Vulmon
Recent Vulnerabilities
Research Posts
Trends
Blog
About
Contact
Vulmon Alerts
By Relevance
By Risk Score
By Publish Date
python pillow vulnerabilities and exploits
(subscribe to this query)
NA
CVE-2023-50447
Pillow up to and including 10.1.0 allows PIL.ImageMath.eval Arbitrary Code Execution via the environment parameter, a different vulnerability than CVE-2022-22817 (which was about the expression parameter).
Python Pillow
Debian Debian Linux 10.0
NA
CVE-2023-44271
An issue exists in Pillow prior to 10.0.0. It is a Denial of Service that uncontrollably allocates memory to process a given task, potentially causing a service to crash by having it run out of memory. This occurs for truetype in ImageFont when textlength in an ImageDraw instance...
Python Pillow
Fedoraproject Fedora 38
NA
CVE-2022-45198
Pillow prior to 9.2.0 performs Improper Handling of Highly Compressed GIF Data (Data Amplification).
Python Pillow
NA
CVE-2022-45199
Pillow prior to 9.3.0 allows denial of service via SAMPLESPERPIXEL.
Python Pillow
7.5
CVSSv2
CVE-2022-30595
libImaging/TgaRleDecode.c in Pillow 9.1.0 has a heap buffer overflow in the processing of invalid TGA image files.
Python Pillow 9.1.0
2 Github repositories
6.4
CVSSv2
CVE-2022-24303
Pillow prior to 9.0.1 allows malicious users to delete files because spaces in temporary pathnames are mishandled.
Python Pillow
Fedoraproject Fedora 34
Fedoraproject Fedora 35
6.4
CVSSv2
CVE-2022-22815
path_getbbox in path.c in Pillow prior to 9.0.0 improperly initializes ImagePath.Path.
Python Pillow
Debian Debian Linux 9.0
Debian Debian Linux 10.0
Debian Debian Linux 11.0
6.4
CVSSv2
CVE-2022-22816
path_getbbox in path.c in Pillow prior to 9.0.0 has a buffer over-read during initialization of ImagePath.Path.
Python Pillow
Debian Debian Linux 9.0
Debian Debian Linux 10.0
Debian Debian Linux 11.0
7.5
CVSSv2
CVE-2022-22817
PIL.ImageMath.eval in Pillow prior to 9.0.0 allows evaluation of arbitrary expressions, such as ones that use the Python exec method. A lambda expression could also be used.
Python Pillow
Debian Debian Linux 9.0
Debian Debian Linux 10.0
Debian Debian Linux 11.0
1 Github repository
5
CVSSv2
CVE-2021-23437
The package pillow 5.2.0 and prior to 8.3.2 are vulnerable to Regular Expression Denial of Service (ReDoS) via the getrgb function.
Python Pillow
Fedoraproject Fedora 33
Fedoraproject Fedora 34
1 Github repository
CVSSv2
CVSSv2
CVSSv3
VMScore
Recommendations:
CVE-2024-3581
reflected XSS
CVE-2024-26925
CVE-2024-27956
LFI
CVE-2024-3607
CVE-2024-3107
CVE-2024-3295
SQL
Vulnerability Notification Service
You don’t have to wait for vulnerability scanning results
Get Started
1
2
3
4
5
NEXT »