Search for packages
| purl | pkg:pypi/pillow@8.1.1 |
| Vulnerability | Summary | Fixed by |
|---|---|---|
|
VCID-4qfp-jk4u-aaaf
Aliases: GHSA-4fx9-vc88-q2xc GMS-2022-347 |
Infinite loop in Pillow |
Affected by 10 other vulnerabilities. |
|
VCID-5557-vu7d-aaaa
Aliases: CVE-2023-4863 GHSA-j7hp-h8jx-5ppr |
Heap buffer overflow in WebP in Google Chrome prior to 116.0.5845.187 allowed a remote attacker to perform an out of bounds memory write via a crafted HTML page. (Chromium security severity: Critical) |
Affected by 2 other vulnerabilities. |
|
VCID-74p8-mazs-aaae
Aliases: BIT-2022-22816 BIT-pillow-2022-22816 CVE-2022-22816 GHSA-xrcv-f9gm-v42c PYSEC-2022-9 |
path_getbbox in path.c in Pillow before 9.0.0 has a buffer over-read during initialization of ImagePath.Path. |
Affected by 10 other vulnerabilities. |
|
VCID-9rup-wxea-aaab
Aliases: GHSA-56pw-mpj4-fxww GMS-2023-3137 |
Bundled libwebp in Pillow vulnerable |
Affected by 2 other vulnerabilities. |
|
VCID-ar3g-bygk-aaan
Aliases: BIT-2022-22817 BIT-pillow-2022-22817 CVE-2022-22817 GHSA-8vj2-vxx3-667w PYSEC-2022-10 |
PIL.ImageMath.eval in Pillow before 9.0.0 allows evaluation of arbitrary expressions, such as ones that use the Python exec method. A lambda expression could also be used. |
Affected by 10 other vulnerabilities. Affected by 8 other vulnerabilities. |
|
VCID-bnjc-ytj1-aaaq
Aliases: BIT-2021-23437 BIT-pillow-2021-23437 CVE-2021-23437 GHSA-98vv-pw6r-q6q4 PYSEC-2021-317 SNYK-PYTHON-PILLOW-1319443 |
The package pillow 5.2.0 and before 8.3.2 are vulnerable to Regular Expression Denial of Service (ReDoS) via the getrgb function. |
Affected by 13 other vulnerabilities. |
|
VCID-emwt-ezmx-aaap
Aliases: BIT-2021-28677 BIT-pillow-2021-28677 CVE-2021-28677 GHSA-q5hq-fp76-qmrc PYSEC-2021-93 |
An issue was discovered in Pillow before 8.2.0. For EPS data, the readline implementation used in EPSImageFile has to deal with any combination of \r and \n as line endings. It used an accidentally quadratic method of accumulating lines while looking for a line ending. A malicious EPS file could use this to perform a DoS of Pillow in the open phase, before an image was accepted for opening. |
Affected by 15 other vulnerabilities. |
|
VCID-exhd-udnk-aaah
Aliases: BIT-2021-28675 BIT-pillow-2021-28675 CVE-2021-28675 GHSA-g6rj-rv7j-xwp4 PYSEC-2021-139 |
An issue was discovered in Pillow before 8.2.0. PSDImagePlugin.PsdImageFile lacked a sanity check on the number of input layers relative to the size of the data block. This could lead to a DoS on Image.open prior to Image.load. |
Affected by 15 other vulnerabilities. |
|
VCID-frct-6cfh-aaae
Aliases: BIT-2022-24303 BIT-pillow-2022-24303 CVE-2022-24303 GHSA-9j59-75qj-795w GMS-2022-348 PYSEC-2022-168 |
Pillow before 9.0.1 allows attackers to delete files because spaces in temporary pathnames are mishandled. |
Affected by 8 other vulnerabilities. |
|
VCID-fxbu-9mp4-aaap
Aliases: BIT-2022-45199 BIT-pillow-2022-45199 CVE-2022-45199 GHSA-q4mp-jvh2-76fj PYSEC-2022-42980 |
Pillow before 9.3.0 allows denial of service via SAMPLESPERPIXEL. |
Affected by 6 other vulnerabilities. |
|
VCID-htzr-e6cg-aaar
Aliases: BIT-2022-22815 BIT-pillow-2022-22815 CVE-2022-22815 GHSA-pw3c-h7wp-cvhx PYSEC-2022-8 |
path_getbbox in path.c in Pillow before 9.0.0 improperly initializes ImagePath.Path. |
Affected by 10 other vulnerabilities. |
|
VCID-j3u2-u8bx-aaam
Aliases: PYSEC-2023-175 |
Pillow versions before v10.0.1 bundled libwebp binaries in wheels that are vulnerable to CVE-2023-4863. imagecodecs v10.0.1 upgrades the bundled libwebp binary to v1.3.2. |
Affected by 2 other vulnerabilities. |
|
VCID-mwb8-9e71-aaaj
Aliases: BIT-2021-25287 BIT-pillow-2021-25287 CVE-2021-25287 GHSA-77gc-v2xv-rvvh PYSEC-2021-137 |
An issue was discovered in Pillow before 8.2.0. There is an out-of-bounds read in J2kDecode, in j2ku_graya_la. |
Affected by 15 other vulnerabilities. |
|
VCID-nf4x-jfmp-aaak
Aliases: BIT-2021-25288 BIT-pillow-2021-25288 CVE-2021-25288 GHSA-rwv7-3v45-hg29 PYSEC-2021-138 |
An issue was discovered in Pillow before 8.2.0. There is an out-of-bounds read in J2kDecode, in j2ku_gray_i. |
Affected by 15 other vulnerabilities. |
|
VCID-qav5-qfe9-aaan
Aliases: BIT-2021-28678 BIT-pillow-2021-28678 CVE-2021-28678 GHSA-hjfx-8p6c-g7gx PYSEC-2021-94 |
An issue was discovered in Pillow before 8.2.0. For BLP data, BlpImagePlugin did not properly check that reads (after jumping to file offsets) returned data. This could lead to a DoS where the decoder could be run a large number of times on empty data. |
Affected by 15 other vulnerabilities. |
|
VCID-qs47-4gpq-aaas
Aliases: BIT-2021-34552 BIT-pillow-2021-34552 CVE-2021-34552 GHSA-7534-mm45-c74v PYSEC-2021-331 |
Pillow through 8.2.0 and PIL (aka Python Imaging Library) through 1.1.7 allow an attacker to pass controlled parameters directly into a convert function to trigger a buffer overflow in Convert.c. |
Affected by 14 other vulnerabilities. |
|
VCID-rhnd-s6hv-aaar
Aliases: BIT-2022-45198 BIT-pillow-2022-45198 CVE-2022-45198 GHSA-m2vv-5vj5-2hm7 PYSEC-2022-42979 |
Pillow before 9.2.0 performs Improper Handling of Highly Compressed GIF Data (Data Amplification). |
Affected by 7 other vulnerabilities. |
|
VCID-sbr2-5baf-aaaf
Aliases: BIT-2021-25291 BIT-pillow-2021-25291 CVE-2021-25291 GHSA-mvg9-xffr-p774 PYSEC-2021-37 |
An issue was discovered in Pillow before 8.1.1. In TiffDecode.c, there is an out-of-bounds read in TiffreadRGBATile via invalid tile boundaries. |
Affected by 15 other vulnerabilities. |
|
VCID-vyep-db8n-aaar
Aliases: BIT-pillow-2023-44271 CVE-2023-44271 GHSA-8ghj-p4vj-mr35 PYSEC-2023-227 |
An issue was discovered in Pillow before 10.0.0. It is a Denial of Service that uncontrollably allocates memory to process a given task, potentially causing a service to crash by having it run out of memory. This occurs for truetype in ImageFont when textlength in an ImageDraw instance operates on a long text argument. |
Affected by 5 other vulnerabilities. |
|
VCID-ydt8-c1kr-aaak
Aliases: CVE-2023-50447 GHSA-3f63-hfp8-52jq |
Pillow through 10.1.0 allows PIL.ImageMath.eval Arbitrary Code Execution via the environment parameter, a different vulnerability than CVE-2022-22817 (which was about the expression parameter). |
Affected by 1 other vulnerability. |
|
VCID-zbbs-5sps-aaas
Aliases: CVE-2024-28219 GHSA-44wm-f244-xhp3 |
In _imagingcms.c in Pillow before 10.3.0, a buffer overflow exists because strcpy is used instead of strncpy. |
Affected by 0 other vulnerabilities. |
|
VCID-zvvz-7rud-aaae
Aliases: BIT-2021-28676 BIT-pillow-2021-28676 CVE-2021-28676 GHSA-7r7m-5h27-29hp PYSEC-2021-92 |
An issue was discovered in Pillow before 8.2.0. For FLI data, FliDecode did not properly check that the block advance was non-zero, potentially leading to an infinite loop on load. |
Affected by 15 other vulnerabilities. |
| Vulnerability | Summary | Aliases |
|---|---|---|
| VCID-1baj-rk3p-aaae | An issue was discovered in Pillow before 8.1.1. There is an out-of-bounds read in SGIRleDecode.c. |
BIT-2021-25293
BIT-pillow-2021-25293 CVE-2021-25293 GHSA-p43w-g3c5-g5mq PYSEC-2021-39 |
| VCID-86eg-xvug-aaak | Pillow before 8.1.1 allows attackers to cause a denial of service (memory consumption) because the reported size of a contained image is not properly checked for a BLP container, and thus an attempted memory allocation can be very large. |
BIT-2021-27921
BIT-pillow-2021-27921 CVE-2021-27921 GHSA-f4w8-cv6p-x6r5 PYSEC-2021-40 |
| VCID-bfw1-1eep-aaar | Pillow before 8.1.1 allows attackers to cause a denial of service (memory consumption) because the reported size of a contained image is not properly checked for an ICO container, and thus an attempted memory allocation can be very large. |
BIT-2021-27923
BIT-pillow-2021-27923 CVE-2021-27923 GHSA-95q3-8gr9-gm8w PYSEC-2021-42 |
| VCID-bhre-augw-aaaj | An issue was discovered in Pillow before 8.1.1. The PDF parser allows a regular expression DoS (ReDoS) attack via a crafted PDF file because of a catastrophic backtracking regex. |
BIT-2021-25292
BIT-pillow-2021-25292 CVE-2021-25292 GHSA-9hx2-hgq2-2g4f PYSEC-2021-38 |
| VCID-k3wd-4t2r-aaap | Uncontrolled Resource Consumption in pillow ### Impact _Pillow before 8.1.1 allows attackers to cause a denial of service because the reported size of a contained image is not properly checked for a BLP container, and thus an attempted memory allocation can be very large._ ### Patches _An issue was discovered in Pillow before 6.2.0. When reading specially crafted invalid image files, the library can either allocate very large amounts of memory or take an extremely long period of time to process the image._ ### Workarounds _An issue was discovered in Pillow before 6.2.0. When reading specially crafted invalid image files, the library can either allocate very large amounts of memory or take an extremely long period of time to process the image._ ### References https://nvd.nist.gov/vuln/detail/CVE-2021-27921 ### For more information If you have any questions or comments about this advisory: * Open an issue in example link to repo email address] |
GHSA-jgpv-4h4c-xhw3
GMS-2021-167 |
| VCID-mvs4-g3jg-aaaa | An issue was discovered in Pillow before 8.1.1. TiffDecode has a heap-based buffer overflow when decoding crafted YCbCr files because of certain interpretation conflicts with LibTIFF in RGBA mode. NOTE: this issue exists because of an incomplete fix for CVE-2020-35654. |
BIT-2021-25289
BIT-pillow-2021-25289 CVE-2021-25289 GHSA-57h3-9rgr-c24m PYSEC-2021-35 |
| VCID-p4un-9aqj-aaaf | Pillow before 8.1.1 allows attackers to cause a denial of service (memory consumption) because the reported size of a contained image is not properly checked for an ICNS container, and thus an attempted memory allocation can be very large. |
BIT-2021-27922
BIT-pillow-2021-27922 CVE-2021-27922 GHSA-3wvg-mj6g-m9cv PYSEC-2021-41 |
| VCID-sbr2-5baf-aaaf | An issue was discovered in Pillow before 8.1.1. In TiffDecode.c, there is an out-of-bounds read in TiffreadRGBATile via invalid tile boundaries. |
BIT-2021-25291
BIT-pillow-2021-25291 CVE-2021-25291 GHSA-mvg9-xffr-p774 PYSEC-2021-37 |
| VCID-z2ep-c7vk-aaah | An issue was discovered in Pillow before 8.1.1. In TiffDecode.c, there is a negative-offset memcpy with an invalid size. |
BIT-2021-25290
BIT-pillow-2021-25290 CVE-2021-25290 GHSA-8xjq-8fcg-g5hw PYSEC-2021-36 |