Most recent entries from all

ALSA-2022:0643 — Important: python-pillow security update

Affected: AlmaLinux:8: python3-pillow, AlmaLinux:8: python3-pillow-devel, AlmaLinux:8: python3-pillow-doc, AlmaLinux:8: python3-pillow-tk

The python-pillow packages contain a Python image processing library that provides extensive file format support, an efficient internal representation, and powerful image-processing capabilities.

Security Fix(es):

* python-pillow: PIL.ImageMath.eval allows evaluation of arbitrary expressions (CVE-2022-22817)

* python-pillow: buffer over-read during initialization of ImagePath.Path in path_getbbox() in path.c (CVE-2022-22816)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

bdu:2022-00583

BIT-pillow-2022-22817

Affected: Bitnami: pillow

PIL.ImageMath.eval in Pillow before 9.0.0 allows evaluation of arbitrary expressions, such as ones that use the Python exec method. A lambda expression could also be used.

BREW-pillow-CVE-2022-22817

Affected: Homebrew: pillow

PIL.ImageMath.eval in Pillow before 9.0.0 allows evaluation of arbitrary expressions, such as ones that use the Python exec method. A lambda expression could also be used.

cnvd-2022-05434

EUVD-2026-195924

fkie_cve-2022-22817

PIL.ImageMath.eval in Pillow before 9.0.0 allows evaluation of arbitrary expressions, such as ones that use the Python exec method. A lambda expression could also be used.

GHSA-8vj2-vxx3-667w — Arbitrary expression injection in Pillow

Affected: PyPI: pillow

`PIL.ImageMath.eval` in Pillow before 9.0.0 allows evaluation of arbitrary expressions, such as ones that use the Python exec method `ImageMath.eval("exec(exit())")`.

While Pillow 9.0.0 restricted top-level builtins available to PIL.ImageMath.eval(), it did not prevent builtins available to lambda expressions. These are now also restricted in 9.0.1.

gsd-2022-22817

OESA-2022-1526 — python-pillow security update

Affected: openEuler:20.03-LTS-SP1: python-pillow, openEuler:20.03-LTS-SP2: python-pillow, openEuler:20.03-LTS-SP3: python-pillow

Python image processing library. Security Fix(es): path_getbbox in path.c in Pillow before 9.0.0 has a buffer over-read during initialization of ImagePath.Path.(CVE-2022-22816) PIL.ImageMath.eval in Pillow before 9.0.0 allows evaluation of arbitrary expressions, such as ones that use the Python exec method.(CVE-2022-22817) path_getbbox in path.c in Pillow before 9.0.0 improperly initializes ImagePath.Path.(CVE-2022-22815)

openSUSE-SU-2024:11814-1 — python310-Pillow-9.0.1-1.1 on GA media

python310-Pillow-9.0.1-1.1 on GA media

PYSEC-2022-10

Affected: PyPI: pillow

PIL.ImageMath.eval in Pillow before 9.0.0 allows evaluation of arbitrary expressions, such as ones that use the Python exec method.

RHSA-2022:0665 — Red Hat Security Advisory: python-pillow security update

python-pillow: buffer over-read during initialization of ImagePath.Path in path_getbbox() in path.c python-pillow: PIL.ImageMath.eval allows evaluation of arbitrary expressions

SUSE-SU-2024:0290-1 — Security update for python-Pillow

Security update for python-Pillow

UBUNTU-CVE-2022-22817

Affected: Ubuntu:18.04:LTS: pillow, Ubuntu:20.04:LTS: pillow, Ubuntu:Pro:20.04:LTS: pillow-python2

PIL.ImageMath.eval in Pillow before 9.0.0 allows evaluation of arbitrary expressions, such as ones that use the Python exec method. A lambda expression could also be used.

WID-SEC-W-2022-0302 — Xerox FreeFlow Print Server: Mehrere Schwachstellen ermöglichen Ausführen von beliebigem Programmcode mit Administrator…

Ein entfernter, authentisierter Angreifer kann mehrere Schwachstellen in Xerox FreeFlow Print Server ausnutzen, um beliebigen Programmcode auszuführen, einen Cross-Site-Scripting-Angriff durchzuführen, Informationen offenzulegen, einen Denial-of-Service-Zustand zu verursachen oder Dateien zu manipulieren.