Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.
Open advisories
117 actionable advisories, newest first. Withdrawn advisories and news are excluded. Coverage is partial.
Pillow before 8.1.2 allows attackers to cause a denial of service (memory consumption) because the reported size of a contained image is not properly checked for an ICNS container, and thus an attempted memory allocation can be very large.
Recommended action: Upgrade to 8.1.2 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Pillow before 8.1.2 allows attackers to cause a denial of service (memory consumption) because the reported size of a contained image is not properly checked for a BLP container, and thus an attempted memory allocation can be very large.
Recommended action: Upgrade to 8.1.2 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Pillow before 8.1.2 allows attackers to cause a denial of service (memory consumption) because the reported size of a contained image is not properly checked for an ICO container, and thus an attempted memory allocation can be very large.
Recommended action: Upgrade to 8.1.2 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Pillow before 7.1.0 has multiple out-of-bounds reads in libImaging/FliDecode.c.
Recommended action: Upgrade to 7.1.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
In Pillow before 7.1.0, there are two Buffer Overflows in libImaging/TiffDecode.c.
Recommended action: Upgrade to 7.1.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
In libImaging/Jpeg2KDecode.c in Pillow before 7.1.0, there are multiple out-of-bounds reads via a crafted JP2 file.
Recommended action: Upgrade to 7.1.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
In libImaging/SgiRleDecode.c in Pillow through 7.0.0, a number of out-of-bounds reads exist in the parsing of SGI image files, a different issue than CVE-2020-5311.
Recommended action: Upgrade to 7.1.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
The (1) JpegImagePlugin.py and (2) EpsImagePlugin.py scripts in Python Image Library (PIL) 1.1.7 and earlier and Pillow before 2.3.1 uses the names of temporary files on the command line, which makes it easier for local users to conduct symlink attacks by listing the processes.
Recommended action: Upgrade to 2.3.1 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
There is a DoS vulnerability in Pillow before 6.2.2 caused by FpxImagePlugin.py calling the range function on an unvalidated 32-bit integer if the number of bands is large. On Windows running 32-bit Python, this results in an OverflowError or MemoryError due to the 2 GB limit. However, on Linux running 64-bit Python this results in the process being terminated by the OOM killer.
Recommended action: Upgrade to 6.2.2 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
libImaging/FliDecode.c in Pillow before 6.2.2 has an FLI buffer overflow.
Recommended action: Upgrade to 6.2.2 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
An issue was discovered in Pillow before 6.2.0. When reading specially crafted invalid image files, the library can either allocate very large amounts of memory or take an extremely long period of time to process the image.
Recommended action: Upgrade to 6.2.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Integer overflow in the ImagingResampleHorizontal function in libImaging/Resample.c in Pillow before 3.1.1 allows remote attackers to have unspecified impact via negative values of the new size, which triggers a heap-based buffer overflow.
Recommended action: Upgrade to 3.1.1 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Buffer overflow in the ImagingFliDecode function in libImaging/FliDecode.c in Pillow before 3.1.1 allows remote attackers to cause a denial of service (crash) via a crafted FLI file.
Recommended action: Upgrade to 3.1.1 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Buffer overflow in the ImagingPcdDecode function in PcdDecode.c in Pillow before 3.1.1 and Python Imaging Library (PIL) 1.1.7 and earlier allows remote attackers to cause a denial of service (crash) via a crafted PhotoCD file.
Recommended action: Upgrade to 3.1.1 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Pillow before 3.3.2 allows context-dependent attackers to obtain sensitive information by using the "crafted image file" approach, related to an "Integer Overflow" issue affecting the Image.core.mapbuffer in map.c component.
Recommended action: Upgrade to 3.3.2 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Buffer overflow in the ImagingLibTiffDecode function in libImaging/TiffDecode.c in Pillow before 3.1.1 allows remote attackers to overwrite memory via a crafted TIFF file.
Recommended action: Upgrade to 3.1.1 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Pillow before 3.3.2 allows context-dependent attackers to execute arbitrary code by using the "crafted image file" approach, related to an "Insecure Sign Extension" issue affecting the ImagingNew in Storage.c component.
Recommended action: Upgrade to 3.3.2 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.