Most recent entries from all

ALSA-2024:3005 — Moderate: python-pillow security update

Affected: AlmaLinux:8: python3-pillow, AlmaLinux:8: python3-pillow-devel, AlmaLinux:8: python3-pillow-doc, AlmaLinux:8: python3-pillow-tk

The python-pillow packages contain a Python image processing library that provides extensive file format support, an efficient internal representation, and powerful image-processing capabilities.

Security Fix(es):

* python-pillow: uncontrolled resource consumption when textlength in an ImageDraw instance operates on a long text argument (CVE-2023-44271)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section.

bdu:2024-06540

BIT-pillow-2023-44271

Affected: Bitnami: pillow

An issue was discovered in Pillow before 10.0.0. It is a Denial of Service that uncontrollably allocates memory to process a given task, potentially causing a service to crash by having it run out of memory. This occurs for truetype in ImageFont when textlength in an ImageDraw instance operates on a long text argument.

BREW-pillow-CVE-2023-44271

Affected: Homebrew: pillow

EUVD-2026-9590

fkie_cve-2023-44271

GHSA-8ghj-p4vj-mr35 — Pillow Denial of Service vulnerability

Affected: PyPI: pillow

gsd-2023-44271

OESA-2023-1856 — python-pillow security update

Affected: openEuler:20.03-LTS-SP1: python-pillow, openEuler:20.03-LTS-SP3: python-pillow, openEuler:22.03-LTS: python-pillow, openEuler:22.03-LTS-SP1: python-pillow, openEuler:22.03-LTS-SP2: python-pillow

Pillow is the friendly PIL fork by Alex Clark and Contributors. PIL is the Python Imaging \ Library by Fredrik Lundh and Contributors. As of 2019, Pillow development is supported by Tidelift. %package -n python3-pillow Summary: Python 3 image processing library Provides: python3-imaging = - Security Fix(es): An issue was discovered in Pillow before 10.0.0. It is a Denial of Service that uncontrollably allocates memory to process a given task, potentially causing a service to crash by having it run out of memory. This occurs for truetype in ImageFont when textlength in an ImageDraw instance operates on a long text argument.(CVE-2023-44271)

openSUSE-SU-2024:13439-1 — python310-Pillow-10.0.1-2.1 on GA media

python310-Pillow-10.0.1-2.1 on GA media

PYSEC-2023-227

Affected: PyPI: pillow

RHSA-2024:1057 — Red Hat Security Advisory: Red Hat Ansible Automation Platform 2.4 Product Security and Bug Fix Update

pygments: ReDoS in pygments python-pillow: uncontrolled resource consumption when textlength in an ImageDraw instance operates on a long text argument python-aiohttp: numerous issues in HTTP parser with header parsing aiohttp: HTTP request modification aiohttp: CRLF injection if user controls the HTTP method using aiohttp client pycryptodome: side-channel leakage for OAEP decryption in PyCryptodome and pycryptodomex platform: Insecure websocket used when interacting with EDA server jinja2: HTML attribute injection when passing user input as keys to xmlattr filter Django: denial-of-service in ``intcomma`` template filter

SUSE-SU-2023:4465-1 — Security update for python-Pillow

Security update for python-Pillow

UBUNTU-CVE-2023-44271

Affected: Ubuntu:Pro:14.04:LTS: pillow, Ubuntu:Pro:16.04:LTS: pillow, Ubuntu:Pro:18.04:LTS: pillow, Ubuntu:20.04:LTS: pillow, Ubuntu:Pro:20.04:LTS: pillow-python2, Ubuntu:22.04:LTS: pillow

WID-SEC-W-2024-0184 — Red Hat Enterprise Linux (pillow): Schwachstelle ermöglicht Denial of Service

Ein entfernter, anonymer Angreifer kann eine Schwachstelle in Red Hat Enterprise Linux ausnutzen, um einen Denial of Service Angriff durchzuführen.