Update dependency Pillow to v10 [SECURITY]

[renovate]

ℹ️ Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package	Change	Age	Confidence
Pillow (changelog)	==5.1.0 → ==10.3.0

---

Warning

Some dependencies could not be looked up. Check the Dependency Dashboard for more information.

---

DOS attack in Pillow when processing specially crafted image files

CVE-2019-16865 / GHSA-j7mj-748x-7p78

More information

Details

An issue was discovered in Pillow before 6.2.0. When reading specially crafted invalid image files, the library can either allocate very large amounts of memory or take an extremely long period of time to process the image.

Severity

• CVSS Score: 8.7 / 10 (High)
• Vector String: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

References

• https://nvd.nist.gov/vuln/detail/CVE-2019-16865
• https://github.com/python-pillow/Pillow/issues/4123
• https://pillow.readthedocs.io/en/latest/releasenotes/6.2.0.html
• https://access.redhat.com/errata/RHSA-2020:0566
• https://access.redhat.com/errata/RHSA-2020:0578
• https://access.redhat.com/errata/RHSA-2020:0580
• https://www.debian.org/security/2020/dsa-4631
• https://access.redhat.com/errata/RHSA-2020:0681
• https://access.redhat.com/errata/RHSA-2020:0683
• https://access.redhat.com/errata/RHSA-2020:0694
• https://github.com/python-pillow/Pillow/commit/ab52630d0644e42a75eb88b78b9a9d7438a6fbeb
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/EMJBUZQGQ2Q7HXYCQVRLU7OXNC7CAWWU
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/LYDXD7EE4YAEVSTNIFZKNVPRVJX5ZOG3
• https://ubuntu.com/security/notices/USN-4272-1
• https://usn.ubuntu.com/4272-1
• https://github.com/pypa/advisory-database/tree/main/vulns/pillow/PYSEC-2019-110.yaml
• https://github.com/advisories/GHSA-j7mj-748x-7p78

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

Out-of-bounds Read in Pillow

CVE-2020-5313 / GHSA-hj69-c76v-86wr

More information

Details

libImaging/FliDecode.c in Pillow before 6.2.2 has an FLI buffer overflow.

Severity

• CVSS Score: 8.3 / 10 (High)
• Vector String: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N

References

• https://nvd.nist.gov/vuln/detail/CVE-2020-5313
• https://github.com/python-pillow/Pillow/commit/a09acd0decd8a87ccce939d5ff65dab59e7d365b
• https://github.com/python-pillow/Pillow/blob/master/CHANGES.rst#622-2020-01-02
• https://pillow.readthedocs.io/en/stable/releasenotes/6.2.2.html
• https://www.debian.org/security/2020/dsa-4631
• https://github.com/advisories/GHSA-hj69-c76v-86wr
• https://github.com/pypa/advisory-database/tree/main/vulns/pillow/PYSEC-2020-84.yaml
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/2MMU3WT2X64GS5WHDPKKC2WZA7UIIQ3A
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/3DUMIBUYGJRAVJCTFUWBRLVQKOUTVX5P
• https://usn.ubuntu.com/4272-1

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

Buffer overflow in Pillow

CVE-2020-10379 / GHSA-8843-m7mw-mxqm

More information

Details

In Pillow before 7.1.0, there are two Buffer Overflows in libImaging/TiffDecode.c.

Severity

• CVSS Score: 8.7 / 10 (High)
• Vector String: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

References

• https://nvd.nist.gov/vuln/detail/CVE-2020-10379
• https://github.com/python-pillow/Pillow/pull/4538
• https://github.com/python-pillow/Pillow/commit/46f4a349b88915787fea3fb91348bb1665831bbb#diff-9478f2787e3ae9668a15123b165c23ac
• https://github.com/python-pillow/Pillow/commits/master/src/libImaging
• https://pillow.readthedocs.io/en/stable/releasenotes/6.2.3.html
• https://pillow.readthedocs.io/en/stable/releasenotes/7.1.0.html
• https://snyk.io/vuln/SNYK-PYTHON-PILLOW-574577
• https://github.com/python-pillow/Pillow/issues/4750
• https://github.com/advisories/GHSA-8843-m7mw-mxqm
• https://github.com/pypa/advisory-database/tree/main/vulns/pillow/PYSEC-2020-78.yaml
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/BEBCPE4F2VHTIT6EZA2YZQZLPVDEBJGD
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/HOKHNWV2VS5GESY7IBD237E7C6T3I427
• https://usn.ubuntu.com/4430-2

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

Out-of-bounds reads in Pillow

CVE-2020-10994 / GHSA-vj42-xq3r-hr3r

More information

Details

In libImaging/Jpeg2KDecode.c in Pillow before 7.1.0, there are multiple out-of-bounds reads via a crafted JP2 file.

Severity

• CVSS Score: 7.1 / 10 (High)
• Vector String: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

References

• https://nvd.nist.gov/vuln/detail/CVE-2020-10994
• https://github.com/python-pillow/Pillow/pull/4505
• https://github.com/python-pillow/Pillow/pull/4538
• https://github.com/python-pillow/Pillow/commit/ff60894d697d1992147b791101ad53a8bf1352e4
• https://github.com/python-pillow/Pillow/blob/master/docs/releasenotes/7.1.0.rst#security
• https://pillow.readthedocs.io/en/stable/releasenotes/7.1.0.html
• https://snyk.io/vuln/SNYK-PYTHON-PILLOW-574575
• https://github.com/advisories/GHSA-vj42-xq3r-hr3r
• https://github.com/pypa/advisory-database/tree/main/vulns/pillow/PYSEC-2020-79.yaml
• https://github.com/python-pillow/Pillow/commits/master/src/libImaging
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/BEBCPE4F2VHTIT6EZA2YZQZLPVDEBJGD
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/HOKHNWV2VS5GESY7IBD237E7C6T3I427
• https://pillow.readthedocs.io/en/stable/releasenotes
• https://usn.ubuntu.com/4430-1
• https://usn.ubuntu.com/4430-2

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

Out-of-bounds reads in Pillow

CVE-2020-10177 / GHSA-cqhg-xjhh-p8hf

More information

Details

Pillow before 7.1.0 has multiple out-of-bounds reads in libImaging/FliDecode.c.

Severity

• CVSS Score: 7.1 / 10 (High)
• Vector String: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

References

• https://nvd.nist.gov/vuln/detail/CVE-2020-10177
• https://github.com/python-pillow/Pillow/pull/4503
• https://github.com/python-pillow/Pillow/pull/4538
• https://github.com/python-pillow/Pillow/commits/master/src/libImaging
• https://pillow.readthedocs.io/en/stable/releasenotes/6.2.3.html
• https://pillow.readthedocs.io/en/stable/releasenotes/7.1.0.html
• https://snyk.io/vuln/SNYK-PYTHON-PILLOW-574573
• https://lists.debian.org/debian-lts-announce/2020/08/msg00012.html
• https://github.com/python-pillow/Pillow/issues/4750
• https://github.com/python-pillow/Pillow/commit/f6926a041b4b544fd2ced3752542afb6c8c19405
• https://github.com/python-pillow/Pillow/commit/c88b0204d7c930e3bd72626ae6ea078571cc0ea7
• https://github.com/python-pillow/Pillow/commit/c66d8aa75436f334f686fe32bca8e414bcdd18e6
• https://github.com/python-pillow/Pillow/commit/c5edc361fd6450f805a6a444723b0f68190b1d0c
• https://github.com/python-pillow/Pillow/commit/b4e439d6d7fd986cd6b4c7f9ca18830d79dacd44
• https://github.com/python-pillow/Pillow/commit/8d4f3c0c5f2fecf175aeb895e9c2d6d06d85bdc9
• https://github.com/python-pillow/Pillow/commit/5b490fc413dfab2d52de46a58905c25d9badb650
• https://github.com/python-pillow/Pillow/commit/19ff42bd683486a8a308743c76972ef6a6482e9b
• https://github.com/python-pillow/Pillow/commit/11ef7ca53a7d0af4bc52666c29199deffa5fc1bd
• https://github.com/python-pillow/Pillow/commit/088ce4df981b70fbec140ee54417bcb49a7dffca
• https://github.com/python-pillow/Pillow/commit/00c6dd72d9ed0124cec81040b4bab0979a200fe2
• https://usn.ubuntu.com/4430-2
• https://usn.ubuntu.com/4430-1
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/HOKHNWV2VS5GESY7IBD237E7C6T3I427
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/BEBCPE4F2VHTIT6EZA2YZQZLPVDEBJGD
• https://github.com/pypa/advisory-database/tree/main/vulns/pillow/PYSEC-2020-76.yaml
• https://github.com/advisories/GHSA-cqhg-xjhh-p8hf

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

Out-of-bounds read in Pillow

CVE-2020-11538 / GHSA-43fq-w8qq-v88h

More information

Details

In libImaging/SgiRleDecode.c in Pillow through 7.0.0, a number of out-of-bounds reads exist in the parsing of SGI image files, a different issue than CVE-2020-5311.

Severity

• CVSS Score: 9.2 / 10 (Critical)
• Vector String: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

References

• https://nvd.nist.gov/vuln/detail/CVE-2020-11538
• https://github.com/python-pillow/Pillow/pull/4504
• https://github.com/python-pillow/Pillow/pull/4538
• https://github.com/python-pillow/Pillow/commit/2ef59fdbaeb756bc512ab3f2ad15ac45665b303d
• https://github.com/python-pillow/Pillow/blob/master/docs/releasenotes/7.1.0.rst#security
• https://pillow.readthedocs.io/en/stable/releasenotes/7.1.0.html
• https://pillow.readthedocs.io/en/stable/releasenotes/index.html
• https://snyk.io/vuln/SNYK-PYTHON-PILLOW-574574
• https://github.com/advisories/GHSA-43fq-w8qq-v88h
• https://github.com/pypa/advisory-database/tree/main/vulns/pillow/PYSEC-2020-80.yaml
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/BEBCPE4F2VHTIT6EZA2YZQZLPVDEBJGD
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/HOKHNWV2VS5GESY7IBD237E7C6T3I427
• https://usn.ubuntu.com/4430-1
• https://usn.ubuntu.com/4430-2

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

Pillow Out-of-bounds Write

CVE-2020-35654 / GHSA-vqcj-wrf2-7v73

More information

Details

In Pillow before 8.1.0, TiffDecode has a heap-based buffer overflow when decoding crafted YCbCr files because of certain interpretation conflicts with LibTIFF in RGBA mode.

Severity

• CVSS Score: 8.6 / 10 (High)
• Vector String: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

References

• https://nvd.nist.gov/vuln/detail/CVE-2020-35654
• https://pillow.readthedocs.io/en/stable/releasenotes/index.html
• https://github.com/python-pillow/Pillow/commit/eb8c1206d6b170d4e798a00db7432e023853da5c
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6BYVI5G44MRIPERKYDQEL3S3YQCZTVHE
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/BF553AMNNNBW7SH4IM4MNE4M6GNZQ7YD
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/TQQY6472RX4J2SUJENWDZAWKTJJGP2ML
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZTSY25UJU7NJUFHH3HWT575LT4TDFWBZ
• https://github.com/advisories/GHSA-vqcj-wrf2-7v73
• https://github.com/pypa/advisory-database/tree/main/vulns/pillow/PYSEC-2021-70.yaml

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

Regular Expression Denial of Service (ReDoS) in Pillow

CVE-2021-25292 / GHSA-9hx2-hgq2-2g4f

More information

Details

An issue was discovered in Pillow before 8.1.1. The PDF parser allows a regular expression DoS (ReDoS) attack via a crafted PDF file because of a catastrophic backtracking regex.

Severity

• CVSS Score: 6.9 / 10 (Medium)
• Vector String: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

References

• https://nvd.nist.gov/vuln/detail/CVE-2021-25292
• https://github.com/python-pillow/Pillow/commit/3bce145966374dd39ce58a6fc0083f8d1890719c
• https://github.com/python-pillow/Pillow/commit/6207b44ab1ff4a91d8ddc7579619876d0bb191a4
• https://pillow.readthedocs.io/en/stable/releasenotes/8.1.1.html
• https://security.gentoo.org/glsa/202107-33
• https://github.com/python-pillow/Pillow/commit/521dab94c7ab72b037bd9a83e9663401e0fd2cee
• https://github.com/advisories/GHSA-9hx2-hgq2-2g4f
• https://github.com/pypa/advisory-database/tree/main/vulns/pillow/PYSEC-2021-38.yaml

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

Out of bounds read in Pillow

CVE-2021-25293 / GHSA-p43w-g3c5-g5mq

More information

Details

An issue was discovered in Pillow before 8.1.1. There is an out-of-bounds read in SGIRleDecode.c.

Severity

• CVSS Score: 8.7 / 10 (High)
• Vector String: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

References

• https://nvd.nist.gov/vuln/detail/CVE-2021-25293
• https://github.com/python-pillow/Pillow/commit/4853e522bddbec66022c0915b9a56255d0188bf9
• https://pillow.readthedocs.io/en/stable/releasenotes/8.1.1.html
• https://security.gentoo.org/glsa/202107-33
• https://github.com/python-pillow/Pillow/commit/f891baa604636cd2506a9360d170bc2cf4963cc5
• https://github.com/advisories/GHSA-p43w-g3c5-g5mq
• https://github.com/pypa/advisory-database/tree/main/vulns/pillow/PYSEC-2021-39.yaml

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

Uncontrolled Resource Consumption in pillow

GHSA-jgpv-4h4c-xhw3

More information

Details

Impact

Pillow before 8.1.1 allows attackers to cause a denial of service (memory consumption) because the reported size of a contained image is not properly checked for a BLP container, and thus an attempted memory allocation can be very large.

Patches

An issue was discovered in Pillow before 6.2.0. When reading specially crafted invalid image files, the library can either allocate very large amounts of memory or take an extremely long period of time to process the image.

Workarounds

An issue was discovered in Pillow before 6.2.0. When reading specially crafted invalid image files, the library can either allocate very large amounts of memory or take an extremely long period of time to process the image.

References

https://nvd.nist.gov/vuln/detail/CVE-2021-27921

For more information

If you have any questions or comments about this advisory:

• Open an issue in example link to repo
• Email us at example email address

Severity

• CVSS Score: 7.5 / 10 (Medium)
• Vector String: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

References

• https://github.com/calix2/pyVulApp/security/advisories/GHSA-jgpv-4h4c-xhw3
• https://github.com/advisories/GHSA-jgpv-4h4c-xhw3

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

Insufficient Verification of Data Authenticity in Pillow

CVE-2021-28678 / GHSA-hjfx-8p6c-g7gx

More information

Details

An issue was discovered in Pillow before 8.2.0. For BLP data, BlpImagePlugin did not properly check that reads (after jumping to file offsets) returned data. This could lead to a DoS where the decoder could be run a large number of times on empty data.

Severity

• CVSS Score: 6.8 / 10 (Medium)
• Vector String: CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

References

• https://nvd.nist.gov/vuln/detail/CVE-2021-28678
• https://github.com/python-pillow/Pillow/pull/5377
• https://github.com/python-pillow/Pillow/pull/5377/commits/496245aa4365d0827390bd0b6fbd11287453b3a1
• https://pillow.readthedocs.io/en/stable/releasenotes/8.2.0.html#cve-2021-28678-fix-blp-dos
• https://security.gentoo.org/glsa/202107-33
• https://github.com/advisories/GHSA-hjfx-8p6c-g7gx
• https://github.com/pypa/advisory-database/tree/main/vulns/pillow/PYSEC-2021-94.yaml
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/MQHA5HAIBOYI3R6HDWCLAGFTIQP767FL

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

Out-of-bounds Read in Pillow

CVE-2021-25287 / GHSA-77gc-v2xv-rvvh

More information

Details

An issue was discovered in Pillow before 8.2.0. There is an out-of-bounds read in J2kDecode, in j2ku_graya_la.

Severity

• CVSS Score: 8.8 / 10 (High)
• Vector String: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:H/SC:N/SI:N/SA:N

References

• https://nvd.nist.gov/vuln/detail/CVE-2021-25287
• https://github.com/python-pillow/Pillow/pull/5377#issuecomment-833821470
• https://github.com/python-pillow/Pillow/pull/5377/commits/3bf5eddb89afdf690eceaa52bc4d3546ba9a5f87
• https://pillow.readthedocs.io/en/stable/releasenotes/8.2.0.html#cve-2021-25287-cve-2021-25288-fix-oob-read-in-jpeg2kdecode
• https://security.gentoo.org/glsa/202107-33
• https://github.com/python-pillow/Pillow/commit/3bf5eddb89afdf690eceaa52bc4d3546ba9a5f87
• https://github.com/advisories/GHSA-77gc-v2xv-rvvh
• https://github.com/pypa/advisory-database/tree/main/vulns/pillow/PYSEC-2021-137.yaml
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/MQHA5HAIBOYI3R6HDWCLAGFTIQP767FL

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

Pillow Out-of-bounds Read vulnerability

CVE-2021-25288 / GHSA-rwv7-3v45-hg29

More information

Details

An issue was discovered in Pillow before 8.2.0. There is an out-of-bounds read in J2kDecode, in j2ku_gray_i. This dates to Pillow 2.4.0.

Severity

• CVSS Score: 8.8 / 10 (High)
• Vector String: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:H/SC:N/SI:N/SA:N

References

• https://nvd.nist.gov/vuln/detail/CVE-2021-25288
• https://github.com/python-pillow/Pillow/pull/5377#issuecomment-833821470
• https://pillow.readthedocs.io/en/stable/releasenotes/8.2.0.html#cve-2021-25287-cve-2021-25288-fix-oob-read-in-jpeg2kdecode
• https://security.gentoo.org/glsa/202107-33
• https://github.com/python-pillow/Pillow/commit/3bf5eddb89afdf690eceaa52bc4d3546ba9a5f87
• https://github.com/advisories/GHSA-rwv7-3v45-hg29
• https://github.com/pypa/advisory-database/tree/main/vulns/pillow/PYSEC-2021-138.yaml
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/MQHA5HAIBOYI3R6HDWCLAGFTIQP767FL

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

Potential infinite loop in Pillow

CVE-2021-28676 / GHSA-7r7m-5h27-29hp

More information

Details

An issue was discovered in Pillow before 8.2.0. For FLI data, FliDecode did not properly check that the block advance was non-zero, potentially leading to an infinite loop on load.

Severity

• CVSS Score: 8.7 / 10 (High)
• Vector String: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

References

• https://nvd.nist.gov/vuln/detail/CVE-2021-28676
• https://github.com/python-pillow/Pillow/pull/5377
• https://pillow.readthedocs.io/en/stable/releasenotes/8.2.0.html#cve-2021-28676-fix-fli-dos
• https://security.gentoo.org/glsa/202107-33
• https://lists.debian.org/debian-lts-announce/2021/07/msg00018.html
• https://github.com/python-pillow/Pillow/commit/bb6c11fb889e6c11b0ee122b828132ee763b5856
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/MQHA5HAIBOYI3R6HDWCLAGFTIQP767FL
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/MQHA5HAIBOYI3R6HDWCLAGFTIQP767FL
• https://github.com/advisories/GHSA-7r7m-5h27-29hp
• https://github.com/pypa/advisory-database/tree/main/vulns/pillow/PYSEC-2021-92.yaml

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

Pillow denial of service

CVE-2021-28675 / GHSA-g6rj-rv7j-xwp4

More information

Details

An issue was discovered in Pillow before 8.2.0. PSDImagePlugin.PsdImageFile lacked a sanity check on the number of input layers relative to the size of the data block. This could lead to a DoS on Image.open prior to Image.load.

Severity

• CVSS Score: 7.1 / 10 (High)
• Vector String: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

References

• https://nvd.nist.gov/vuln/detail/CVE-2021-28675
• https://github.com/python-pillow/Pillow/pull/5377/commits/22e9bee4ef225c0edbb9323f94c26cee0c623497
• https://pillow.readthedocs.io/en/stable/releasenotes/8.2.0.html#cve-2021-28675-fix-dos-in-psdimageplugin
• https://security.gentoo.org/glsa/202107-33
• https://github.com/advisories/GHSA-g6rj-rv7j-xwp4
• https://github.com/pypa/advisory-database/tree/main/vulns/pillow/PYSEC-2021-139.yaml
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/MQHA5HAIBOYI3R6HDWCLAGFTIQP767FL

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

Uncontrolled Resource Consumption in Pillow

CVE-2021-28677 / GHSA-q5hq-fp76-qmrc

More information

Details

An issue was discovered in Pillow before 8.2.0. For EPS data, the readline implementation used in EPSImageFile has to deal with any combination of \r and \n as line endings. It used an accidentally quadratic method of accumulating lines while looking for a line ending. A malicious EPS file could use this to perform a DoS of Pillow in the open phase, before an image was accepted for opening.

Severity

• CVSS Score: 8.7 / 10 (High)
• Vector String: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

References

• https://nvd.nist.gov/vuln/detail/CVE-2021-28677
• https://github.com/python-pillow/Pillow/pull/5377
• https://pillow.readthedocs.io/en/stable/releasenotes/8.2.0.html#cve-2021-28677-fix-eps-dos-on-open
• https://security.gentoo.org/glsa/202107-33
• https://lists.debian.org/debian-lts-announce/2021/07/msg00018.html
• https://github.com/python-pillow/Pillow/commit/5a5e6db0abf4e7a638fb1b3408c4e495a096cb92
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/MQHA5HAIBOYI3R6HDWCLAGFTIQP767FL
• https://github.com/advisories/GHSA-q5hq-fp76-qmrc
• https://github.com/pypa/advisory-database/tree/main/vulns/pillow/PYSEC-2021-93.yaml

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

Buffer Overflow in Pillow

CVE-2021-34552 / GHSA-7534-mm45-c74v

More information

Details

Pillow through 8.2.0 and PIL (aka Python Imaging Library) through 1.1.7 allow an attacker to pass controlled parameters directly into a convert function to trigger a buffer overflow in Convert.c.

Severity

• CVSS Score: 9.3 / 10 (Critical)
• Vector String: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

References

• https://nvd.nist.gov/vuln/detail/CVE-2021-34552
• https://lists.debian.org/debian-lts-announce/2021/07/msg00018.html
• https://pillow.readthedocs.io/en/stable/releasenotes/8.3.0.html#buffer-overflow
• https://pillow.readthedocs.io/en/stable/releasenotes/index.html
• https://github.com/python-pillow/Pillow/pull/5567
• https://security.gentoo.org/glsa/202211-10
• https://github.com/python-pillow/Pillow/commit/31c473898c29d1b7cb6555ce67d9503a4906b83f
• https://github.com/advisories/GHSA-7534-mm45-c74v
• https://github.com/pypa/advisory-database/tree/main/vulns/pillow/PYSEC-2021-331.yaml
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/7V6LCG525ARIX6LX5QRYNAWVDD2MD2SV
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/VUGBBT63VL7G4JNOEIPDJIOC34ZFBKNJ

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

Out-of-bounds read in Pillow

CVE-2020-10378 / GHSA-3xv8-3j54-hgrp

More information

Details

In libImaging/PcxDecode.c in Pillow before 7.1.0, an out-of-bounds read can occur when reading PCX files where state->shuffle is instructed to read beyond state->buffer.

Severity

• CVSS Score: 8.2 / 10 (High)
• Vector String: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

References

• https://nvd.nist.gov/vuln/detail/CVE-2020-10378
• https://github.com/python-pillow/Pillow/pull/4538
• https://github.com/python-pillow/Pillow/commit/6a83e4324738bb0452fbe8074a995b1c73f08de7#diff-9478f2787e3ae9668a15123b165c23ac
• https://github.com/pypa/advisory-db/blob/7872b0a91b4d980f749e6d75a81f8cc1af32829f/vulns/pillow/PYSEC-2020-77.yaml
• https://github.com/python-pillow/Pillow/commits/master/src/libImaging
• https://pillow.readthedocs.io/en/stable/releasenotes/6.2.3.html
• https://pillow.readthedocs.io/en/stable/releasenotes/7.1.0.html
• https://github.com/python-pillow/Pillow/issues/4750
• https://github.com/python-pillow/Pillow/commit/124f4bb591e16212605d0e41c413ed53e242cba2
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/BEBCPE4F2VHTIT6EZA2YZQZLPVDEBJGD
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/HOKHNWV2VS5GESY7IBD237E7C6T3I427
• https://usn.ubuntu.com/4430-1
• https://usn.ubuntu.com/4430-2
• https://github.com/advisories/GHSA-3xv8-3j54-hgrp
• https://github.com/pypa/advisory-database/tree/main/vulns/pillow/PYSEC-2020-77.yaml

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

PCX P mode buffer overflow in Pillow

CVE-2020-5312 / GHSA-p49h-hjvm-jg3h

More information

Details

libImaging/PcxDecode.c in Pillow before 6.2.2 has a PCX P mode buffer overflow.

Severity

• CVSS Score: 9.3 / 10 (Critical)
• Vector String: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

References

• https://nvd.nist.gov/vuln/detail/CVE-2020-5312
• https://github.com/python-pillow/Pillow/commit/93b22b846e0269ee9594ff71a72bec02d2bea8fd
• https://access.redhat.com/errata/RHSA-2020:0566
• https://access.redhat.com/errata/RHSA-2020:0578
• https://access.redhat.com/errata/RHSA-2020:0580
• https://access.redhat.com/errata/RHSA-2020:0681
• https://access.redhat.com/errata/RHSA-2020:0683
• https://access.redhat.com/errata/RHSA-2020:0694
• https://github.com/pypa/advisory-db/blob/7872b0a91b4d980f749e6d75a81f8cc1af32829f/vulns/pillow/PYSEC-2020-83.yaml
• https://pillow.readthedocs.io/en/stable/releasenotes/6.2.2.html
• https://www.debian.org/security/2020/dsa-4631
• https://github.com/advisories/GHSA-p49h-hjvm-jg3h
• https://github.com/pypa/advisory-database/tree/main/vulns/pillow/PYSEC-2020-83.yaml
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/2MMU3WT2X64GS5WHDPKKC2WZA7UIIQ3A
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/3DUMIBUYGJRAVJCTFUWBRLVQKOUTVX5P
• https://usn.ubuntu.com/4272-1

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

Out-of-bounds Read in Pillow

CVE-2022-22816 / GHSA-xrcv-f9gm-v42c

More information

Details

path_getbbox in path.c in Pillow before 9.0.0 has a buffer over-read during initialization of ImagePath.Path.

Severity

• CVSS Score: 6.9 / 10 (Medium)
• Vector String: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N

References

• https://nvd.nist.gov/vuln/detail/CVE-2022-22816
• https://github.com/python-pillow/Pillow/blob/c5d9223a8b5e9295d15b5a9b1ef1dae44c8499f3/src/path.c#L331
• https://pillow.readthedocs.io/en/stable/releasenotes/9.0.0.html#fixed-imagepath-path-array-handling
• https://lists.debian.org/debian-lts-announce/2022/01/msg00018.html
• https://www.debian.org/security/2022/dsa-5053
• https://security.gentoo.org/glsa/202211-10
• https://github.com/python-pillow/Pillow/pull/5920
• https://github.com/python-pillow/Pillow/commit/5543e4e2d409cd9e409bc64cdc77be0af007a31f
• https://github.com/advisories/GHSA-xrcv-f9gm-v42c
• https://github.com/pypa/advisory-database/tree/main/vulns/pillow/PYSEC-2022-9.yaml

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

Improper Initialization in Pillow

CVE-2022-22815 / GHSA-pw3c-h7wp-cvhx

More information

Details

Pillow is the friendly PIL (Python Imaging Library) fork. path_getbbox in path.c in Pillow before 9.0.0 improperly initializes ImagePath.Path.

Severity

• CVSS Score: 6.9 / 10 (Medium)
• Vector String: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N

References

• https://nvd.nist.gov/vuln/detail/CVE-2022-22815
• https://github.com/python-pillow/Pillow/blob/c5d9223a8b5e9295d15b5a9b1ef1dae44c8499f3/src/path.c#L331
• https://pillow.readthedocs.io/en/stable/releasenotes/9.0.0.html#fixed-imagepath-path-array-handling
• https://lists.debian.org/debian-lts-announce/2022/01/msg00018.html
• https://www.debian.org/security/2022/dsa-5053
• https://github.com/python-pillow/Pillow/commit/c48271ab354db49cdbd740bc45e13be4f0f7993c
• https://github.com/python-pillow/Pillow/pull/5920
• https://github.com/python-pillow/Pillow/commit/1e092419b6806495c683043ab3feb6ce264f3b9c
• https://github.com/python-pillow/Pillow/blob/e8ab5640774716c5486d3cb05167f74f742ad6ef/CHANGES.rst?plain=1#L1187
• https://github.com/advisories/GHSA-pw3c-h7wp-cvhx
• https://github.com/pypa/advisory-database/tree/main/vulns/pillow/PYSEC-2022-8.yaml

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

Path traversal in Pillow

CVE-2022-24303 / GHSA-9j59-75qj-795w

More information

Details

Pillow before 9.0.1 allows attackers to delete files because spaces in temporary pathnames are mishandled.

Severity

• CVSS Score: 8.8 / 10 (High)
• Vector String: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N

References

• https://nvd.nist.gov/vuln/detail/CVE-2022-24303
• https://github.com/python-pillow/Pillow/commit/427221ef5f19157001bf8b1ad7cfe0b905ca8c26
• https://pillow.readthedocs.io/en/stable/releasenotes/9.0.1.html#security
• https://github.com/pypa/advisory-database/tree/main/vulns/pillow/PYSEC-2022-168.yaml
• https://security.gentoo.org/glsa/202211-10
• https://github.com/python-pillow/Pillow/pull/6010
• https://github.com/python-pillow/Pillow/commit/10c4f75aaa383bd9671e923e3b91d391ea12d781
• https://github.com/python-pillow/Pillow/commit/143032103c9f2d55a0a7960bd3e630cb72549e8a
• https://github.com/python-pillow/Pillow/blob/e8ab5640774716c5486d3cb05167f74f742ad6ef/CHANGES.rst?plain=1#L1172
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/W4ZUXPKEX72O3E5IHBPVY5ZCPMJ4GHHV
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/XR6UP2XONXOVXI4446VY72R63YRO2YTP
• https://github.com/python-pillow/Pillow/pull/3450
• https://github.com/advisories/GHSA-9j59-75qj-795w

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

Infinite loop in Pillow

GHSA-4fx9-vc88-q2xc

More information

Details

JpegImagePlugin may append an EOF marker to the end of a truncated file, so that the last segment of the data will still be processed by the decoder.

If the EOF marker is not detected as such however, this could lead to an infinite loop where JpegImagePlugin keeps trying to end the file.

Severity

Low

References

• https://github.com/python-pillow/Pillow/commit/baae9ec4b67c68e3adaf1208cf54e8de5e38a6fd
• [https://pi

✂ Note

PR body was truncated to here.