VulnerableCode Package Details - pkg:deb/debian/pillow@5.4.1-2%2Bdeb10u3

Vulnerabilities affecting this package (35)

Vulnerability	Summary	Fixed by
VCID-13kb-u1tp-73fu Aliases: BIT-pillow-2021-25288 CVE-2021-25288 GHSA-rwv7-3v45-hg29 PYSEC-2021-138	An issue was discovered in Pillow before 8.2.0. There is an out-of-bounds read in J2kDecode, in j2ku_gray_i.	8.1.2+dfsg-0.3+deb11u2 Affected by 3 other vulnerabilities. This version is affected by these other vulnerabilities: {{ fixed_by_vuln.vulnerability_id }} {{ fixed_by_vuln.vulnerability_id }} {{ fixed_by_vuln.vulnerability_id }}
VCID-1zmn-5zx3-2kab Aliases: BIT-pillow-2021-27923 CVE-2021-27923 GHSA-95q3-8gr9-gm8w PYSEC-2021-42	Pillow before 8.1.1 allows attackers to cause a denial of service (memory consumption) because the reported size of a contained image is not properly checked for an ICO container, and thus an attempted memory allocation can be very large.	8.1.2+dfsg-0.3+deb11u2 Affected by 3 other vulnerabilities. This version is affected by these other vulnerabilities: {{ fixed_by_vuln.vulnerability_id }} {{ fixed_by_vuln.vulnerability_id }} {{ fixed_by_vuln.vulnerability_id }}
VCID-22vm-fpzm-hkep Aliases: BIT-pillow-2021-27921 CVE-2021-27921 GHSA-f4w8-cv6p-x6r5 PYSEC-2021-40	Pillow before 8.1.1 allows attackers to cause a denial of service (memory consumption) because the reported size of a contained image is not properly checked for a BLP container, and thus an attempted memory allocation can be very large.	8.1.2+dfsg-0.3+deb11u2 Affected by 3 other vulnerabilities. This version is affected by these other vulnerabilities: {{ fixed_by_vuln.vulnerability_id }} {{ fixed_by_vuln.vulnerability_id }} {{ fixed_by_vuln.vulnerability_id }}
VCID-5wm9-zath-x7dy Aliases: CVE-2019-19911 GHSA-5gm3-px64-rw72 PYSEC-2020-172	There is a DoS vulnerability in Pillow before 6.2.2 caused by FpxImagePlugin.py calling the range function on an unvalidated 32-bit integer if the number of bands is large. On Windows running 32-bit Python, this results in an OverflowError or MemoryError due to the 2 GB limit. However, on Linux running 64-bit Python this results in the process being terminated by the OOM killer.	8.1.2+dfsg-0.3+deb11u2 Affected by 3 other vulnerabilities. This version is affected by these other vulnerabilities: {{ fixed_by_vuln.vulnerability_id }} {{ fixed_by_vuln.vulnerability_id }} {{ fixed_by_vuln.vulnerability_id }}
VCID-7jch-5hxc-6ufk Aliases: CVE-2019-16865 GHSA-j7mj-748x-7p78 PYSEC-2019-110	An issue was discovered in Pillow before 6.2.0. When reading specially crafted invalid image files, the library can either allocate very large amounts of memory or take an extremely long period of time to process the image.	8.1.2+dfsg-0.3+deb11u2 Affected by 3 other vulnerabilities. This version is affected by these other vulnerabilities: {{ fixed_by_vuln.vulnerability_id }} {{ fixed_by_vuln.vulnerability_id }} {{ fixed_by_vuln.vulnerability_id }}
VCID-8u3x-uhum-dbdz Aliases: BIT-pillow-2022-22817 CVE-2022-22817 GHSA-8vj2-vxx3-667w PYSEC-2022-10	PIL.ImageMath.eval in Pillow before 9.0.0 allows evaluation of arbitrary expressions, such as ones that use the Python exec method.	8.1.2+dfsg-0.3+deb11u2 Affected by 3 other vulnerabilities. This version is affected by these other vulnerabilities: {{ fixed_by_vuln.vulnerability_id }} {{ fixed_by_vuln.vulnerability_id }} {{ fixed_by_vuln.vulnerability_id }}
VCID-9qhg-wthd-2feb Aliases: BIT-pillow-2022-22815 CVE-2022-22815 GHSA-pw3c-h7wp-cvhx PYSEC-2022-8	path_getbbox in path.c in Pillow before 9.0.0 improperly initializes ImagePath.Path.	8.1.2+dfsg-0.3+deb11u2 Affected by 3 other vulnerabilities. This version is affected by these other vulnerabilities: {{ fixed_by_vuln.vulnerability_id }} {{ fixed_by_vuln.vulnerability_id }} {{ fixed_by_vuln.vulnerability_id }}
VCID-b21b-ucpb-pbbv Aliases: BIT-pillow-2021-28675 CVE-2021-28675 GHSA-g6rj-rv7j-xwp4 PYSEC-2021-139	An issue was discovered in Pillow before 8.2.0. PSDImagePlugin.PsdImageFile lacked a sanity check on the number of input layers relative to the size of the data block. This could lead to a DoS on Image.open prior to Image.load.	8.1.2+dfsg-0.3+deb11u2 Affected by 3 other vulnerabilities. This version is affected by these other vulnerabilities: {{ fixed_by_vuln.vulnerability_id }} {{ fixed_by_vuln.vulnerability_id }} {{ fixed_by_vuln.vulnerability_id }}
VCID-beyg-bzsk-h7dd Aliases: BIT-pillow-2020-5312 CVE-2020-5312 GHSA-p49h-hjvm-jg3h PYSEC-2020-83	libImaging/PcxDecode.c in Pillow before 6.2.2 has a PCX P mode buffer overflow.	8.1.2+dfsg-0.3+deb11u2 Affected by 3 other vulnerabilities. This version is affected by these other vulnerabilities: {{ fixed_by_vuln.vulnerability_id }} {{ fixed_by_vuln.vulnerability_id }} {{ fixed_by_vuln.vulnerability_id }}
VCID-cpms-qu5p-bffb Aliases: BIT-pillow-2020-35653 CVE-2020-35653 GHSA-f5g8-5qq7-938w PYSEC-2021-69	In Pillow before 8.1.0, PcxDecode has a buffer over-read when decoding a crafted PCX file because the user-supplied stride value is trusted for buffer calculations.	8.1.2+dfsg-0.3+deb11u2 Affected by 3 other vulnerabilities. This version is affected by these other vulnerabilities: {{ fixed_by_vuln.vulnerability_id }} {{ fixed_by_vuln.vulnerability_id }} {{ fixed_by_vuln.vulnerability_id }}
VCID-dhhz-5aav-m7am Aliases: BIT-pillow-2020-35654 CVE-2020-35654 GHSA-vqcj-wrf2-7v73 PYSEC-2021-70	In Pillow before 8.1.0, TiffDecode has a heap-based buffer overflow when decoding crafted YCbCr files because of certain interpretation conflicts with LibTIFF in RGBA mode.	8.1.2+dfsg-0.3+deb11u2 Affected by 3 other vulnerabilities. This version is affected by these other vulnerabilities: {{ fixed_by_vuln.vulnerability_id }} {{ fixed_by_vuln.vulnerability_id }} {{ fixed_by_vuln.vulnerability_id }}
VCID-e4yx-7np3-j7cg Aliases: BIT-pillow-2021-25291 CVE-2021-25291 GHSA-mvg9-xffr-p774 PYSEC-2021-37	An issue was discovered in Pillow before 8.1.1. In TiffDecode.c, there is an out-of-bounds read in TiffreadRGBATile via invalid tile boundaries.	8.1.2+dfsg-0.3+deb11u2 Affected by 3 other vulnerabilities. This version is affected by these other vulnerabilities: {{ fixed_by_vuln.vulnerability_id }} {{ fixed_by_vuln.vulnerability_id }} {{ fixed_by_vuln.vulnerability_id }}
VCID-e51c-zvqh-bbdk Aliases: BIT-pillow-2021-25290 CVE-2021-25290 GHSA-8xjq-8fcg-g5hw PYSEC-2021-36	An issue was discovered in Pillow before 8.1.1. In TiffDecode.c, there is a negative-offset memcpy with an invalid size.	8.1.2+dfsg-0.3+deb11u2 Affected by 3 other vulnerabilities. This version is affected by these other vulnerabilities: {{ fixed_by_vuln.vulnerability_id }} {{ fixed_by_vuln.vulnerability_id }} {{ fixed_by_vuln.vulnerability_id }}
VCID-egyy-erjx-tuey Aliases: BIT-pillow-2021-25289 CVE-2021-25289 GHSA-57h3-9rgr-c24m PYSEC-2021-35	An issue was discovered in Pillow before 8.1.1. TiffDecode has a heap-based buffer overflow when decoding crafted YCbCr files because of certain interpretation conflicts with LibTIFF in RGBA mode. NOTE: this issue exists because of an incomplete fix for CVE-2020-35654.	8.1.2+dfsg-0.3+deb11u2 Affected by 3 other vulnerabilities. This version is affected by these other vulnerabilities: {{ fixed_by_vuln.vulnerability_id }} {{ fixed_by_vuln.vulnerability_id }} {{ fixed_by_vuln.vulnerability_id }}
VCID-gezp-xc9s-6fhd Aliases: BIT-pillow-2021-28678 CVE-2021-28678 GHSA-hjfx-8p6c-g7gx PYSEC-2021-94	An issue was discovered in Pillow before 8.2.0. For BLP data, BlpImagePlugin did not properly check that reads (after jumping to file offsets) returned data. This could lead to a DoS where the decoder could be run a large number of times on empty data.	8.1.2+dfsg-0.3+deb11u2 Affected by 3 other vulnerabilities. This version is affected by these other vulnerabilities: {{ fixed_by_vuln.vulnerability_id }} {{ fixed_by_vuln.vulnerability_id }} {{ fixed_by_vuln.vulnerability_id }}
VCID-j4bx-8hbu-n3cp Aliases: CVE-2023-50447 GHSA-3f63-hfp8-52jq	Arbitrary Code Execution in Pillow Pillow through 10.1.0 allows PIL.ImageMath.eval Arbitrary Code Execution via the environment parameter, a different vulnerability than CVE-2022-22817 (which was about the expression parameter).	8.1.2+dfsg-0.3+deb11u2 Affected by 3 other vulnerabilities. This version is affected by these other vulnerabilities: {{ fixed_by_vuln.vulnerability_id }} {{ fixed_by_vuln.vulnerability_id }} {{ fixed_by_vuln.vulnerability_id }}
VCID-jqw6-pxaj-mkcg Aliases: BIT-pillow-2021-28676 CVE-2021-28676 GHSA-7r7m-5h27-29hp PYSEC-2021-92	An issue was discovered in Pillow before 8.2.0. For FLI data, FliDecode did not properly check that the block advance was non-zero, potentially leading to an infinite loop on load.	8.1.2+dfsg-0.3+deb11u2 Affected by 3 other vulnerabilities. This version is affected by these other vulnerabilities: {{ fixed_by_vuln.vulnerability_id }} {{ fixed_by_vuln.vulnerability_id }} {{ fixed_by_vuln.vulnerability_id }}
VCID-jwr6-nxcq-cfaz Aliases: BIT-pillow-2020-10177 CVE-2020-10177 GHSA-cqhg-xjhh-p8hf PYSEC-2020-76	Pillow before 7.1.0 has multiple out-of-bounds reads in libImaging/FliDecode.c.	8.1.2+dfsg-0.3+deb11u2 Affected by 3 other vulnerabilities. This version is affected by these other vulnerabilities: {{ fixed_by_vuln.vulnerability_id }} {{ fixed_by_vuln.vulnerability_id }} {{ fixed_by_vuln.vulnerability_id }}
VCID-mrgz-udvr-xfcy Aliases: BIT-pillow-2021-34552 CVE-2021-34552 GHSA-7534-mm45-c74v PYSEC-2021-331	Pillow through 8.2.0 and PIL (aka Python Imaging Library) through 1.1.7 allow an attacker to pass controlled parameters directly into a convert function to trigger a buffer overflow in Convert.c.	8.1.2+dfsg-0.3+deb11u2 Affected by 3 other vulnerabilities. This version is affected by these other vulnerabilities: {{ fixed_by_vuln.vulnerability_id }} {{ fixed_by_vuln.vulnerability_id }} {{ fixed_by_vuln.vulnerability_id }}
VCID-ndu9-a6dm-c7hk Aliases: BIT-pillow-2021-25293 CVE-2021-25293 GHSA-p43w-g3c5-g5mq PYSEC-2021-39	An issue was discovered in Pillow before 8.1.1. There is an out-of-bounds read in SGIRleDecode.c.	8.1.2+dfsg-0.3+deb11u2 Affected by 3 other vulnerabilities. This version is affected by these other vulnerabilities: {{ fixed_by_vuln.vulnerability_id }} {{ fixed_by_vuln.vulnerability_id }} {{ fixed_by_vuln.vulnerability_id }}
VCID-qa59-e7mz-tuah Aliases: BIT-pillow-2022-22816 CVE-2022-22816 GHSA-xrcv-f9gm-v42c PYSEC-2022-9	path_getbbox in path.c in Pillow before 9.0.0 has a buffer over-read during initialization of ImagePath.Path.	8.1.2+dfsg-0.3+deb11u2 Affected by 3 other vulnerabilities. This version is affected by these other vulnerabilities: {{ fixed_by_vuln.vulnerability_id }} {{ fixed_by_vuln.vulnerability_id }} {{ fixed_by_vuln.vulnerability_id }}
VCID-qdgq-uetp-huet Aliases: BIT-pillow-2020-10378 CVE-2020-10378 GHSA-3xv8-3j54-hgrp PYSEC-2020-77	In libImaging/PcxDecode.c in Pillow before 7.1.0, an out-of-bounds read can occur when reading PCX files where state->shuffle is instructed to read beyond state->buffer.	8.1.2+dfsg-0.3+deb11u2 Affected by 3 other vulnerabilities. This version is affected by these other vulnerabilities: {{ fixed_by_vuln.vulnerability_id }} {{ fixed_by_vuln.vulnerability_id }} {{ fixed_by_vuln.vulnerability_id }}
VCID-qg7c-edaa-jqfp Aliases: BIT-pillow-2021-28677 CVE-2021-28677 GHSA-q5hq-fp76-qmrc PYSEC-2021-93	An issue was discovered in Pillow before 8.2.0. For EPS data, the readline implementation used in EPSImageFile has to deal with any combination of \r and \n as line endings. It used an accidentally quadratic method of accumulating lines while looking for a line ending. A malicious EPS file could use this to perform a DoS of Pillow in the open phase, before an image was accepted for opening.	8.1.2+dfsg-0.3+deb11u2 Affected by 3 other vulnerabilities. This version is affected by these other vulnerabilities: {{ fixed_by_vuln.vulnerability_id }} {{ fixed_by_vuln.vulnerability_id }} {{ fixed_by_vuln.vulnerability_id }}
VCID-t423-5mrd-zfgc Aliases: BIT-pillow-2020-35655 CVE-2020-35655 GHSA-hf64-x4gq-p99h PYSEC-2021-71	In Pillow before 8.1.0, SGIRleDecode has a 4-byte buffer over-read when decoding crafted SGI RLE image files because offsets and length tables are mishandled.	8.1.2+dfsg-0.3+deb11u2 Affected by 3 other vulnerabilities. This version is affected by these other vulnerabilities: {{ fixed_by_vuln.vulnerability_id }} {{ fixed_by_vuln.vulnerability_id }} {{ fixed_by_vuln.vulnerability_id }}
VCID-tcp3-b9dq-xkbf Aliases: BIT-pillow-2020-10994 CVE-2020-10994 GHSA-vj42-xq3r-hr3r PYSEC-2020-79	In libImaging/Jpeg2KDecode.c in Pillow before 7.1.0, there are multiple out-of-bounds reads via a crafted JP2 file.	8.1.2+dfsg-0.3+deb11u2 Affected by 3 other vulnerabilities. This version is affected by these other vulnerabilities: {{ fixed_by_vuln.vulnerability_id }} {{ fixed_by_vuln.vulnerability_id }} {{ fixed_by_vuln.vulnerability_id }}
VCID-u2tx-1zrw-e3d1 Aliases: BIT-pillow-2020-11538 CVE-2020-11538 GHSA-43fq-w8qq-v88h PYSEC-2020-80	In libImaging/SgiRleDecode.c in Pillow through 7.0.0, a number of out-of-bounds reads exist in the parsing of SGI image files, a different issue than CVE-2020-5311.	8.1.2+dfsg-0.3+deb11u2 Affected by 3 other vulnerabilities. This version is affected by these other vulnerabilities: {{ fixed_by_vuln.vulnerability_id }} {{ fixed_by_vuln.vulnerability_id }} {{ fixed_by_vuln.vulnerability_id }}
VCID-u6sh-ntun-7ybj Aliases: BIT-pillow-2020-5313 CVE-2020-5313 GHSA-hj69-c76v-86wr PYSEC-2020-84	libImaging/FliDecode.c in Pillow before 6.2.2 has an FLI buffer overflow.	8.1.2+dfsg-0.3+deb11u2 Affected by 3 other vulnerabilities. This version is affected by these other vulnerabilities: {{ fixed_by_vuln.vulnerability_id }} {{ fixed_by_vuln.vulnerability_id }} {{ fixed_by_vuln.vulnerability_id }}
VCID-uhhx-w7hq-7faz Aliases: BIT-pillow-2020-10379 CVE-2020-10379 GHSA-8843-m7mw-mxqm PYSEC-2020-78	In Pillow before 7.1.0, there are two Buffer Overflows in libImaging/TiffDecode.c.	8.1.2+dfsg-0.3+deb11u2 Affected by 3 other vulnerabilities. This version is affected by these other vulnerabilities: {{ fixed_by_vuln.vulnerability_id }} {{ fixed_by_vuln.vulnerability_id }} {{ fixed_by_vuln.vulnerability_id }}
VCID-v8cj-pcn6-juff Aliases: BIT-pillow-2023-44271 CVE-2023-44271 GHSA-8ghj-p4vj-mr35 PYSEC-2023-227	An issue was discovered in Pillow before 10.0.0. It is a Denial of Service that uncontrollably allocates memory to process a given task, potentially causing a service to crash by having it run out of memory. This occurs for truetype in ImageFont when textlength in an ImageDraw instance operates on a long text argument.	8.1.2+dfsg-0.3+deb11u2 Affected by 3 other vulnerabilities. This version is affected by these other vulnerabilities: {{ fixed_by_vuln.vulnerability_id }} {{ fixed_by_vuln.vulnerability_id }} {{ fixed_by_vuln.vulnerability_id }}
VCID-x9n2-jz5u-n7b5 Aliases: BIT-pillow-2021-25292 CVE-2021-25292 GHSA-9hx2-hgq2-2g4f PYSEC-2021-38	An issue was discovered in Pillow before 8.1.1. The PDF parser allows a regular expression DoS (ReDoS) attack via a crafted PDF file because of a catastrophic backtracking regex.	8.1.2+dfsg-0.3+deb11u2 Affected by 3 other vulnerabilities. This version is affected by these other vulnerabilities: {{ fixed_by_vuln.vulnerability_id }} {{ fixed_by_vuln.vulnerability_id }} {{ fixed_by_vuln.vulnerability_id }}
VCID-xxem-11vz-akfc Aliases: BIT-pillow-2021-27922 CVE-2021-27922 GHSA-3wvg-mj6g-m9cv PYSEC-2021-41	Pillow before 8.1.1 allows attackers to cause a denial of service (memory consumption) because the reported size of a contained image is not properly checked for an ICNS container, and thus an attempted memory allocation can be very large.	8.1.2+dfsg-0.3+deb11u2 Affected by 3 other vulnerabilities. This version is affected by these other vulnerabilities: {{ fixed_by_vuln.vulnerability_id }} {{ fixed_by_vuln.vulnerability_id }} {{ fixed_by_vuln.vulnerability_id }}
VCID-yc15-m42h-quhg Aliases: CVE-2024-28219 GHSA-44wm-f244-xhp3	Pillow buffer overflow vulnerability In _imagingcms.c in Pillow before 10.3.0, a buffer overflow exists because strcpy is used instead of strncpy.	8.1.2+dfsg-0.3+deb11u2 Affected by 3 other vulnerabilities. This version is affected by these other vulnerabilities: {{ fixed_by_vuln.vulnerability_id }} {{ fixed_by_vuln.vulnerability_id }} {{ fixed_by_vuln.vulnerability_id }}
VCID-ygd3-7jsw-3bcm Aliases: BIT-pillow-2020-5311 CVE-2020-5311 GHSA-r7rm-8j6h-r933 PYSEC-2020-82	libImaging/SgiRleDecode.c in Pillow before 6.2.2 has an SGI buffer overflow.	8.1.2+dfsg-0.3+deb11u2 Affected by 3 other vulnerabilities. This version is affected by these other vulnerabilities: {{ fixed_by_vuln.vulnerability_id }} {{ fixed_by_vuln.vulnerability_id }} {{ fixed_by_vuln.vulnerability_id }}
VCID-zkmc-8kzj-hqa4 Aliases: BIT-pillow-2021-25287 CVE-2021-25287 GHSA-77gc-v2xv-rvvh PYSEC-2021-137	An issue was discovered in Pillow before 8.2.0. There is an out-of-bounds read in J2kDecode, in j2ku_graya_la.	8.1.2+dfsg-0.3+deb11u2 Affected by 3 other vulnerabilities. This version is affected by these other vulnerabilities: {{ fixed_by_vuln.vulnerability_id }} {{ fixed_by_vuln.vulnerability_id }} {{ fixed_by_vuln.vulnerability_id }}
VCID-zv8x-5snd-f3e3 Aliases: BIT-pillow-2020-5310 CVE-2020-5310 GHSA-vcqg-3p29-xw73 PYSEC-2020-81	libImaging/TiffDecode.c in Pillow before 6.2.2 has a TIFF decoding integer overflow, related to realloc.	8.1.2+dfsg-0.3+deb11u2 Affected by 3 other vulnerabilities. This version is affected by these other vulnerabilities: {{ fixed_by_vuln.vulnerability_id }} {{ fixed_by_vuln.vulnerability_id }} {{ fixed_by_vuln.vulnerability_id }}

Next non-vulnerable version	9.4.0-1.1+deb12u1
Latest non-vulnerable version	9.4.0-1.1+deb12u1
Risk	4.5

Date	Actor	Action	Vulnerability	Source	VulnerableCode Version
2025-08-01T19:31:52.416661+00:00	Debian Oval Importer	Affected by	VCID-dhhz-5aav-m7am	https://www.debian.org/security/oval/oval-definitions-bullseye.xml.bz2	37.0.0
2025-08-01T19:30:54.674019+00:00	Debian Oval Importer	Affected by	VCID-tcp3-b9dq-xkbf	https://www.debian.org/security/oval/oval-definitions-bullseye.xml.bz2	37.0.0
2025-08-01T19:27:53.659972+00:00	Debian Oval Importer	Affected by	VCID-jqw6-pxaj-mkcg	https://www.debian.org/security/oval/oval-definitions-bullseye.xml.bz2	37.0.0
2025-08-01T19:26:38.006816+00:00	Debian Oval Importer	Affected by	VCID-ygd3-7jsw-3bcm	https://www.debian.org/security/oval/oval-definitions-bullseye.xml.bz2	37.0.0
2025-08-01T19:26:22.708054+00:00	Debian Oval Importer	Affected by	VCID-7jch-5hxc-6ufk	https://www.debian.org/security/oval/oval-definitions-bullseye.xml.bz2	37.0.0
2025-08-01T19:19:31.335680+00:00	Debian Oval Importer	Affected by	VCID-qg7c-edaa-jqfp	https://www.debian.org/security/oval/oval-definitions-bullseye.xml.bz2	37.0.0
2025-08-01T19:03:29.768843+00:00	Debian Oval Importer	Affected by	VCID-u6sh-ntun-7ybj	https://www.debian.org/security/oval/oval-definitions-bullseye.xml.bz2	37.0.0
2025-08-01T18:10:24.780217+00:00	Debian Oval Importer	Affected by	VCID-13kb-u1tp-73fu	https://www.debian.org/security/oval/oval-definitions-bullseye.xml.bz2	37.0.0
2025-08-01T17:54:20.218124+00:00	Debian Oval Importer	Affected by	VCID-qdgq-uetp-huet	https://www.debian.org/security/oval/oval-definitions-bullseye.xml.bz2	37.0.0
2025-08-01T17:12:47.291329+00:00	Debian Oval Importer	Affected by	VCID-e51c-zvqh-bbdk	https://www.debian.org/security/oval/oval-definitions-bullseye.xml.bz2	37.0.0
2025-08-01T17:08:07.840869+00:00	Debian Oval Importer	Affected by	VCID-1zmn-5zx3-2kab	https://www.debian.org/security/oval/oval-definitions-bullseye.xml.bz2	37.0.0
2025-08-01T16:48:33.124289+00:00	Debian Oval Importer	Affected by	VCID-uhhx-w7hq-7faz	https://www.debian.org/security/oval/oval-definitions-bullseye.xml.bz2	37.0.0
2025-08-01T16:20:21.940213+00:00	Debian Oval Importer	Affected by	VCID-x9n2-jz5u-n7b5	https://www.debian.org/security/oval/oval-definitions-bullseye.xml.bz2	37.0.0
2025-08-01T16:14:49.222797+00:00	Debian Oval Importer	Affected by	VCID-beyg-bzsk-h7dd	https://www.debian.org/security/oval/oval-definitions-bullseye.xml.bz2	37.0.0
2025-08-01T15:43:02.571470+00:00	Debian Oval Importer	Affected by	VCID-yc15-m42h-quhg	https://www.debian.org/security/oval/oval-definitions-bullseye.xml.bz2	37.0.0
2025-08-01T15:17:52.820724+00:00	Debian Oval Importer	Affected by	VCID-t423-5mrd-zfgc	https://www.debian.org/security/oval/oval-definitions-bullseye.xml.bz2	37.0.0
2025-08-01T15:02:50.257264+00:00	Debian Oval Importer	Affected by	VCID-gezp-xc9s-6fhd	https://www.debian.org/security/oval/oval-definitions-bullseye.xml.bz2	37.0.0
2025-08-01T14:42:01.833150+00:00	Debian Oval Importer	Affected by	VCID-22vm-fpzm-hkep	https://www.debian.org/security/oval/oval-definitions-bullseye.xml.bz2	37.0.0
2025-08-01T14:31:47.240338+00:00	Debian Oval Importer	Affected by	VCID-xxem-11vz-akfc	https://www.debian.org/security/oval/oval-definitions-bullseye.xml.bz2	37.0.0
2025-08-01T14:27:30.957924+00:00	Debian Oval Importer	Affected by	VCID-cpms-qu5p-bffb	https://www.debian.org/security/oval/oval-definitions-bullseye.xml.bz2	37.0.0
2025-08-01T14:14:29.080158+00:00	Debian Oval Importer	Affected by	VCID-5wm9-zath-x7dy	https://www.debian.org/security/oval/oval-definitions-bullseye.xml.bz2	37.0.0
2025-08-01T14:11:44.408957+00:00	Debian Oval Importer	Affected by	VCID-zv8x-5snd-f3e3	https://www.debian.org/security/oval/oval-definitions-bullseye.xml.bz2	37.0.0
2025-08-01T13:55:40.571982+00:00	Debian Oval Importer	Affected by	VCID-v8cj-pcn6-juff	https://www.debian.org/security/oval/oval-definitions-bullseye.xml.bz2	37.0.0
2025-08-01T13:54:39.181700+00:00	Debian Oval Importer	Affected by	VCID-ndu9-a6dm-c7hk	https://www.debian.org/security/oval/oval-definitions-bullseye.xml.bz2	37.0.0
2025-08-01T13:26:51.841202+00:00	Debian Oval Importer	Affected by	VCID-qa59-e7mz-tuah	https://www.debian.org/security/oval/oval-definitions-bullseye.xml.bz2	37.0.0
2025-08-01T13:24:46.930311+00:00	Debian Oval Importer	Affected by	VCID-9qhg-wthd-2feb	https://www.debian.org/security/oval/oval-definitions-bullseye.xml.bz2	37.0.0
2025-08-01T13:16:26.177199+00:00	Debian Oval Importer	Affected by	VCID-zkmc-8kzj-hqa4	https://www.debian.org/security/oval/oval-definitions-bullseye.xml.bz2	37.0.0
2025-08-01T13:08:35.688926+00:00	Debian Oval Importer	Affected by	VCID-mrgz-udvr-xfcy	https://www.debian.org/security/oval/oval-definitions-bullseye.xml.bz2	37.0.0
2025-08-01T13:04:26.613466+00:00	Debian Oval Importer	Affected by	VCID-8u3x-uhum-dbdz	https://www.debian.org/security/oval/oval-definitions-bullseye.xml.bz2	37.0.0
2025-08-01T12:17:37.493055+00:00	Debian Oval Importer	Affected by	VCID-e4yx-7np3-j7cg	https://www.debian.org/security/oval/oval-definitions-bullseye.xml.bz2	37.0.0
2025-08-01T12:11:32.249072+00:00	Debian Oval Importer	Affected by	VCID-egyy-erjx-tuey	https://www.debian.org/security/oval/oval-definitions-bullseye.xml.bz2	37.0.0
2025-08-01T12:10:26.323777+00:00	Debian Oval Importer	Affected by	VCID-u2tx-1zrw-e3d1	https://www.debian.org/security/oval/oval-definitions-bullseye.xml.bz2	37.0.0
2025-08-01T12:09:19.332033+00:00	Debian Oval Importer	Affected by	VCID-b21b-ucpb-pbbv	https://www.debian.org/security/oval/oval-definitions-bullseye.xml.bz2	37.0.0
2025-08-01T12:05:58.835869+00:00	Debian Oval Importer	Affected by	VCID-jwr6-nxcq-cfaz	https://www.debian.org/security/oval/oval-definitions-bullseye.xml.bz2	37.0.0
2025-08-01T11:52:19.162094+00:00	Debian Oval Importer	Affected by	VCID-j4bx-8hbu-n3cp	https://www.debian.org/security/oval/oval-definitions-bullseye.xml.bz2	37.0.0
2025-08-01T11:47:34.646011+00:00	Debian Oval Importer	Fixing	VCID-5wm9-zath-x7dy	https://www.debian.org/security/oval/oval-definitions-buster.xml.bz2	37.0.0
2025-08-01T11:43:30.453985+00:00	Debian Oval Importer	Fixing	VCID-9qhg-wthd-2feb	https://www.debian.org/security/oval/oval-definitions-buster.xml.bz2	37.0.0
2025-08-01T11:33:08.198578+00:00	Debian Oval Importer	Fixing	VCID-qa59-e7mz-tuah	https://www.debian.org/security/oval/oval-definitions-buster.xml.bz2	37.0.0
2025-08-01T11:22:27.178280+00:00	Debian Oval Importer	Fixing	VCID-beyg-bzsk-h7dd	https://www.debian.org/security/oval/oval-definitions-buster.xml.bz2	37.0.0
2025-08-01T11:20:02.321558+00:00	Debian Oval Importer	Fixing	VCID-8u3x-uhum-dbdz	https://www.debian.org/security/oval/oval-definitions-buster.xml.bz2	37.0.0
2025-08-01T11:18:23.380757+00:00	Debian Oval Importer	Fixing	VCID-u6sh-ntun-7ybj	https://www.debian.org/security/oval/oval-definitions-buster.xml.bz2	37.0.0

Vulnerability	Summary	Aliases
VCID-5wm9-zath-x7dy	There is a DoS vulnerability in Pillow before 6.2.2 caused by FpxImagePlugin.py calling the range function on an unvalidated 32-bit integer if the number of bands is large. On Windows running 32-bit Python, this results in an OverflowError or MemoryError due to the 2 GB limit. However, on Linux running 64-bit Python this results in the process being terminated by the OOM killer.	CVE-2019-19911 GHSA-5gm3-px64-rw72 PYSEC-2020-172
VCID-8u3x-uhum-dbdz	PIL.ImageMath.eval in Pillow before 9.0.0 allows evaluation of arbitrary expressions, such as ones that use the Python exec method.	BIT-pillow-2022-22817 CVE-2022-22817 GHSA-8vj2-vxx3-667w PYSEC-2022-10
VCID-9qhg-wthd-2feb	path_getbbox in path.c in Pillow before 9.0.0 improperly initializes ImagePath.Path.	BIT-pillow-2022-22815 CVE-2022-22815 GHSA-pw3c-h7wp-cvhx PYSEC-2022-8
VCID-beyg-bzsk-h7dd	libImaging/PcxDecode.c in Pillow before 6.2.2 has a PCX P mode buffer overflow.	BIT-pillow-2020-5312 CVE-2020-5312 GHSA-p49h-hjvm-jg3h PYSEC-2020-83
VCID-qa59-e7mz-tuah	path_getbbox in path.c in Pillow before 9.0.0 has a buffer over-read during initialization of ImagePath.Path.	BIT-pillow-2022-22816 CVE-2022-22816 GHSA-xrcv-f9gm-v42c PYSEC-2022-9
VCID-u6sh-ntun-7ybj	libImaging/FliDecode.c in Pillow before 6.2.2 has an FLI buffer overflow.	BIT-pillow-2020-5313 CVE-2020-5313 GHSA-hj69-c76v-86wr PYSEC-2020-84