliases":["CVE-2022-22816","GHSA-xrcv-f9gm-v42c","PYSEC-2022-9"],"risk_score":null,"exploitability":null,"weighted_severity":null,"resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-wfzw-3x26-tucg"},{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/35579?format=json","vulnerability_id":"VCID-whh3-qs36-pqfq","summary":"In libImaging/Jpeg2KDecode.c in Pillow before 7.1.0, there are multiple out-of-bounds reads via a crafted JP2 file.","references":[{"reference_url":"https://github.com/advisories/GHSA-vj42-xq3r-hr3r","reference_id":"","reference_type":"","scores":[],"url":"https://github.com/advisories/GHSA-vj42-xq3r-hr3r"},{"reference_url":"https://github.com/python-pillow/Pillow/commits/master/src/libImaging/","reference_id":"","reference_type":"","scores":[],"url":"https://github.com/python-pillow/Pillow/commits/master/src/libImaging/"},{"reference_url":"https://github.com/python-pillow/Pillow/pull/4505","reference_id":"","reference_type":"","scores":[],"url":"https://github.com/python-pillow/Pillow/pull/4505"},{"reference_url":"https://github.com/python-pillow/Pillow/pull/4538","reference_id":"","reference_type":"","scores":[],"url":"https://github.com/python-pillow/Pillow/pull/4538"},{"reference_url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/BEBCPE4F2VHTIT6EZA2YZQZLPVDEBJGD/","reference_id":"","reference_type":"","scores":[],"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/BEBCPE4F2VHTIT6EZA2YZQZLPVDEBJGD/"},{"reference_url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/HOKHNWV2VS5GESY7IBD237E7C6T3I427/","reference_id":"","reference_type":"","scores":[],"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/HOKHNWV2VS5GESY7IBD237E7C6T3I427/"},{"reference_url":"https://pillow.readthedocs.io/en/stable/releasenotes/","reference_id":"","reference_type":"","scores":[],"url":"https://pillow.readthedocs.io/en/stable/releasenotes/"},{"reference_url":"https://pillow.readthedocs.io/en/stable/releasenotes/7.1.0.html","reference_id":"","reference_type":"","scores":[],"url":"https://pillow.readthedocs.io/en/stable/releasenotes/7.1.0.html"},{"reference_url":"https://usn.ubuntu.com/4430-1/","reference_id":"","reference_type":"","scores":[],"url":"https://usn.ubuntu.com/4430-1/"},{"reference_url":"https://usn.ubuntu.com/4430-2/","reference_id":"","reference_type":"","scores":[],"url":"https://usn.ubuntu.com/4430-2/"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/17727?format=json","purl":"pkg:pypi/pillow@7.0.0","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-2gpf-94cu-6fcd"},{"vulnerability":"VCID-3gam-zy4w-2ucr"},{"vulnerability":"VCID-4tub-w66m-uyfu"},{"vulnerability":"VCID-5h45-rcpb-q7bz"},{"vulnerability":"VCID-7hcs-pkze-6ba4"},{"vulnerability":"VCID-7v6e-3dxw-aubu"},{"vulnerability":"VCID-7ya3-j9fa-zugj"},{"vulnerability":"VCID-8z6g-5td3-g7ej"},{"vulnerability":"VCID-9hza-srk7-sucy"},{"vulnerability":"VCID-9v9s-wbu3-cqc7"},{"vulnerability":"VCID-d4dx-wbrv-gqaa"},{"vulnerability":"VCID-dkcx-xcb8-3fgj"},{"vulnerability":"VCID-fq9j-ntxd-t3b3"},{"vulnerability":"VCID-g48w-36yx-tue3"},{"vulnerability":"VCID-gve2-x5zh-gqha"},{"vulnerability":"VCID-htee-x1mv-sfhh"},{"vulnerability":"VCID-jtq6-eykc-ykbz"},{"vulnerability":"VCID-kjxw-f4f4-dydb"},{"vulnerability":"VCID-prvn-bejg-kufb"},{"vulnerability":"VCID-q8fz-36n2-vfh2"},{"vulnerability":"VCID-qbfa-rky7-juh5"},{"vulnerability":"VCID-qz6s-pjqj-7uet"},{"vulnerability":"VCID-t3rz-wf43-a3bf"},{"vulnerability":"VCID-tcda-8txy-7ygn"},{"vulnerability":"VCID-vx7b-mwfx-5fg2"},{"vulnerability":"VCID-wfzw-3x26-tucg"},{"vulnerability":"VCID-wuv4-qn69-zygh"},{"vulnerability":"VCID-x3bz-ehvb-jyfs"},{"vulnerability":"VCID-xbur-n6na-d7g1"},{"vulnerability":"VCID-yk5x-nt2m-5kgy"},{"vulnerability":"VCID-zsxq-dasb-qyex"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:pypi/pillow@7.0.0"}],"aliases":["CVE-2020-10994","GHSA-vj42-xq3r-hr3r","PYSEC-2020-79"],"risk_score":null,"exploitability":null,"weighted_severity":null,"resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-whh3-qs36-pqfq"},{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/35755?format=json","vulnerability_id":"VCID-wuv4-qn69-zygh","summary":"An issue was discovered in Pillow before 8.1.1. The PDF parser allows a regular expression DoS (ReDoS) attack via a crafted PDF file because of a catastrophic backtracking regex.","references":[{"reference_url":"https://github.com/advisories/GHSA-9hx2-hgq2-2g4f","reference_id":"","reference_type":"","scores":[],"url":"https://github.com/advisories/GHSA-9hx2-hgq2-2g4f"},{"reference_url":"https://pillow.readthedocs.io/en/stable/releasenotes/8.1.1.html","reference_id":"","reference_type":"","scores":[],"url":"https://pillow.readthedocs.io/en/stable/releasenotes/8.1.1.html"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/20203?format=json","purl":"pkg:pypi/pillow@8.1.1","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-2gpf-94cu-6fcd"},{"vulnerability":"VCID-4tub-w66m-uyfu"},{"vulnerability":"VCID-7ya3-j9fa-zugj"},{"vulnerability":"VCID-9hza-srk7-sucy"},{"vulnerability":"VCID-d4dx-wbrv-gqaa"},{"vulnerability":"VCID-dkcx-xcb8-3fgj"},{"vulnerability":"VCID-fq9j-ntxd-t3b3"},{"vulnerability":"VCID-gve2-x5zh-gqha"},{"vulnerability":"VCID-htee-x1mv-sfhh"},{"vulnerability":"VCID-prvn-bejg-kufb"},{"vulnerability":"VCID-q8fz-36n2-vfh2"},{"vulnerability":"VCID-qbfa-rky7-juh5"},{"vulnerability":"VCID-tcda-8txy-7ygn"},{"vulnerability":"VCID-vx7b-mwfx-5fg2"},{"vulnerability":"VCID-wfzw-3x26-tucg"},{"vulnerability":"VCID-x3bz-ehvb-jyfs"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:pypi/pillow@8.1.1"}],"aliases":["CVE-2021-25292","GHSA-9hx2-hgq2-2g4f","PYSEC-2021-38"],"risk_score":null,"exploitability":null,"weighted_severity":null,"resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-wuv4-qn69-zygh"},{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/36600?format=json","vulnerability_id":"VCID-x3bz-ehvb-jyfs","summary":"An issue was discovered in Pillow before 10.0.0. It is a Denial of Service that uncontrollably allocates memory to process a given task, potentially causing a service to crash by having it run out of memory. This occurs for truetype in ImageFont when textlength in an ImageDraw instance operates on a long text argument.","references":[{"reference_url":"https://devhub.checkmarx.com/cve-details/CVE-2023-44271/","reference_id":"","reference_type":"","scores":[],"url":"https://devhub.checkmarx.com/cve-details/CVE-2023-44271/"},{"reference_url":"https://github.com/pypa/advisory-database/tree/main/vulns/pillow/PYSEC-2023-227.yaml","reference_id":"","reference_type":"","scores":[],"url":"https://github.com/pypa/advisory-database/tree/main/vulns/pillow/PYSEC-2023-227.yaml"},{"reference_url":"https://github.com/python-pillow/Pillow","reference_id":"","reference_type":"","scores":[],"url":"https://github.com/python-pillow/Pillow"},{"reference_url":"https://github.com/python-pillow/Pillow/commit/1fe1bb49c452b0318cad12ea9d97c3bef188e9a7","reference_id":"","reference_type":"","scores":[],"url":"https://github.com/python-pillow/Pillow/commit/1fe1bb49c452b0318cad12ea9d97c3bef188e9a7"},{"reference_url":"https://github.com/python-pillow/Pillow/pull/7244","reference_id":"","reference_type":"","scores":[],"url":"https://github.com/python-pillow/Pillow/pull/7244"},{"reference_url":"https://lists.debian.org/debian-lts-announce/2024/03/msg00021.html","reference_id":"","reference_type":"","scores":[],"url":"https://lists.debian.org/debian-lts-announce/2024/03/msg00021.html"},{"reference_url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/N2JOEDUJDQLCUII2LQYZYSM7RJL2I3P4","reference_id":"","reference_type":"","scores":[],"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/N2JOEDUJDQLCUII2LQYZYSM7RJL2I3P4"},{"reference_url":"https://devhub.checkmarx.com/cve-details/CVE-2023-44271","reference_id":"CVE-2023-44271","reference_type":"","scores":[],"url":"https://devhub.checkmarx.com/cve-details/CVE-2023-44271"},{"reference_url":"https://nvd.nist.gov/vuln/detail/CVE-2023-44271","reference_id":"CVE-2023-44271","reference_type":"","scores":[],"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-44271"},{"reference_url":"https://github.com/advisories/GHSA-8ghj-p4vj-mr35","reference_id":"GHSA-8ghj-p4vj-mr35","reference_type":"","scores":[],"url":"https://github.com/advisories/GHSA-8ghj-p4vj-mr35"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/37828?format=json","purl":"pkg:pypi/pillow@10.0.0","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-4tub-w66m-uyfu"},{"vulnerability":"VCID-9hza-srk7-sucy"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:pypi/pillow@10.0.0"}],"aliases":["CVE-2023-44271","GHSA-8ghj-p4vj-mr35","PYSEC-2023-227"],"risk_score":null,"exploitability":null,"weighted_severity":null,"resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-x3bz-ehvb-jyfs"},{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/35581?format=json","vulnerability_id":"VCID-xbur-n6na-d7g1","summary":"In libImaging/PcxDecode.c in Pillow before 7.1.0, an out-of-bounds read can occur when reading PCX files where state->shuffle is instructed to read beyond state->buffer.","references":[{"reference_url":"https://github.com/advisories/GHSA-3xv8-3j54-hgrp","reference_id":"","reference_type":"","scores":[],"url":"https://github.com/advisories/GHSA-3xv8-3j54-hgrp"},{"reference_url":"https://github.com/pypa/advisory-database/tree/main/vulns/pillow/PYSEC-2020-77.yaml","reference_id":"","reference_type":"","scores":[],"url":"https://github.com/pypa/advisory-database/tree/main/vulns/pillow/PYSEC-2020-77.yaml"},{"reference_url":"https://github.com/pypa/advisory-db/blob/7872b0a91b4d980f749e6d75a81f8cc1af32829f/vulns/pillow/PYSEC-2020-77.yaml","reference_id":"","reference_type":"","scores":[],"url":"https://github.com/pypa/advisory-db/blob/7872b0a91b4d980f749e6d75a81f8cc1af32829f/vulns/pillow/PYSEC-2020-77.yaml"},{"reference_url":"https://github.com/python-pillow/Pillow","reference_id":"","reference_type":"","scores":[],"url":"https://github.com/python-pillow/Pillow"},{"reference_url":"https://github.com/python-pillow/Pillow/commit/124f4bb591e16212605d0e41c413ed53e242cba2","reference_id":"","reference_type":"","scores":[],"url":"https://github.com/python-pillow/Pillow/commit/124f4bb591e16212605d0e41c413ed53e242cba2"},{"reference_url":"https://github.com/python-pillow/Pillow/commit/6a83e4324738bb0452fbe8074a995b1c73f08de7#diff-9478f2787e3ae9668a15123b165c23ac","reference_id":"","reference_type":"","scores":[],"url":"https://github.com/python-pillow/Pillow/commit/6a83e4324738bb0452fbe8074a995b1c73f08de7#diff-9478f2787e3ae9668a15123b165c23ac"},{"reference_url":"https://github.com/python-pillow/Pillow/commits/master/src/libImaging","reference_id":"","reference_type":"","scores":[],"url":"https://github.com/python-pillow/Pillow/commits/master/src/libImaging"},{"reference_url":"https://github.com/python-pillow/Pillow/issues/4750","reference_id":"","reference_type":"","scores":[],"url":"https://github.com/python-pillow/Pillow/issues/4750"},{"reference_url":"https://github.com/python-pillow/Pillow/pull/4538","reference_id":"","reference_type":"","scores":[],"url":"https://github.com/python-pillow/Pillow/pull/4538"},{"reference_url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/BEBCPE4F2VHTIT6EZA2YZQZLPVDEBJGD","reference_id":"","reference_type":"","scores":[],"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/BEBCPE4F2VHTIT6EZA2YZQZLPVDEBJGD"},{"reference_url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/BEBCPE4F2VHTIT6EZA2YZQZLPVDEBJGD/","reference_id":"","reference_type":"","scores":[],"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/BEBCPE4F2VHTIT6EZA2YZQZLPVDEBJGD/"},{"reference_url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/HOKHNWV2VS5GESY7IBD237E7C6T3I427","reference_id":"","reference_type":"","scores":[],"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/HOKHNWV2VS5GESY7IBD237E7C6T3I427"},{"reference_url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/HOKHNWV2VS5GESY7IBD237E7C6T3I427/","reference_id":"","reference_type":"","scores":[],"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/HOKHNWV2VS5GESY7IBD237E7C6T3I427/"},{"reference_url":"https://pillow.readthedocs.io/en/stable/releasenotes/6.2.3.html","reference_id":"","reference_type":"","scores":[],"url":"https://pillow.readthedocs.io/en/stable/releasenotes/6.2.3.html"},{"reference_url":"https://pillow.readthedocs.io/en/stable/releasenotes/7.1.0.html","reference_id":"","reference_type":"","scores":[],"url":"https://pillow.readthedocs.io/en/stable/releasenotes/7.1.0.html"},{"reference_url":"https://usn.ubuntu.com/4430-1","reference_id":"","reference_type":"","scores":[],"url":"https://usn.ubuntu.com/4430-1"},{"reference_url":"https://usn.ubuntu.com/4430-1/","reference_id":"","reference_type":"","scores":[],"url":"https://usn.ubuntu.com/4430-1/"},{"reference_url":"https://usn.ubuntu.com/4430-2","reference_id":"","reference_type":"","scores":[],"url":"https://usn.ubuntu.com/4430-2"},{"reference_url":"https://usn.ubuntu.com/4430-2/","reference_id":"","reference_type":"","scores":[],"url":"https://usn.ubuntu.com/4430-2/"},{"reference_url":"https://nvd.nist.gov/vuln/detail/CVE-2020-10378","reference_id":"CVE-2020-10378","reference_type":"","scores":[],"url":"https://nvd.nist.gov/vuln/detail/CVE-2020-10378"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/17728?format=json","purl":"pkg:pypi/pillow@7.1.0","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-2gpf-94cu-6fcd"},{"vulnerability":"VCID-3gam-zy4w-2ucr"},{"vulnerability":"VCID-4tub-w66m-uyfu"},{"vulnerability":"VCID-5h45-rcpb-q7bz"},{"vulnerability":"VCID-7hcs-pkze-6ba4"},{"vulnerability":"VCID-7v6e-3dxw-aubu"},{"vulnerability":"VCID-7ya3-j9fa-zugj"},{"vulnerability":"VCID-8z6g-5td3-g7ej"},{"vulnerability":"VCID-9hza-srk7-sucy"},{"vulnerability":"VCID-d4dx-wbrv-gqaa"},{"vulnerability":"VCID-dkcx-xcb8-3fgj"},{"vulnerability":"VCID-fq9j-ntxd-t3b3"},{"vulnerability":"VCID-g48w-36yx-tue3"},{"vulnerability":"VCID-gve2-x5zh-gqha"},{"vulnerability":"VCID-htee-x1mv-sfhh"},{"vulnerability":"VCID-kjxw-f4f4-dydb"},{"vulnerability":"VCID-prvn-bejg-kufb"},{"vulnerability":"VCID-q8fz-36n2-vfh2"},{"vulnerability":"VCID-qbfa-rky7-juh5"},{"vulnerability":"VCID-qz6s-pjqj-7uet"},{"vulnerability":"VCID-tcda-8txy-7ygn"},{"vulnerability":"VCID-vx7b-mwfx-5fg2"},{"vulnerability":"VCID-wfzw-3x26-tucg"},{"vulnerability":"VCID-wuv4-qn69-zygh"},{"vulnerability":"VCID-x3bz-ehvb-jyfs"},{"vulnerability":"VCID-yk5x-nt2m-5kgy"},{"vulnerability":"VCID-zsxq-dasb-qyex"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:pypi/pillow@7.1.0"}],"aliases":["CVE-2020-10378","GHSA-3xv8-3j54-hgrp","PYSEC-2020-77"],"risk_score":null,"exploitability":null,"weighted_severity":null,"resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-xbur-n6na-d7g1"},{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/35754?format=json","vulnerability_id":"VCID-yk5x-nt2m-5kgy","summary":"An issue was discovered in Pillow before 8.1.1. In TiffDecode.c, there is an out-of-bounds read in TiffreadRGBATile via invalid tile boundaries.","references":[{"reference_url":"https://github.com/advisories/GHSA-mvg9-xffr-p774","reference_id":"","reference_type":"","scores":[],"url":"https://github.com/advisories/GHSA-mvg9-xffr-p774"},{"reference_url":"https://pillow.readthedocs.io/en/stable/releasenotes/8.1.1.html","reference_id":"","reference_type":"","scores":[],"url":"https://pillow.readthedocs.io/en/stable/releasenotes/8.1.1.html"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/20203?format=json","purl":"pkg:pypi/pillow@8.1.1","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-2gpf-94cu-6fcd"},{"vulnerability":"VCID-4tub-w66m-uyfu"},{"vulnerability":"VCID-7ya3-j9fa-zugj"},{"vulnerability":"VCID-9hza-srk7-sucy"},{"vulnerability":"VCID-d4dx-wbrv-gqaa"},{"vulnerability":"VCID-dkcx-xcb8-3fgj"},{"vulnerability":"VCID-fq9j-ntxd-t3b3"},{"vulnerability":"VCID-gve2-x5zh-gqha"},{"vulnerability":"VCID-htee-x1mv-sfhh"},{"vulnerability":"VCID-prvn-bejg-kufb"},{"vulnerability":"VCID-q8fz-36n2-vfh2"},{"vulnerability":"VCID-qbfa-rky7-juh5"},{"vulnerability":"VCID-tcda-8txy-7ygn"},{"vulnerability":"VCID-vx7b-mwfx-5fg2"},{"vulnerability":"VCID-wfzw-3x26-tucg"},{"vulnerability":"VCID-x3bz-ehvb-jyfs"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:pypi/pillow@8.1.1"}],"aliases":["CVE-2021-25291","GHSA-mvg9-xffr-p774","PYSEC-2021-37"],"risk_score":null,"exploitability":null,"weighted_severity":null,"resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-yk5x-nt2m-5kgy"},{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/35742?format=json","vulnerability_id":"VCID-zsxq-dasb-qyex","summary":"Pillow before 8.1.1 allows attackers to cause a denial of service (memory consumption) because the reported size of a contained image is not properly checked for an ICNS container, and thus an attempted memory allocation can be very large.","references":[{"reference_url":"https://github.com/advisories/GHSA-3wvg-mj6g-m9cv","reference_id":"","reference_type":"","scores":[],"url":"https://github.com/advisories/GHSA-3wvg-mj6g-m9cv"},{"reference_url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/S7G44Z33J4BNI2DPDROHWGVG2U7ZH5JU/","reference_id":"","reference_type":"","scores":[],"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/S7G44Z33J4BNI2DPDROHWGVG2U7ZH5JU/"},{"reference_url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/TQQY6472RX4J2SUJENWDZAWKTJJGP2ML/","reference_id":"","reference_type":"","scores":[],"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/TQQY6472RX4J2SUJENWDZAWKTJJGP2ML/"},{"reference_url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZTSY25UJU7NJUFHH3HWT575LT4TDFWBZ/","reference_id":"","reference_type":"","scores":[],"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZTSY25UJU7NJUFHH3HWT575LT4TDFWBZ/"},{"reference_url":"https://pillow.readthedocs.io/en/stable/releasenotes/8.1.1.html","reference_id":"","reference_type":"","scores":[],"url":"https://pillow.readthedocs.io/en/stable/releasenotes/8.1.1.html"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/20203?format=json","purl":"pkg:pypi/pillow@8.1.1","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-2gpf-94cu-6fcd"},{"vulnerability":"VCID-4tub-w66m-uyfu"},{"vulnerability":"VCID-7ya3-j9fa-zugj"},{"vulnerability":"VCID-9hza-srk7-sucy"},{"vulnerability":"VCID-d4dx-wbrv-gqaa"},{"vulnerability":"VCID-dkcx-xcb8-3fgj"},{"vulnerability":"VCID-fq9j-ntxd-t3b3"},{"vulnerability":"VCID-gve2-x5zh-gqha"},{"vulnerability":"VCID-htee-x1mv-sfhh"},{"vulnerability":"VCID-prvn-bejg-kufb"},{"vulnerability":"VCID-q8fz-36n2-vfh2"},{"vulnerability":"VCID-qbfa-rky7-juh5"},{"vulnerability":"VCID-tcda-8txy-7ygn"},{"vulnerability":"VCID-vx7b-mwfx-5fg2"},{"vulnerability":"VCID-wfzw-3x26-tucg"},{"vulnerability":"VCID-x3bz-ehvb-jyfs"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:pypi/pillow@8.1.1"}],"aliases":["CVE-2021-27922","GHSA-3wvg-mj6g-m9cv","PYSEC-2021-41"],"risk_score":null,"exploitability":null,"weighted_severity":null,"resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-zsxq-dasb-qyex"}],"fixing_vulnerabilities":[{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/34994?format=json","vulnerability_id":"VCID-1uv3-mjkz-rkcr","summary":"Buffer overflow in the ImagingPcdDecode function in PcdDecode.c in Pillow before 3.1.1 and Python Imaging Library (PIL) 1.1.7 and earlier allows remote attackers to cause a denial of service (crash) via a crafted PhotoCD file.","references":[{"reference_url":"https://github.com/advisories/GHSA-3c5c-7235-994j","reference_id":"","reference_type":"","scores":[],"url":"https://github.com/advisories/GHSA-3c5c-7235-994j"},{"reference_url":"https://github.com/pypa/advisory-database/tree/main/vulns/pillow/PYSEC-2016-19.yaml","reference_id":"","reference_type":"","scores":[],"url":"https://github.com/pypa/advisory-database/tree/main/vulns/pillow/PYSEC-2016-19.yaml"},{"reference_url":"https://github.com/python-pillow/Pillow","reference_id":"","reference_type":"","scores":[],"url":"https://github.com/python-pillow/Pillow"},{"reference_url":"https://github.com/python-pillow/Pillow/blob/c3cb690fed5d4bf0c45576759de55d054916c165/CHANGES.rst","reference_id":"","reference_type":"","scores":[],"url":"https://github.com/python-pillow/Pillow/blob/c3cb690fed5d4bf0c45576759de55d054916c165/CHANGES.rst"},{"reference_url":"https://github.com/python-pillow/Pillow/blob/c3cb690fed5d4bf0c45576759de55d054916c165/CHANGES.rst?plain=1#L53","reference_id":"","reference_type":"","scores":[],"url":"https://github.com/python-pillow/Pillow/blob/c3cb690fed5d4bf0c45576759de55d054916c165/CHANGES.rst?plain=1#L53"},{"reference_url":"https://github.com/python-pillow/Pillow/commit/5bdf54b5a76b54fb00bd05f2d733e0a4173eefc9","reference_id":"","reference_type":"","scores":[],"url":"https://github.com/python-pillow/Pillow/commit/5bdf54b5a76b54fb00bd05f2d733e0a4173eefc9"},{"reference_url":"https://github.com/python-pillow/Pillow/commit/5bdf54b5a76b54fb00bd05f2d733e0a4173eefc9#diff-8ff6909c159597e22288ad818938fd6b","reference_id":"","reference_type":"","scores":[],"url":"https://github.com/python-pillow/Pillow/commit/5bdf54b5a76b54fb00bd05f2d733e0a4173eefc9#diff-8ff6909c159597e22288ad818938fd6b"},{"reference_url":"https://github.com/python-pillow/Pillow/commit/ae453aa18b66af54e7ff716f4ccb33adca60afd4#diff-8ff6909c159597e22288ad818938fd6b","reference_id":"","reference_type":"","scores":[],"url":"https://github.com/python-pillow/Pillow/commit/ae453aa18b66af54e7ff716f4ccb33adca60afd4#diff-8ff6909c159597e22288ad818938fd6b"},{"reference_url":"https://github.com/python-pillow/Pillow/pull/1706","reference_id":"","reference_type":"","scores":[],"url":"https://github.com/python-pillow/Pillow/pull/1706"},{"reference_url":"https://security.gentoo.org/glsa/201612-52","reference_id":"","reference_type":"","scores":[],"url":"https://security.gentoo.org/glsa/201612-52"},{"reference_url":"http://www.debian.org/security/2016/dsa-3499","reference_id":"","reference_type":"","scores":[],"url":"http://www.debian.org/security/2016/dsa-3499"},{"reference_url":"http://www.openwall.com/lists/oss-security/2016/02/02/5","reference_id":"","reference_type":"","scores":[],"url":"http://www.openwall.com/lists/oss-security/2016/02/02/5"},{"reference_url":"http://www.openwall.com/lists/oss-security/2016/02/22/2","reference_id":"","reference_type":"","scores":[],"url":"http://www.openwall.com/lists/oss-security/2016/02/22/2"},{"reference_url":"http://www.oracle.com/technetwork/topics/security/bulletinjan2016-2867206.html","reference_id":"","reference_type":"","scores":[],"url":"http://www.oracle.com/technetwork/topics/security/bulletinjan2016-2867206.html"},{"reference_url":"https://nvd.nist.gov/vuln/detail/CVE-2016-2533","reference_id":"CVE-2016-2533","reference_type":"","scores":[],"url":"https://nvd.nist.gov/vuln/detail/CVE-2016-2533"},{"reference_url":"http://www.cvedetails.com/cve/CVE-2016-2533/","reference_id":"CVE-2016-2533","reference_type":"","scores":[],"url":"http://www.cvedetails.com/cve/CVE-2016-2533/"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/9210?format=json","purl":"pkg:pypi/pillow@3.1.1","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-2gpf-94cu-6fcd"},{"vulnerability":"VCID-3gam-zy4w-2ucr"},{"vulnerability":"VCID-4tub-w66m-uyfu"},{"vulnerability":"VCID-5h45-rcpb-q7bz"},{"vulnerability":"VCID-6qkd-kgxx-dyeq"},{"vulnerability":"VCID-6wqw-esat-2ua2"},{"vulnerability":"VCID-7sps-ppua-ubb2"},{"vulnerability":"VCID-7v6e-3dxw-aubu"},{"vulnerability":"VCID-7ya3-j9fa-zugj"},{"vulnerability":"VCID-8z6g-5td3-g7ej"},{"vulnerability":"VCID-9hza-srk7-sucy"},{"vulnerability":"VCID-9qm6-cbz9-b7c8"},{"vulnerability":"VCID-9v9s-wbu3-cqc7"},{"vulnerability":"VCID-cb58-eehb-j7cv"},{"vulnerability":"VCID-d4dx-wbrv-gqaa"},{"vulnerability":"VCID-dkcx-xcb8-3fgj"},{"vulnerability":"VCID-fq9j-ntxd-t3b3"},{"vulnerability":"VCID-g48w-36yx-tue3"},{"vulnerability":"VCID-gve2-x5zh-gqha"},{"vulnerability":"VCID-htee-x1mv-sfhh"},{"vulnerability":"VCID-jtq6-eykc-ykbz"},{"vulnerability":"VCID-kjxw-f4f4-dydb"},{"vulnerability":"VCID-mph7-qmm8-1fan"},{"vulnerability":"VCID-p66f-cwf8-tfdr"},{"vulnerability":"VCID-prvn-bejg-kufb"},{"vulnerability":"VCID-px2q-ph74-1ue6"},{"vulnerability":"VCID-q8fz-36n2-vfh2"},{"vulnerability":"VCID-qbfa-rky7-juh5"},{"vulnerability":"VCID-qz6s-pjqj-7uet"},{"vulnerability":"VCID-t3rz-wf43-a3bf"},{"vulnerability":"VCID-tcda-8txy-7ygn"},{"vulnerability":"VCID-vx7b-mwfx-5fg2"},{"vulnerability":"VCID-vxtq-wjad-3ue3"},{"vulnerability":"VCID-wfzw-3x26-tucg"},{"vulnerability":"VCID-whh3-qs36-pqfq"},{"vulnerability":"VCID-wuv4-qn69-zygh"},{"vulnerability":"VCID-x3bz-ehvb-jyfs"},{"vulnerability":"VCID-xbur-n6na-d7g1"},{"vulnerability":"VCID-yk5x-nt2m-5kgy"},{"vulnerability":"VCID-zsxq-dasb-qyex"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:pypi/pillow@3.1.1"}],"aliases":["CVE-2016-2533","GHSA-3c5c-7235-994j","PYSEC-2016-19"],"risk_score":null,"exploitability":null,"weighted_severity":null,"resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-1uv3-mjkz-rkcr"},{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/34990?format=json","vulnerability_id":"VCID-8gxw-hqk5-2uak","summary":"Integer overflow in the ImagingResampleHorizontal function in libImaging/Resample.c in Pillow before 3.1.1 allows remote attackers to have unspecified impact via negative values of the new size, which triggers a heap-based buffer overflow.","references":[{"reference_url":"https://github.com/advisories/GHSA-hvr8-466p-75rh","reference_id":"","reference_type":"","scores":[],"url":"https://github.com/advisories/GHSA-hvr8-466p-75rh"},{"reference_url":"https://github.com/pypa/advisory-database/tree/main/vulns/pillow/PYSEC-2016-7.yaml","reference_id":"","reference_type":"","scores":[],"url":"https://github.com/pypa/advisory-database/tree/main/vulns/pillow/PYSEC-2016-7.yaml"},{"reference_url":"https://github.com/python-pillow/Pillow","reference_id":"","reference_type":"","scores":[],"url":"https://github.com/python-pillow/Pillow"},{"reference_url":"https://github.com/python-pillow/Pillow/blob/c3cb690fed5d4bf0c45576759de55d054916c165/CHANGES.rst","reference_id":"","reference_type":"","scores":[],"url":"https://github.com/python-pillow/Pillow/blob/c3cb690fed5d4bf0c45576759de55d054916c165/CHANGES.rst"},{"reference_url":"https://github.com/python-pillow/Pillow/commit/4e0d9b0b9740d258ade40cce248c93777362ac1e","reference_id":"","reference_type":"","scores":[],"url":"https://github.com/python-pillow/Pillow/commit/4e0d9b0b9740d258ade40cce248c93777362ac1e"},{"reference_url":"https://github.com/python-pillow/Pillow/pull/1714","reference_id":"","reference_type":"","scores":[],"url":"https://github.com/python-pillow/Pillow/pull/1714"},{"reference_url":"https://security.gentoo.org/glsa/201612-52","reference_id":"","reference_type":"","scores":[],"url":"https://security.gentoo.org/glsa/201612-52"},{"reference_url":"http://www.securityfocus.com/bid/86064","reference_id":"","reference_type":"","scores":[],"url":"http://www.securityfocus.com/bid/86064"},{"reference_url":"https://nvd.nist.gov/vuln/detail/CVE-2016-4009","reference_id":"CVE-2016-4009","reference_type":"","scores":[],"url":"https://nvd.nist.gov/vuln/detail/CVE-2016-4009"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/9210?format=json","purl":"pkg:pypi/pillow@3.1.1","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-2gpf-94cu-6fcd"},{"vulnerability":"VCID-3gam-zy4w-2ucr"},{"vulnerability":"VCID-4tub-w66m-uyfu"},{"vulnerability":"VCID-5h45-rcpb-q7bz"},{"vulnerability":"VCID-6qkd-kgxx-dyeq"},{"vulnerability":"VCID-6wqw-esat-2ua2"},{"vulnerability":"VCID-7sps-ppua-ubb2"},{"vulnerability":"VCID-7v6e-3dxw-aubu"},{"vulnerability":"VCID-7ya3-j9fa-zugj"},{"vulnerability":"VCID-8z6g-5td3-g7ej"},{"vulnerability":"VCID-9hza-srk7-sucy"},{"vulnerability":"VCID-9qm6-cbz9-b7c8"},{"vulnerability":"VCID-9v9s-wbu3-cqc7"},{"vulnerability":"VCID-cb58-eehb-j7cv"},{"vulnerability":"VCID-d4dx-wbrv-gqaa"},{"vulnerability":"VCID-dkcx-xcb8-3fgj"},{"vulnerability":"VCID-fq9j-ntxd-t3b3"},{"vulnerability":"VCID-g48w-36yx-tue3"},{"vulnerability":"VCID-gve2-x5zh-gqha"},{"vulnerability":"VCID-htee-x1mv-sfhh"},{"vulnerability":"VCID-jtq6-eykc-ykbz"},{"vulnerability":"VCID-kjxw-f4f4-dydb"},{"vulnerability":"VCID-mph7-qmm8-1fan"},{"vulnerability":"VCID-p66f-cwf8-tfdr"},{"vulnerability":"VCID-prvn-bejg-kufb"},{"vulnerability":"VCID-px2q-ph74-1ue6"},{"vulnerability":"VCID-q8fz-36n2-vfh2"},{"vulnerability":"VCID-qbfa-rky7-juh5"},{"vulnerability":"VCID-qz6s-pjqj-7uet"},{"vulnerability":"VCID-t3rz-wf43-a3bf"},{"vulnerability":"VCID-tcda-8txy-7ygn"},{"vulnerability":"VCID-vx7b-mwfx-5fg2"},{"vulnerability":"VCID-vxtq-wjad-3ue3"},{"vulnerability":"VCID-wfzw-3x26-tucg"},{"vulnerability":"VCID-whh3-qs36-pqfq"},{"vulnerability":"VCID-wuv4-qn69-zygh"},{"vulnerability":"VCID-x3bz-ehvb-jyfs"},{"vulnerability":"VCID-xbur-n6na-d7g1"},{"vulnerability":"VCID-yk5x-nt2m-5kgy"},{"vulnerability":"VCID-zsxq-dasb-qyex"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:pypi/pillow@3.1.1"}],"aliases":["CVE-2016-4009","GHSA-hvr8-466p-75rh","PYSEC-2016-7"],"risk_score":null,"exploitability":null,"weighted_severity":null,"resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-8gxw-hqk5-2uak"},{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/34989?format=json","vulnerability_id":"VCID-hy5d-twhs-e7a3","summary":"Buffer overflow in the ImagingLibTiffDecode function in libImaging/TiffDecode.c in Pillow before 3.1.1 allows remote attackers to overwrite memory via a crafted TIFF file.","references":[{"reference_url":"https://github.com/advisories/GHSA-hggx-3h72-49ww","reference_id":"","reference_type":"","scores":[],"url":"https://github.com/advisories/GHSA-hggx-3h72-49ww"},{"reference_url":"https://github.com/pypa/advisory-database/tree/main/vulns/pillow/PYSEC-2016-5.yaml","reference_id":"","reference_type":"","scores":[],"url":"https://github.com/pypa/advisory-database/tree/main/vulns/pillow/PYSEC-2016-5.yaml"},{"reference_url":"https://github.com/python-pillow/Pillow","reference_id":"","reference_type":"","scores":[],"url":"https://github.com/python-pillow/Pillow"},{"reference_url":"https://github.com/python-pillow/Pillow/blob/c3cb690fed5d4bf0c45576759de55d054916c165/CHANGES.rst","reference_id":"","reference_type":"","scores":[],"url":"https://github.com/python-pillow/Pillow/blob/c3cb690fed5d4bf0c45576759de55d054916c165/CHANGES.rst"},{"reference_url":"https://github.com/python-pillow/Pillow/commit/6dcbf5bd96b717c58d7b642949da8d323099928e","reference_id":"","reference_type":"","scores":[],"url":"https://github.com/python-pillow/Pillow/commit/6dcbf5bd96b717c58d7b642949da8d323099928e"},{"reference_url":"https://security.gentoo.org/glsa/201612-52","reference_id":"","reference_type":"","scores":[],"url":"https://security.gentoo.org/glsa/201612-52"},{"reference_url":"http://www.debian.org/security/2016/dsa-3499","reference_id":"","reference_type":"","scores":[],"url":"http://www.debian.org/security/2016/dsa-3499"},{"reference_url":"https://nvd.nist.gov/vuln/detail/CVE-2016-0740","reference_id":"CVE-2016-0740","reference_type":"","scores":[],"url":"https://nvd.nist.gov/vuln/detail/CVE-2016-0740"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/9210?format=json","purl":"pkg:pypi/pillow@3.1.1","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-2gpf-94cu-6fcd"},{"vulnerability":"VCID-3gam-zy4w-2ucr"},{"vulnerability":"VCID-4tub-w66m-uyfu"},{"vulnerability":"VCID-5h45-rcpb-q7bz"},{"vulnerability":"VCID-6qkd-kgxx-dyeq"},{"vulnerability":"VCID-6wqw-esat-2ua2"},{"vulnerability":"VCID-7sps-ppua-ubb2"},{"vulnerability":"VCID-7v6e-3dxw-aubu"},{"vulnerability":"VCID-7ya3-j9fa-zugj"},{"vulnerability":"VCID-8z6g-5td3-g7ej"},{"vulnerability":"VCID-9hza-srk7-sucy"},{"vulnerability":"VCID-9qm6-cbz9-b7c8"},{"vulnerability":"VCID-9v9s-wbu3-cqc7"},{"vulnerability":"VCID-cb58-eehb-j7cv"},{"vulnerability":"VCID-d4dx-wbrv-gqaa"},{"vulnerability":"VCID-dkcx-xcb8-3fgj"},{"vulnerability":"VCID-fq9j-ntxd-t3b3"},{"vulnerability":"VCID-g48w-36yx-tue3"},{"vulnerability":"VCID-gve2-x5zh-gqha"},{"vulnerability":"VCID-htee-x1mv-sfhh"},{"vulnerability":"VCID-jtq6-eykc-ykbz"},{"vulnerability":"VCID-kjxw-f4f4-dydb"},{"vulnerability":"VCID-mph7-qmm8-1fan"},{"vulnerability":"VCID-p66f-cwf8-tfdr"},{"vulnerability":"VCID-prvn-bejg-kufb"},{"vulnerability":"VCID-px2q-ph74-1ue6"},{"vulnerability":"VCID-q8fz-36n2-vfh2"},{"vulnerability":"VCID-qbfa-rky7-juh5"},{"vulnerability":"VCID-qz6s-pjqj-7uet"},{"vulnerability":"VCID-t3rz-wf43-a3bf"},{"vulnerability":"VCID-tcda-8txy-7ygn"},{"vulnerability":"VCID-vx7b-mwfx-5fg2"},{"vulnerability":"VCID-vxtq-wjad-3ue3"},{"vulnerability":"VCID-wfzw-3x26-tucg"},{"vulnerability":"VCID-whh3-qs36-pqfq"},{"vulnerability":"VCID-wuv4-qn69-zygh"},{"vulnerability":"VCID-x3bz-ehvb-jyfs"},{"vulnerability":"VCID-xbur-n6na-d7g1"},{"vulnerability":"VCID-yk5x-nt2m-5kgy"},{"vulnerability":"VCID-zsxq-dasb-qyex"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:pypi/pillow@3.1.1"}],"aliases":["CVE-2016-0740","GHSA-hggx-3h72-49ww","PYSEC-2016-5"],"risk_score":null,"exploitability":null,"weighted_severity":null,"resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-hy5d-twhs-e7a3"},{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/34993?format=json","vulnerability_id":"VCID-q11v-xn32-auch","summary":"Buffer overflow in the ImagingFliDecode function in libImaging/FliDecode.c in Pillow before 3.1.1 allows remote attackers to cause a denial of service (crash) via a crafted FLI file.","references":[{"reference_url":"https://github.com/advisories/GHSA-8xjv-v9xq-m5h9","reference_id":"","reference_type":"","scores":[],"url":"https://github.com/advisories/GHSA-8xjv-v9xq-m5h9"},{"reference_url":"https://github.com/pypa/advisory-database/tree/main/vulns/pillow/PYSEC-2016-6.yaml","reference_id":"","reference_type":"","scores":[],"url":"https://github.com/pypa/advisory-database/tree/main/vulns/pillow/PYSEC-2016-6.yaml"},{"reference_url":"https://github.com/python-pillow/Pillow","reference_id":"","reference_type":"","scores":[],"url":"https://github.com/python-pillow/Pillow"},{"reference_url":"https://github.com/python-pillow/Pillow/blob/c3cb690fed5d4bf0c45576759de55d054916c165/CHANGES.rst","reference_id":"","reference_type":"","scores":[],"url":"https://github.com/python-pillow/Pillow/blob/c3cb690fed5d4bf0c45576759de55d054916c165/CHANGES.rst"},{"reference_url":"https://github.com/python-pillow/Pillow/commit/893a40850c2d5da41537958e40569c029a6e127b","reference_id":"","reference_type":"","scores":[],"url":"https://github.com/python-pillow/Pillow/commit/893a40850c2d5da41537958e40569c029a6e127b"},{"reference_url":"https://security.gentoo.org/glsa/201612-52","reference_id":"","reference_type":"","scores":[],"url":"https://security.gentoo.org/glsa/201612-52"},{"reference_url":"http://www.debian.org/security/2016/dsa-3499","reference_id":"","reference_type":"","scores":[],"url":"http://www.debian.org/security/2016/dsa-3499"},{"reference_url":"https://nvd.nist.gov/vuln/detail/CVE-2016-0775","reference_id":"CVE-2016-0775","reference_type":"","scores":[],"url":"https://nvd.nist.gov/vuln/detail/CVE-2016-0775"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/9210?format=json","purl":"pkg:pypi/pillow@3.1.1","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-2gpf-94cu-6fcd"},{"vulnerability":"VCID-3gam-zy4w-2ucr"},{"vulnerability":"VCID-4tub-w66m-uyfu"},{"vulnerability":"VCID-5h45-rcpb-q7bz"},{"vulnerability":"VCID-6qkd-kgxx-dyeq"},{"vulnerability":"VCID-6wqw-esat-2ua2"},{"vulnerability":"VCID-7sps-ppua-ubb2"},{"vulnerability":"VCID-7v6e-3dxw-aubu"},{"vulnerability":"VCID-7ya3-j9fa-zugj"},{"vulnerability":"VCID-8z6g-5td3-g7ej"},{"vulnerability":"VCID-9hza-srk7-sucy"},{"vulnerability":"VCID-9qm6-cbz9-b7c8"},{"vulnerability":"VCID-9v9s-wbu3-cqc7"},{"vulnerability":"VCID-cb58-eehb-j7cv"},{"vulnerability":"VCID-d4dx-wbrv-gqaa"},{"vulnerability":"VCID-dkcx-xcb8-3fgj"},{"vulnerability":"VCID-fq9j-ntxd-t3b3"},{"vulnerability":"VCID-g48w-36yx-tue3"},{"vulnerability":"VCID-gve2-x5zh-gqha"},{"vulnerability":"VCID-htee-x1mv-sfhh"},{"vulnerability":"VCID-jtq6-eykc-ykbz"},{"vulnerability":"VCID-kjxw-f4f4-dydb"},{"vulnerability":"VCID-mph7-qmm8-1fan"},{"vulnerability":"VCID-p66f-cwf8-tfdr"},{"vulnerability":"VCID-prvn-bejg-kufb"},{"vulnerability":"VCID-px2q-ph74-1ue6"},{"vulnerability":"VCID-q8fz-36n2-vfh2"},{"vulnerability":"VCID-qbfa-rky7-juh5"},{"vulnerability":"VCID-qz6s-pjqj-7uet"},{"vulnerability":"VCID-t3rz-wf43-a3bf"},{"vulnerability":"VCID-tcda-8txy-7ygn"},{"vulnerability":"VCID-vx7b-mwfx-5fg2"},{"vulnerability":"VCID-vxtq-wjad-3ue3"},{"vulnerability":"VCID-wfzw-3x26-tucg"},{"vulnerability":"VCID-whh3-qs36-pqfq"},{"vulnerability":"VCID-wuv4-qn69-zygh"},{"vulnerability":"VCID-x3bz-ehvb-jyfs"},{"vulnerability":"VCID-xbur-n6na-d7g1"},{"vulnerability":"VCID-yk5x-nt2m-5kgy"},{"vulnerability":"VCID-zsxq-dasb-qyex"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:pypi/pillow@3.1.1"}],"aliases":["CVE-2016-0775","GHSA-8xjv-v9xq-m5h9","PYSEC-2016-6"],"risk_score":null,"exploitability":null,"weighted_severity":null,"resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-q11v-xn32-auch"}],"risk_score":null,"resource_url":"http://public2.vulnerablecode.io/packages/pkg:pypi/pillow@3.1.1"}