Update dependency pillow to v10 [SECURITY]

[renovate]

ℹ️ Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package	Change	Age	Confidence
pillow (changelog)	==7.2.0 → ==10.3.0

---

Pillow Out-of-bounds Write

CVE-2020-35654 / GHSA-vqcj-wrf2-7v73

More information

Details

In Pillow before 8.1.0, TiffDecode has a heap-based buffer overflow when decoding crafted YCbCr files because of certain interpretation conflicts with LibTIFF in RGBA mode.

Severity

• CVSS Score: 8.6 / 10 (High)
• Vector String: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

References

• https://nvd.nist.gov/vuln/detail/CVE-2020-35654
• https://pillow.readthedocs.io/en/stable/releasenotes/index.html
• https://github.com/python-pillow/Pillow/commit/eb8c1206d6b170d4e798a00db7432e023853da5c
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6BYVI5G44MRIPERKYDQEL3S3YQCZTVHE
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/BF553AMNNNBW7SH4IM4MNE4M6GNZQ7YD
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/TQQY6472RX4J2SUJENWDZAWKTJJGP2ML
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZTSY25UJU7NJUFHH3HWT575LT4TDFWBZ
• https://github.com/advisories/GHSA-vqcj-wrf2-7v73
• https://github.com/pypa/advisory-database/tree/main/vulns/pillow/PYSEC-2021-70.yaml

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

Regular Expression Denial of Service (ReDoS) in Pillow

CVE-2021-25292 / GHSA-9hx2-hgq2-2g4f

More information

Details

An issue was discovered in Pillow before 8.1.1. The PDF parser allows a regular expression DoS (ReDoS) attack via a crafted PDF file because of a catastrophic backtracking regex.

Severity

• CVSS Score: 6.9 / 10 (Medium)
• Vector String: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

References

• https://nvd.nist.gov/vuln/detail/CVE-2021-25292
• https://github.com/python-pillow/Pillow/commit/3bce145966374dd39ce58a6fc0083f8d1890719c
• https://github.com/python-pillow/Pillow/commit/6207b44ab1ff4a91d8ddc7579619876d0bb191a4
• https://pillow.readthedocs.io/en/stable/releasenotes/8.1.1.html
• https://security.gentoo.org/glsa/202107-33
• https://github.com/python-pillow/Pillow/commit/521dab94c7ab72b037bd9a83e9663401e0fd2cee
• https://github.com/advisories/GHSA-9hx2-hgq2-2g4f
• https://github.com/pypa/advisory-database/tree/main/vulns/pillow/PYSEC-2021-38.yaml

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

Out of bounds read in Pillow

CVE-2021-25293 / GHSA-p43w-g3c5-g5mq

More information

Details

An issue was discovered in Pillow before 8.1.1. There is an out-of-bounds read in SGIRleDecode.c.

Severity

• CVSS Score: 8.7 / 10 (High)
• Vector String: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

References

• https://nvd.nist.gov/vuln/detail/CVE-2021-25293
• https://github.com/python-pillow/Pillow/commit/4853e522bddbec66022c0915b9a56255d0188bf9
• https://pillow.readthedocs.io/en/stable/releasenotes/8.1.1.html
• https://security.gentoo.org/glsa/202107-33
• https://github.com/python-pillow/Pillow/commit/f891baa604636cd2506a9360d170bc2cf4963cc5
• https://github.com/advisories/GHSA-p43w-g3c5-g5mq
• https://github.com/pypa/advisory-database/tree/main/vulns/pillow/PYSEC-2021-39.yaml

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

Uncontrolled Resource Consumption in pillow

GHSA-jgpv-4h4c-xhw3

More information

Details

Impact

Pillow before 8.1.1 allows attackers to cause a denial of service (memory consumption) because the reported size of a contained image is not properly checked for a BLP container, and thus an attempted memory allocation can be very large.

Patches

An issue was discovered in Pillow before 6.2.0. When reading specially crafted invalid image files, the library can either allocate very large amounts of memory or take an extremely long period of time to process the image.

Workarounds

An issue was discovered in Pillow before 6.2.0. When reading specially crafted invalid image files, the library can either allocate very large amounts of memory or take an extremely long period of time to process the image.

References

https://nvd.nist.gov/vuln/detail/CVE-2021-27921

For more information

If you have any questions or comments about this advisory:

• Open an issue in example link to repo
• Email us at example email address

Severity

• CVSS Score: 7.5 / 10 (Medium)
• Vector String: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

References

• https://github.com/calix2/pyVulApp/security/advisories/GHSA-jgpv-4h4c-xhw3
• https://github.com/advisories/GHSA-jgpv-4h4c-xhw3

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

Insufficient Verification of Data Authenticity in Pillow

CVE-2021-28678 / GHSA-hjfx-8p6c-g7gx

More information

Details

An issue was discovered in Pillow before 8.2.0. For BLP data, BlpImagePlugin did not properly check that reads (after jumping to file offsets) returned data. This could lead to a DoS where the decoder could be run a large number of times on empty data.

Severity

• CVSS Score: 6.8 / 10 (Medium)
• Vector String: CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

References

• https://nvd.nist.gov/vuln/detail/CVE-2021-28678
• https://github.com/python-pillow/Pillow/pull/5377
• https://github.com/python-pillow/Pillow/pull/5377/commits/496245aa4365d0827390bd0b6fbd11287453b3a1
• https://pillow.readthedocs.io/en/stable/releasenotes/8.2.0.html#cve-2021-28678-fix-blp-dos
• https://security.gentoo.org/glsa/202107-33
• https://github.com/advisories/GHSA-hjfx-8p6c-g7gx
• https://github.com/pypa/advisory-database/tree/main/vulns/pillow/PYSEC-2021-94.yaml
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/MQHA5HAIBOYI3R6HDWCLAGFTIQP767FL

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

Out-of-bounds Read in Pillow

CVE-2021-25287 / GHSA-77gc-v2xv-rvvh

More information

Details

An issue was discovered in Pillow before 8.2.0. There is an out-of-bounds read in J2kDecode, in j2ku_graya_la.

Severity

• CVSS Score: 8.8 / 10 (High)
• Vector String: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:H/SC:N/SI:N/SA:N

References

• https://nvd.nist.gov/vuln/detail/CVE-2021-25287
• https://github.com/python-pillow/Pillow/pull/5377#issuecomment-833821470
• https://github.com/python-pillow/Pillow/pull/5377/commits/3bf5eddb89afdf690eceaa52bc4d3546ba9a5f87
• https://pillow.readthedocs.io/en/stable/releasenotes/8.2.0.html#cve-2021-25287-cve-2021-25288-fix-oob-read-in-jpeg2kdecode
• https://security.gentoo.org/glsa/202107-33
• https://github.com/python-pillow/Pillow/commit/3bf5eddb89afdf690eceaa52bc4d3546ba9a5f87
• https://github.com/advisories/GHSA-77gc-v2xv-rvvh
• https://github.com/pypa/advisory-database/tree/main/vulns/pillow/PYSEC-2021-137.yaml
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/MQHA5HAIBOYI3R6HDWCLAGFTIQP767FL

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

Pillow Out-of-bounds Read vulnerability

CVE-2021-25288 / GHSA-rwv7-3v45-hg29

More information

Details

An issue was discovered in Pillow before 8.2.0. There is an out-of-bounds read in J2kDecode, in j2ku_gray_i. This dates to Pillow 2.4.0.

Severity

• CVSS Score: 8.8 / 10 (High)
• Vector String: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:H/SC:N/SI:N/SA:N

References

• https://nvd.nist.gov/vuln/detail/CVE-2021-25288
• https://github.com/python-pillow/Pillow/pull/5377#issuecomment-833821470
• https://pillow.readthedocs.io/en/stable/releasenotes/8.2.0.html#cve-2021-25287-cve-2021-25288-fix-oob-read-in-jpeg2kdecode
• https://security.gentoo.org/glsa/202107-33
• https://github.com/python-pillow/Pillow/commit/3bf5eddb89afdf690eceaa52bc4d3546ba9a5f87
• https://github.com/advisories/GHSA-rwv7-3v45-hg29
• https://github.com/pypa/advisory-database/tree/main/vulns/pillow/PYSEC-2021-138.yaml
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/MQHA5HAIBOYI3R6HDWCLAGFTIQP767FL

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

Potential infinite loop in Pillow

CVE-2021-28676 / GHSA-7r7m-5h27-29hp

More information

Details

An issue was discovered in Pillow before 8.2.0. For FLI data, FliDecode did not properly check that the block advance was non-zero, potentially leading to an infinite loop on load.

Severity

• CVSS Score: 8.7 / 10 (High)
• Vector String: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

References

• https://nvd.nist.gov/vuln/detail/CVE-2021-28676
• https://github.com/python-pillow/Pillow/pull/5377
• https://pillow.readthedocs.io/en/stable/releasenotes/8.2.0.html#cve-2021-28676-fix-fli-dos
• https://security.gentoo.org/glsa/202107-33
• https://lists.debian.org/debian-lts-announce/2021/07/msg00018.html
• https://github.com/python-pillow/Pillow/commit/bb6c11fb889e6c11b0ee122b828132ee763b5856
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/MQHA5HAIBOYI3R6HDWCLAGFTIQP767FL
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/MQHA5HAIBOYI3R6HDWCLAGFTIQP767FL
• https://github.com/advisories/GHSA-7r7m-5h27-29hp
• https://github.com/pypa/advisory-database/tree/main/vulns/pillow/PYSEC-2021-92.yaml

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

Pillow denial of service

CVE-2021-28675 / GHSA-g6rj-rv7j-xwp4

More information

Details

An issue was discovered in Pillow before 8.2.0. PSDImagePlugin.PsdImageFile lacked a sanity check on the number of input layers relative to the size of the data block. This could lead to a DoS on Image.open prior to Image.load.

Severity

• CVSS Score: 7.1 / 10 (High)
• Vector String: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

References

• https://nvd.nist.gov/vuln/detail/CVE-2021-28675
• https://github.com/python-pillow/Pillow/pull/5377/commits/22e9bee4ef225c0edbb9323f94c26cee0c623497
• https://pillow.readthedocs.io/en/stable/releasenotes/8.2.0.html#cve-2021-28675-fix-dos-in-psdimageplugin
• https://security.gentoo.org/glsa/202107-33
• https://github.com/advisories/GHSA-g6rj-rv7j-xwp4
• https://github.com/pypa/advisory-database/tree/main/vulns/pillow/PYSEC-2021-139.yaml
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/MQHA5HAIBOYI3R6HDWCLAGFTIQP767FL

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

Uncontrolled Resource Consumption in Pillow

CVE-2021-28677 / GHSA-q5hq-fp76-qmrc

More information

Details

An issue was discovered in Pillow before 8.2.0. For EPS data, the readline implementation used in EPSImageFile has to deal with any combination of \r and \n as line endings. It used an accidentally quadratic method of accumulating lines while looking for a line ending. A malicious EPS file could use this to perform a DoS of Pillow in the open phase, before an image was accepted for opening.

Severity

• CVSS Score: 8.7 / 10 (High)
• Vector String: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

References

• https://nvd.nist.gov/vuln/detail/CVE-2021-28677
• https://github.com/python-pillow/Pillow/pull/5377
• https://pillow.readthedocs.io/en/stable/releasenotes/8.2.0.html#cve-2021-28677-fix-eps-dos-on-open
• https://security.gentoo.org/glsa/202107-33
• https://lists.debian.org/debian-lts-announce/2021/07/msg00018.html
• https://github.com/python-pillow/Pillow/commit/5a5e6db0abf4e7a638fb1b3408c4e495a096cb92
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/MQHA5HAIBOYI3R6HDWCLAGFTIQP767FL
• https://github.com/advisories/GHSA-q5hq-fp76-qmrc
• https://github.com/pypa/advisory-database/tree/main/vulns/pillow/PYSEC-2021-93.yaml

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

Buffer Overflow in Pillow

CVE-2021-34552 / GHSA-7534-mm45-c74v

More information

Details

Pillow through 8.2.0 and PIL (aka Python Imaging Library) through 1.1.7 allow an attacker to pass controlled parameters directly into a convert function to trigger a buffer overflow in Convert.c.

Severity

• CVSS Score: 9.3 / 10 (Critical)
• Vector String: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

References

• https://nvd.nist.gov/vuln/detail/CVE-2021-34552
• https://lists.debian.org/debian-lts-announce/2021/07/msg00018.html
• https://pillow.readthedocs.io/en/stable/releasenotes/8.3.0.html#buffer-overflow
• https://pillow.readthedocs.io/en/stable/releasenotes/index.html
• https://github.com/python-pillow/Pillow/pull/5567
• https://security.gentoo.org/glsa/202211-10
• https://github.com/python-pillow/Pillow/commit/31c473898c29d1b7cb6555ce67d9503a4906b83f
• https://github.com/advisories/GHSA-7534-mm45-c74v
• https://github.com/pypa/advisory-database/tree/main/vulns/pillow/PYSEC-2021-331.yaml
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/7V6LCG525ARIX6LX5QRYNAWVDD2MD2SV
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/VUGBBT63VL7G4JNOEIPDJIOC34ZFBKNJ

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

Improper Initialization in Pillow

CVE-2022-22815 / GHSA-pw3c-h7wp-cvhx

More information

Details

Pillow is the friendly PIL (Python Imaging Library) fork. path_getbbox in path.c in Pillow before 9.0.0 improperly initializes ImagePath.Path.

Severity

• CVSS Score: 6.9 / 10 (Medium)
• Vector String: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N

References

• https://nvd.nist.gov/vuln/detail/CVE-2022-22815
• https://github.com/python-pillow/Pillow/blob/c5d9223a8b5e9295d15b5a9b1ef1dae44c8499f3/src/path.c#L331
• https://pillow.readthedocs.io/en/stable/releasenotes/9.0.0.html#fixed-imagepath-path-array-handling
• https://lists.debian.org/debian-lts-announce/2022/01/msg00018.html
• https://www.debian.org/security/2022/dsa-5053
• https://github.com/python-pillow/Pillow/commit/c48271ab354db49cdbd740bc45e13be4f0f7993c
• https://github.com/python-pillow/Pillow/pull/5920
• https://github.com/python-pillow/Pillow/commit/1e092419b6806495c683043ab3feb6ce264f3b9c
• https://github.com/python-pillow/Pillow/blob/e8ab5640774716c5486d3cb05167f74f742ad6ef/CHANGES.rst?plain=1#L1187
• https://github.com/advisories/GHSA-pw3c-h7wp-cvhx
• https://github.com/pypa/advisory-database/tree/main/vulns/pillow/PYSEC-2022-8.yaml

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

Out-of-bounds Read in Pillow

CVE-2022-22816 / GHSA-xrcv-f9gm-v42c

More information

Details

path_getbbox in path.c in Pillow before 9.0.0 has a buffer over-read during initialization of ImagePath.Path.

Severity

• CVSS Score: 6.9 / 10 (Medium)
• Vector String: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N

References

• https://nvd.nist.gov/vuln/detail/CVE-2022-22816
• https://github.com/python-pillow/Pillow/blob/c5d9223a8b5e9295d15b5a9b1ef1dae44c8499f3/src/path.c#L331
• https://pillow.readthedocs.io/en/stable/releasenotes/9.0.0.html#fixed-imagepath-path-array-handling
• https://lists.debian.org/debian-lts-announce/2022/01/msg00018.html
• https://www.debian.org/security/2022/dsa-5053
• https://security.gentoo.org/glsa/202211-10
• https://github.com/python-pillow/Pillow/pull/5920
• https://github.com/python-pillow/Pillow/commit/5543e4e2d409cd9e409bc64cdc77be0af007a31f
• https://github.com/advisories/GHSA-xrcv-f9gm-v42c
• https://github.com/pypa/advisory-database/tree/main/vulns/pillow/PYSEC-2022-9.yaml

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

Path traversal in Pillow

CVE-2022-24303 / GHSA-9j59-75qj-795w

More information

Details

Pillow before 9.0.1 allows attackers to delete files because spaces in temporary pathnames are mishandled.

Severity

• CVSS Score: 8.8 / 10 (High)
• Vector String: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N

References

• https://nvd.nist.gov/vuln/detail/CVE-2022-24303
• https://github.com/python-pillow/Pillow/commit/427221ef5f19157001bf8b1ad7cfe0b905ca8c26
• https://pillow.readthedocs.io/en/stable/releasenotes/9.0.1.html#security
• https://github.com/pypa/advisory-database/tree/main/vulns/pillow/PYSEC-2022-168.yaml
• https://security.gentoo.org/glsa/202211-10
• https://github.com/python-pillow/Pillow/pull/6010
• https://github.com/python-pillow/Pillow/commit/10c4f75aaa383bd9671e923e3b91d391ea12d781
• https://github.com/python-pillow/Pillow/commit/143032103c9f2d55a0a7960bd3e630cb72549e8a
• https://github.com/python-pillow/Pillow/blob/e8ab5640774716c5486d3cb05167f74f742ad6ef/CHANGES.rst?plain=1#L1172
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/W4ZUXPKEX72O3E5IHBPVY5ZCPMJ4GHHV
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/XR6UP2XONXOVXI4446VY72R63YRO2YTP
• https://github.com/python-pillow/Pillow/pull/3450
• https://github.com/advisories/GHSA-9j59-75qj-795w

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

Infinite loop in Pillow

GHSA-4fx9-vc88-q2xc

More information

Details

JpegImagePlugin may append an EOF marker to the end of a truncated file, so that the last segment of the data will still be processed by the decoder.

If the EOF marker is not detected as such however, this could lead to an infinite loop where JpegImagePlugin keeps trying to end the file.

Severity

Low

References

• https://github.com/python-pillow/Pillow/commit/baae9ec4b67c68e3adaf1208cf54e8de5e38a6fd
• https://pillow.readthedocs.io/en/stable/releasenotes/9.0.0.html#ensure-jpegimageplugin-stops-at-the-end-of-a-truncated-file
• https://github.com/advisories/GHSA-4fx9-vc88-q2xc

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

Pillow vulnerable to Data Amplification attack.

CVE-2022-45198 / GHSA-m2vv-5vj5-2hm7

More information

Details

Pillow before 9.2.0 performs Improper Handling of Highly Compressed GIF Data (Data Amplification).

Severity

• CVSS Score: 8.7 / 10 (High)
• Vector String: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

References

• https://nvd.nist.gov/vuln/detail/CVE-2022-45198
• https://github.com/python-pillow/Pillow/pull/6402
• https://bugs.gentoo.org/855683
• https://cwe.mitre.org/data/definitions/409.html
• https://github.com/python-pillow/Pillow/releases/tag/9.2.0
• https://github.com/python-pillow/Pillow/pull/6402/commits/c9f1b35e981075110a23487a8d4a6cbb59a588ea
• https://github.com/python-pillow/Pillow/commit/11918eac0628ec8ac0812670d9838361ead2d6a4
• https://security.gentoo.org/glsa/202211-10
• https://github.com/pypa/advisory-database/tree/main/vulns/pillow/PYSEC-2022-42979.yaml
• https://github.com/advisories/GHSA-m2vv-5vj5-2hm7

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

Out of bounds read in Pillow

CVE-2021-25291 / GHSA-mvg9-xffr-p774

More information

Details

An issue was discovered in Pillow before 8.2.0. In TiffDecode.c, there is an out-of-bounds read in TiffreadRGBATile via invalid tile boundaries.

Severity

• CVSS Score: 8.7 / 10 (High)
• Vector String: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

References

• https://nvd.nist.gov/vuln/detail/CVE-2021-25291
• https://github.com/python-pillow/Pillow/commit/cbdce6c5d054fccaf4af34b47f212355c64ace7a
• https://pillow.readthedocs.io/en/stable/releasenotes/8.1.1.html
• https://security.gentoo.org/glsa/202107-33
• https://github.com/python-pillow/Pillow/commit/8b8076bdcb3815be0ef0d279651d8d1342b8ea61
• https://github.com/advisories/GHSA-mvg9-xffr-p774
• https://github.com/pypa/advisory-database/tree/main/vulns/pillow/PYSEC-2021-37.yaml

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

Arbitrary expression injection in Pillow

CVE-2022-22817 / GHSA-8vj2-vxx3-667w

More information

Details

PIL.ImageMath.eval in Pillow before 9.0.0 allows evaluation of arbitrary expressions, such as ones that use the Python exec method ImageMath.eval("exec(exit())").

While Pillow 9.0.0 restricted top-level builtins available to PIL.ImageMath.eval(), it did not prevent builtins available to lambda expressions. These are now also restricted in 9.0.1.

Severity

• CVSS Score: 9.3 / 10 (Critical)
• Vector String: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

References

• https://nvd.nist.gov/vuln/detail/CVE-2022-22817
• https://pillow.readthedocs.io/en/stable/releasenotes/9.0.0.html#restrict-builtins-available-to-imagemath-eval
• https://lists.debian.org/debian-lts-announce/2022/01/msg00018.html
• https://www.debian.org/security/2022/dsa-5053
• https://github.com/python-pillow/Pillow/commit/8531b01d6cdf0b70f256f93092caa2a5d91afc11
• https://pillow.readthedocs.io/en/stable/releasenotes/9.0.1.html#security
• https://security.gentoo.org/glsa/202211-10
• https://lists.debian.org/debian-lts-announce/2024/03/msg00021.html
• https://github.com/advisories/GHSA-8vj2-vxx3-667w
• https://github.com/pypa/advisory-database/tree/main/vulns/pillow/PYSEC-2022-10.yaml

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

Uncontrolled Resource Consumption in pillow

CVE-2021-23437 / GHSA-98vv-pw6r-q6q4

More information

Details

The package pillow 5.2.0 and before 8.3.2 are vulnerable to Regular Expression Denial of Service (ReDoS) via the getrgb function.

Severity

• CVSS Score: 8.7 / 10 (High)
• Vector String: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

References

• https://nvd.nist.gov/vuln/detail/CVE-2021-23437
• https://github.com/python-pillow/Pillow/commit/9e08eb8f78fdfd2f476e1b20b7cf38683754866b
• https://pillow.readthedocs.io/en/stable/releasenotes/8.3.2.html
• https://snyk.io/vuln/SNYK-PYTHON-PILLOW-1319443
• https://security.gentoo.org/glsa/202211-10
• https://lists.debian.org/debian-lts-announce/2024/03/msg00021.html
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/RNSG6VFXTAROGF7ACYLMAZNQV4EJ6I2C
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VKRCL7KKAKOXCVD7M6WC5OKFGL4L3SJT
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/RNSG6VFXTAROGF7ACYLMAZNQV4EJ6I2C
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/VKRCL7KKAKOXCVD7M6WC5OKFGL4L3SJT
• https://github.com/advisories/GHSA-98vv-pw6r-q6q4
• https://github.com/pypa/advisory-database/tree/main/vulns/pillow/PYSEC-2021-317.yaml

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

libwebp: OOB write in BuildHuffmanTable

CVE-2023-4863 / GHSA-j7hp-h8jx-5ppr

More information

Details

Heap buffer overflow in libwebp allow a remote attacker to perform an out of bounds memory write via a crafted HTML page.

Severity

• CVSS Score: 8.8 / 10 (High)
• Vector String: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

References

• https://nvd.nist.gov/vuln/detail/CVE-2023-4863
• https://chromereleases.googleblog.com/2023/09/stable-channel-update-for-desktop_11.html
• https://crbug.com/1479274
• https://github.com/qnighy/libwebp-sys2-rs/pull/21
• https://github.com/qnighy/libwebp-sys2-rs/commit/4560c473a76ec8bd8c650f19ddf9d7a44f719f8b
• https://github.com/webmproject/libwebp/commit/902bc9190331343b2017211debcec8d2ab87e17a
• https://bugzilla.suse.com/show_bug.cgi?id=1215231
• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-4863
• https://news.ycombinator.com/item?id=37478403
• https://rustsec.org/advisories/RUSTSEC-2023-0060.html
• https://security-tracker.debian.org/tracker/CVE-2023-4863
• https://github.com/electron/electron/pull/39823
• https://github.com/electron/electron/pull/39825
• https://github.com/electron/electron/pull/39826
• https://github.com/electron/electron/pull/39827
• https://github.com/electron/electron/pull/39828
• https://github.com/webmproject/libwebp/releases/tag/v1.3.2
• https://lists.debian.org/debian-lts-announce/2023/09/msg00015.html
• https://lists.debian.org/debian-lts-announce/2023/09/msg00016.html
• https://lists.debian.org/debian-lts-announce/2023/09/msg00017.html
• https://rustsec.org/advisories/RUSTSEC-2023-0061.html
• https://security.gentoo.org/glsa/202309-05
• https://www.debian.org/security/2023/dsa-5496
• https://www.debian.org/security/2023/dsa-5497
• https://www.debian.org/security/2023/dsa-5498
• http://www.openwall.com/lists/oss-security/2023/09/21/4
• http://www.openwall.com/lists/oss-security/2023/09/22/1
• http://www.openwall.com/lists/oss-security/2023/09/22/3
• http://www.openwall.com/lists/oss-security/2023/09/22/4
• http://www.openwall.com/lists/oss-security/2023/09/22/5
• http://www.openwall.com/lists/oss-security/2023/09/22/6
• http://www.openwall.com/lists/oss-security/2023/09/22/7
• http://www.openwall.com/lists/oss-security/2023/09/22/8
• http://www.openwall.com/lists/oss-security/2023/09/26/1
• http://www.openwall.com/lists/oss-security/2023/09/26/7
• http://www.openwall.com/lists/oss-security/2023/09/28/1
• http://www.openwall.com/lists/oss-security/2023/09/28/2
• http://www.openwall.com/lists/oss-security/2023/09/28/4
• https://github.com/jaredforth/webp/pull/30
• https://github.com/python-pillow/Pillow/pull/7395
• https://github.com/jaredforth/webp/commit/9d4c56e63abecc777df71c702503c3eaabd7dcbc
• https://pillow.readthedocs.io/en/stable/releasenotes/10.0.1.html#security
• https://github.com/ImageMagick/ImageMagick/discussions/6664
• https://github.com/dlemstra/Magick.NET/releases/tag/13.3.0
• https://security.gentoo.org/glsa/202401-10
• https://sethmlarson.dev/security-developer-in-residence-weekly-report-16
• https://security.netapp.com/advisory/ntap-20230929-0011
• https://stackdiary.com/critical-vulnerability-in-webp-codec-cve-2023-4863
• https://www.bentley.com/advisories/be-2023-0001
• https://www.bleepingcomputer.com/news/google/google-fixes-another-chrome-zero-day-bug-exploited-in-attacks
• https://www.mozilla.org/en-US/security/advisories/mfsa2023-40
• https://www.vicarius.io/vsociety/posts/zero-day-webp-vulnerability-cve-2023-4863
• https://adamcaudill.com/2023/09/14/whose-cve-is-it-anyway
• https://blog.isosceles.com/the-webp-0day
• https://en.bandisoft.com/honeyview/history
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6T655QF7CQ3DYAMPFV7IECQYGDEUIVVT
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/FYYKLG6CRGEDTNRBSU26EEWAO6D6U645
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/KUQ7CTX3W372X3UY56VVNAHCH6H2F4X3
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/OZDGWWMJREPAGKWCJKSCM4WYLANSKIFX
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/PYZV7TMKF4QHZ54SFJX54BDN52VHGGCX
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/WHOLML7N2G5KCAZXFWC5IDFFHSQS5SDB
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/WTRUIS3564P7ZLM2S2IH4Y4KZ327LI4I
• https://github.com/advisories/GHSA-j7hp-h8jx-5ppr

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

Pillow Denial of Service vulnerability

CVE-2023-44271 / GHSA-8ghj-p4vj-mr35

More information

Details

An issue was discovered in Pillow before 10.0.0. It is a Denial of Service that uncontrollably allocates memory to process a given task, potentially causing a service to crash by having it run out of memory. This occurs for truetype in ImageFont when textlength in an ImageDraw instance operates on a long text argument.

Severity

• CVSS Score: 8.7 / 10 (High)
• Vector String: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

References

• https://nvd.nist.gov/vuln/detail/CVE-2023-44271
• https://github.com/python-pillow/Pillow/pull/7244
• https://github.com/python-pillow/Pillow/commit/1fe1bb49c452b0318cad12ea9d97c3bef188e9a7
• https://github.com/pypa/advisory-database/tree/main/vulns/pillow/PYSEC-2023-227.yaml
• https://devhub.checkmarx.com/cve-details/CVE-2023-44271
• https://lists.debian.org/debian-lts-announce/2024/03/msg00021.html
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/N2JOEDUJDQLCUII2LQYZYSM7RJL2I3P4
• https://github.com/advisories/GHSA-8ghj-p4vj-mr35

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

Arbitrary Code Execution in Pillow

CVE-2023-50447 / GHSA-3f63-hfp8-52jq

More information

Details

Pillow through 10.1.0 allows PIL.ImageMath.eval Arbitrary Code Execution via the environment parameter, a different vulnerability than CVE-2022-22817 (which was about the expression parameter).

Severity

• CVSS Score: 9.3 / 10 (Critical)
• Vector String: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

References

• https://nvd.nist.gov/vuln/detail/CVE-2023-50447
• https://github.com/python-pillow/Pillow/commit/45c726fd4daa63236a8f3653530f297dc87b160a
• https://pillow.readthedocs.io/en/stable/releasenotes/10.2.0.html#security
• http://www.openwall.com/lists/oss-security/2024/01/20/1
• https://github.com/python-pillow/Pillow/releases
• https://lists.debian.org/debian-lts-announce/2024/01/msg00019.html
• https://devhub.checkmarx.com/cve-details/CVE-2023-50447
• https://duartecsantos.github.io/2023-01-02-CVE-2023-50447
• https://duartecsantos.github.io/2024-01-02-CVE-2023-50447
• https://github.com/advisories/GHSA-3f63-hfp8-52jq

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

Pillow buffer overflow vulnerability

CVE-2024-28219 / GHSA-44wm-f244-xhp3

More information

Details

In _imagingcms.c in Pillow before 10.3.0, a buffer overflow exists because strcpy is used instead of strncpy.

Severity

• CVSS Score: 7.3 / 10 (High)
• Vector String: CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

References

• https://nvd.nist.gov/vuln/detail/CVE-2024-28219
• https://pillow.readthedocs.io/en/stable/releasenotes/10.3.0.html#security
• https://github.com/python-pillow/Pillow/commit/2a93aba5cfcf6e241ab4f9392c13e3b74032c061
• https://lists.debian.org/debian-lts-announce/2024/04/msg00008.html
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/4XLPUT3VK4GQ6EVY525TT2QNUIXNRU5M
• https://github.com/advisories/GHSA-44wm-f244-xhp3

This data is provided by the [GitHub Advisory Database](https://redirect.github.com/advisor