Note:
This project will be discontinued after December 13, 2021. [more]
Product:
Pillow
(Python)Repositories |
• https://github.com/python-pillow/Pillow
• https://github.com/python-imaging/Pillow |
#Vulnerabilities | 50 |
Date | Id | Summary | Products | Score | Patch | Annotated |
---|---|---|---|---|---|---|
2020-01-05 | CVE-2019-19911 | There is a DoS vulnerability in Pillow before 6.2.2 caused by FpxImagePlugin.py calling the range function on an unvalidated 32-bit integer if the number of bands is large. On Windows running 32-bit Python, this results in an OverflowError or MemoryError due to the 2 GB limit. However, on Linux running 64-bit Python this results in the process being terminated by the OOM killer. | Ubuntu_linux, Debian_linux, Fedora, Pillow | 7.5 | ||
2021-07-13 | CVE-2021-34552 | Pillow through 8.2.0 and PIL (aka Python Imaging Library) through 1.1.7 allow an attacker to pass controlled parameters directly into a convert function to trigger a buffer overflow in Convert.c. | Debian_linux, Fedora, Pillow | 9.8 | ||
2021-09-03 | CVE-2021-23437 | The package pillow 5.2.0 and before 8.3.2 are vulnerable to Regular Expression Denial of Service (ReDoS) via the getrgb function. | Fedora, Pillow | 7.5 | ||
2022-01-10 | CVE-2022-22815 | path_getbbox in path.c in Pillow before 9.0.0 improperly initializes ImagePath.Path. | Debian_linux, Pillow | 6.5 | ||
2022-01-10 | CVE-2022-22816 | path_getbbox in path.c in Pillow before 9.0.0 has a buffer over-read during initialization of ImagePath.Path. | Debian_linux, Pillow | 6.5 | ||
2022-01-10 | CVE-2022-22817 | PIL.ImageMath.eval in Pillow before 9.0.0 allows evaluation of arbitrary expressions, such as ones that use the Python exec method. A lambda expression could also be used, | Debian_linux, Pillow | 9.8 | ||
2022-03-28 | CVE-2022-24303 | Pillow before 9.0.1 allows attackers to delete files because spaces in temporary pathnames are mishandled. | Fedora, Pillow | 9.1 | ||
2020-01-03 | CVE-2020-5310 | libImaging/TiffDecode.c in Pillow before 6.2.2 has a TIFF decoding integer overflow, related to realloc. | Ubuntu_linux, Fedora, Pillow | 8.8 | ||
2020-01-03 | CVE-2020-5313 | libImaging/FliDecode.c in Pillow before 6.2.2 has an FLI buffer overflow. | Ubuntu_linux, Debian_linux, Fedora, Pillow | 7.1 | ||
2022-11-14 | CVE-2022-45198 | Pillow before 9.2.0 performs Improper Handling of Highly Compressed GIF Data (Data Amplification). | Pillow | 7.5 |