Most recent entries from all

ALSA-2024:0893 — Important: python-pillow security update

Affected: AlmaLinux:8: python3-pillow, AlmaLinux:8: python3-pillow-devel, AlmaLinux:8: python3-pillow-doc, AlmaLinux:8: python3-pillow-tk

The python-pillow packages contain a Python image processing library that provides extensive file format support, an efficient internal representation, and powerful image-processing capabilities.

Security Fix(es):

* pillow: Arbitrary Code Execution via the environment parameter (CVE-2023-50447)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

bdu:2024-00775

BIT-pillow-2023-50447

Affected: Bitnami: pillow

Pillow through 10.1.0 allows PIL.ImageMath.eval Arbitrary Code Execution via the environment parameter, a different vulnerability than CVE-2022-22817 (which was about the expression parameter).

BREW-pillow-CVE-2023-50447

Affected: Homebrew: pillow

Pillow through 10.1.0 allows PIL.ImageMath.eval Arbitrary Code Execution via the environment parameter, a different vulnerability than CVE-2022-22817 (which was about the expression parameter).

certfr-2024-avi-1103 — De multiples vulnérabilités ont été découvertes dans les produits IBM. Certaines d'entre elles permettent à un attaquan…

certfr-2024-avi-1103

EUVD-2026-10414

fkie_cve-2023-50447

Pillow through 10.1.0 allows PIL.ImageMath.eval Arbitrary Code Execution via the environment parameter, a different vulnerability than CVE-2022-22817 (which was about the expression parameter).

GHSA-3f63-hfp8-52jq — Arbitrary Code Execution in Pillow

Affected: PyPI: Pillow

Pillow through 10.1.0 allows PIL.ImageMath.eval Arbitrary Code Execution via the environment parameter, a different vulnerability than CVE-2022-22817 (which was about the expression parameter).

gsd-2023-50447

ICSA-25-203-04 — Schneider Electric EcoStruxure Power Operation (Update A)

Pillow Version 10.1.0 allows PIL.ImageMath.eval arbitrary code execution via the environment parameter. This is a different vulnerability from CVE-2022-22817, which pertains to the expression parameter. In _imagingcms.c in Pillow prior to 10.3.0, a buffer overflow exists because strcpy is used instead of strncpy. Versions of Pillow before 9.2.0 improperly handle highly compressed GIF data (data amplification). A heap buffer overflow in vp8 encoding in libvpx, used by Google Chrome versions prior to 117.0.5938.132 and libvpx Version 1.13.1 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. Envoy is a cloud-native high-performance edge/middle/service proxy. Envoy's HTTP/2 codec may leak a header map and bookkeeping structures upon receiving RST_STREAM immediately followed by the GOAWAY frames from an upstream server. In nghttp2, cleanup of pending requests due to receipt of the GOAWAY frame skips de-allocation of the bookkeeping structure and pending compressed header. The error return [code path] is taken if the connection is already marked for not sending more requests due to GOAWAY frame. The clean-up code is right after the return statement, causing a memory leak. This results in denial of service through memory exhaustion. This vulnerability was patched in Versions 1.26.3, 1.25.8, 1.24.9, 1.23.11. The HTTP/2 protocol allows a denial of service (server resource consumption) because request cancellation can reset many streams quickly,…

OESA-2024-1098 — python-pillow security update

Affected: openEuler:20.03-LTS-SP1: python-pillow, openEuler:20.03-LTS-SP4: python-pillow, openEuler:22.03-LTS: python-pillow, openEuler:22.03-LTS-SP1: python-pillow, openEuler:22.03-LTS-SP2: python-pillow, openEuler:22.03-LTS-SP3: python-pillow

Pillow is the friendly PIL fork by Alex Clark and Contributors. PIL is the Python Imaging \ Library by Fredrik Lundh and Contributors. As of 2019, Pillow development is supported by Tidelift. %package -n python3-pillow Summary: Python 3 image processing library Provides: python3-imaging = - Security Fix(es): Pillow through 10.1.0 allows PIL.ImageMath.eval Arbitrary Code Execution via the environment parameter, a different vulnerability than CVE-2022-22817 (which was about the expression parameter).(CVE-2023-50447)

openSUSE-SU-2024:0125-1 — Security update for python-Pillow

Security update for python-Pillow

PYSEC-2026-457 — Arbitrary Code Execution in Pillow

Affected: PyPI: pillow

Pillow through 10.1.0 allows PIL.ImageMath.eval Arbitrary Code Execution via the environment parameter, a different vulnerability than CVE-2022-22817 (which was about the expression parameter).

RHSA-2024:0754 — Red Hat Security Advisory: python-pillow security update

pillow: Arbitrary Code Execution via the environment parameter

SEVD-2025-189-03 — EcoStruxure™ Power Operation

Schneider Electric is aware of multiple vulnerabilities disclosed in PostgreSQL.

Many vendors, including Schneider Electric, use PostgreSQL in their offers. PostgreSQL is a database server that is used as a data store for multiple products.

Schneider Electric installs a version of PostgreSQL with its EcoStruxure™ Power Operation https://www.se.com/us/en/product-range/65405-ecostruxure-power-operation/?parent-subcategory-id=59326966&filter=business-4-low-voltage-products-and-systems#overview software.

EcoStruxure™ Power Operation (EPO) is an on-premises software offer that provides a single platform to monitor and control medium and lower power systems.

Failure to apply the remediations and mitigations below could result in loss of system functionality or unauthorized access to system functions.

SUSE-SU-2024:0185-1 — Security update for python-Pillow

Security update for python-Pillow

UBUNTU-CVE-2023-50447

Affected: Ubuntu:Pro:14.04:LTS: pillow, Ubuntu:Pro:16.04:LTS: pillow, Ubuntu:Pro:18.04:LTS: pillow, Ubuntu:20.04:LTS: pillow, Ubuntu:Pro:20.04:LTS: pillow-python2, Ubuntu:22.04:LTS: pillow, Ubuntu:24.04:LTS: pillow

Pillow through 10.1.0 allows PIL.ImageMath.eval Arbitrary Code Execution via the environment parameter, a different vulnerability than CVE-2022-22817 (which was about the expression parameter).

WID-SEC-W-2024-0337 — Red Hat Enterprise Linux (Pillow): Schwachstelle ermöglicht Codeausführung

Ein entfernter, anonymer Angreifer kann eine Schwachstelle in Red Hat Enterprise Linux in der Komponente "Pillow" ausnutzen, um beliebigen Programmcode auszuführen.