Most recent entries from all

ALSA-2022:0643 — Important: python-pillow security update

Affected: AlmaLinux:8: python3-pillow, AlmaLinux:8: python3-pillow-devel, AlmaLinux:8: python3-pillow-doc, AlmaLinux:8: python3-pillow-tk

The python-pillow packages contain a Python image processing library that provides extensive file format support, an efficient internal representation, and powerful image-processing capabilities.

Security Fix(es):

* python-pillow: PIL.ImageMath.eval allows evaluation of arbitrary expressions (CVE-2022-22817)

* python-pillow: buffer over-read during initialization of ImagePath.Path in path_getbbox() in path.c (CVE-2022-22816)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

bdu:2022-00582

BIT-pillow-2022-22816

Affected: Bitnami: pillow

path_getbbox in path.c in Pillow before 9.0.0 has a buffer over-read during initialization of ImagePath.Path.

BREW-pillow-CVE-2022-22816

Affected: Homebrew: pillow

path_getbbox in path.c in Pillow before 9.0.0 has a buffer over-read during initialization of ImagePath.Path.

cnvd-2022-05433

EUVD-2026-13567

fkie_cve-2022-22816

path_getbbox in path.c in Pillow before 9.0.0 has a buffer over-read during initialization of ImagePath.Path.

GHSA-xrcv-f9gm-v42c — Out-of-bounds Read in Pillow

Affected: PyPI: pillow

path_getbbox in path.c in Pillow before 9.0.0 has a buffer over-read during initialization of ImagePath.Path.

gsd-2022-22816

OESA-2022-1526 — python-pillow security update

Affected: openEuler:20.03-LTS-SP1: python-pillow, openEuler:20.03-LTS-SP2: python-pillow, openEuler:20.03-LTS-SP3: python-pillow

Python image processing library. Security Fix(es): path_getbbox in path.c in Pillow before 9.0.0 has a buffer over-read during initialization of ImagePath.Path.(CVE-2022-22816) PIL.ImageMath.eval in Pillow before 9.0.0 allows evaluation of arbitrary expressions, such as ones that use the Python exec method.(CVE-2022-22817) path_getbbox in path.c in Pillow before 9.0.0 improperly initializes ImagePath.Path.(CVE-2022-22815)

PYSEC-2022-9

Affected: PyPI: pillow

path_getbbox in path.c in Pillow before 9.0.0 has a buffer over-read during initialization of ImagePath.Path.

RHSA-2022:0609 — Red Hat Security Advisory: python-pillow security update

python-pillow: buffer over-read during initialization of ImagePath.Path in path_getbbox() in path.c python-pillow: PIL.ImageMath.eval allows evaluation of arbitrary expressions

RHSA-2022:0665 — Red Hat Security Advisory: python-pillow security update

python-pillow: buffer over-read during initialization of ImagePath.Path in path_getbbox() in path.c python-pillow: PIL.ImageMath.eval allows evaluation of arbitrary expressions

SUSE-SU-2024:1673-1 — Security update for python-Pillow

Security update for python-Pillow

UBUNTU-CVE-2022-22816

Affected: Ubuntu:Pro:14.04:LTS: pillow, Ubuntu:Pro:16.04:LTS: pillow, Ubuntu:18.04:LTS: pillow, Ubuntu:20.04:LTS: pillow, Ubuntu:Pro:20.04:LTS: pillow-python2, Ubuntu:22.04:LTS: pillow

path_getbbox in path.c in Pillow before 9.0.0 has a buffer over-read during initialization of ImagePath.Path.

WID-SEC-W-2022-0302 — Xerox FreeFlow Print Server: Mehrere Schwachstellen ermöglichen Ausführen von beliebigem Programmcode mit Administrator…

Ein entfernter, authentisierter Angreifer kann mehrere Schwachstellen in Xerox FreeFlow Print Server ausnutzen, um beliebigen Programmcode auszuführen, einen Cross-Site-Scripting-Angriff durchzuführen, Informationen offenzulegen, einen Denial-of-Service-Zustand zu verursachen oder Dateien zu manipulieren.