rpm package
almalinux/python3-pillow
pkg:rpm/almalinux/python3-pillow
Vulnerabilities (26)
| CVE | Sev | CVSS | KEV | Affected versions | Fixed in | Published | Description |
|---|---|---|---|---|---|---|---|
| CVE-2026-59197 | Hig | 8.2 | < 5.1.1-23.el8_10 | 5.1.1-23.el8_10 | Jul 14, 2026 | Pillow is a Python imaging library. Prior to 12.3.0, Pillow's public rank-filter API can trigger a native heap out-of-bounds write when given a very large odd filter size because ImageFilter.RankFilter.filter() calls image.expand(size // 2, size // 2) before rank-filter size vali | |
| CVE-2026-54058 | Cri | 9.1 | < 5.1.1-23.el8_10 | 5.1.1-23.el8_10 | Jul 14, 2026 | Pillow is a Python imaging library. Prior to 12.3.0, when Pillow loads an uncompressed McIdas AREA image from a filename through the mmap raw codec path, attacker-controlled header words can set a row stride smaller than the natural row width, causing pixel access such as Image.t | |
| CVE-2026-55380 | Hig | 7.5 | < 5.1.1-22.el8_10 | 5.1.1-22.el8_10 | Jul 6, 2026 | Pillow is a Python imaging library. Prior to 12.3.0, PIL/GdImageFile.py GdImageFile._open() read image dimensions from the GD 2.x header and stored them in self._size without calling Image._decompression_bomb_check(), allowing a crafted .gd file to trigger excessive C-heap alloca | |
| CVE-2026-55379 | Hig | 7.5 | < 5.1.1-22.el8_10 | 5.1.1-22.el8_10 | Jul 6, 2026 | Pillow is a Python imaging library. Prior to 12.3.0, PIL/BdfFontFile.py bdf_char() read the BBX width and height field from a BDF font file and passed attacker-controlled dimensions to Image.new() without calling Image._decompression_bomb_check(), bypassing Pillow's documented de | |
| CVE-2026-54060 | Hig | 7.5 | < 5.1.1-22.el8_10 | 5.1.1-22.el8_10 | Jul 6, 2026 | Pillow is a Python imaging library. Prior to 12.3.0, PIL/FontFile.py FontFile.compile() assembled per-glyph images into a combined bitmap with Image.new("1", (xsize, ysize)) without calling Image._decompression_bomb_check(), allowing a font to trigger excessive allocation during | |
| CVE-2026-54059 | Hig | 7.5 | < 5.1.1-22.el8_10 | 5.1.1-22.el8_10 | Jul 6, 2026 | Pillow is a Python imaging library. Prior to 12.3.0, PIL/PcfFontFile.py _load_bitmaps() read glyph dimensions from the PCF METRICS section and passed them directly to Image.frombytes() without calling Image._decompression_bomb_check(), allowing crafted PCF font data to cause exce | |
| CVE-2024-28219 | Med | 6.7 | < 5.1.1-21.el8_10 | 5.1.1-21.el8_10 | Apr 3, 2024 | In _imagingcms.c in Pillow before 10.3.0, a buffer overflow exists because strcpy is used instead of strncpy. | |
| CVE-2023-50447 | Hig | 8.1 | < 5.1.1-18.el8_9.1.alma.1 | 5.1.1-18.el8_9.1.alma.1 | Jan 19, 2024 | Pillow through 10.1.0 allows PIL.ImageMath.eval Arbitrary Code Execution via the environment parameter, a different vulnerability than CVE-2022-22817 (which was about the expression parameter). | |
| CVE-2023-44271 | Hig | 7.5 | < 5.1.1-20.el8 | 5.1.1-20.el8 | Nov 3, 2023 | An issue was discovered in Pillow before 10.0.0. It is a Denial of Service that uncontrollably allocates memory to process a given task, potentially causing a service to crash by having it run out of memory. This occurs for truetype in ImageFont when textlength in an ImageDraw in | |
| CVE-2022-22817 | Cri | 9.8 | < 5.1.1-18.el8_5 | 5.1.1-18.el8_5 | Jan 10, 2022 | PIL.ImageMath.eval in Pillow before 9.0.0 allows evaluation of arbitrary expressions, such as ones that use the Python exec method. A lambda expression could also be used. | |
| CVE-2022-22816 | Med | 6.5 | < 5.1.1-18.el8_5 | 5.1.1-18.el8_5 | Jan 10, 2022 | path_getbbox in path.c in Pillow before 9.0.0 has a buffer over-read during initialization of ImagePath.Path. | |
| CVE-2021-34552 | Cri | 9.8 | < 5.1.1-16.el8 | 5.1.1-16.el8 | Jul 13, 2021 | Pillow through 8.2.0 and PIL (aka Python Imaging Library) through 1.1.7 allow an attacker to pass controlled parameters directly into a convert function to trigger a buffer overflow in Convert.c. | |
| CVE-2021-28678 | Med | 5.5 | < 5.1.1-16.el8 | 5.1.1-16.el8 | Jun 2, 2021 | An issue was discovered in Pillow before 8.2.0. For BLP data, BlpImagePlugin did not properly check that reads (after jumping to file offsets) returned data. This could lead to a DoS where the decoder could be run a large number of times on empty data. | |
| CVE-2021-28677 | Hig | 7.5 | < 5.1.1-16.el8 | 5.1.1-16.el8 | Jun 2, 2021 | An issue was discovered in Pillow before 8.2.0. For EPS data, the readline implementation used in EPSImageFile has to deal with any combination of \r and \n as line endings. It used an accidentally quadratic method of accumulating lines while looking for a line ending. A maliciou | |
| CVE-2021-28676 | Hig | 7.5 | < 5.1.1-16.el8 | 5.1.1-16.el8 | Jun 2, 2021 | An issue was discovered in Pillow before 8.2.0. For FLI data, FliDecode did not properly check that the block advance was non-zero, potentially leading to an infinite loop on load. | |
| CVE-2021-25288 | Cri | 9.1 | < 5.1.1-16.el8 | 5.1.1-16.el8 | Jun 2, 2021 | An issue was discovered in Pillow before 8.2.0. There is an out-of-bounds read in J2kDecode, in j2ku_gray_i. | |
| CVE-2021-25287 | Cri | 9.1 | < 5.1.1-16.el8 | 5.1.1-16.el8 | Jun 2, 2021 | An issue was discovered in Pillow before 8.2.0. There is an out-of-bounds read in J2kDecode, in j2ku_graya_la. | |
| CVE-2021-28675 | Med | 5.5 | < 5.1.1-16.el8 | 5.1.1-16.el8 | Jun 2, 2021 | An issue was discovered in Pillow before 8.2.0. PSDImagePlugin.PsdImageFile lacked a sanity check on the number of input layers relative to the size of the data block. This could lead to a DoS on Image.open prior to Image.load. | |
| CVE-2021-25293 | Hig | 7.5 | < 5.1.1-16.el8 | 5.1.1-16.el8 | Mar 19, 2021 | An issue was discovered in Pillow before 8.1.1. There is an out-of-bounds read in SGIRleDecode.c. | |
| CVE-2021-25292 | Med | 6.5 | < 5.1.1-16.el8 | 5.1.1-16.el8 | Mar 19, 2021 | An issue was discovered in Pillow before 8.1.1. The PDF parser allows a regular expression DoS (ReDoS) attack via a crafted PDF file because of a catastrophic backtracking regex. |
- affected < 5.1.1-23.el8_10fixed 5.1.1-23.el8_10
Pillow is a Python imaging library. Prior to 12.3.0, Pillow's public rank-filter API can trigger a native heap out-of-bounds write when given a very large odd filter size because ImageFilter.RankFilter.filter() calls image.expand(size // 2, size // 2) before rank-filter size vali
- affected < 5.1.1-23.el8_10fixed 5.1.1-23.el8_10
Pillow is a Python imaging library. Prior to 12.3.0, when Pillow loads an uncompressed McIdas AREA image from a filename through the mmap raw codec path, attacker-controlled header words can set a row stride smaller than the natural row width, causing pixel access such as Image.t
- affected < 5.1.1-22.el8_10fixed 5.1.1-22.el8_10
Pillow is a Python imaging library. Prior to 12.3.0, PIL/GdImageFile.py GdImageFile._open() read image dimensions from the GD 2.x header and stored them in self._size without calling Image._decompression_bomb_check(), allowing a crafted .gd file to trigger excessive C-heap alloca
- affected < 5.1.1-22.el8_10fixed 5.1.1-22.el8_10
Pillow is a Python imaging library. Prior to 12.3.0, PIL/BdfFontFile.py bdf_char() read the BBX width and height field from a BDF font file and passed attacker-controlled dimensions to Image.new() without calling Image._decompression_bomb_check(), bypassing Pillow's documented de
- affected < 5.1.1-22.el8_10fixed 5.1.1-22.el8_10
Pillow is a Python imaging library. Prior to 12.3.0, PIL/FontFile.py FontFile.compile() assembled per-glyph images into a combined bitmap with Image.new("1", (xsize, ysize)) without calling Image._decompression_bomb_check(), allowing a font to trigger excessive allocation during
- affected < 5.1.1-22.el8_10fixed 5.1.1-22.el8_10
Pillow is a Python imaging library. Prior to 12.3.0, PIL/PcfFontFile.py _load_bitmaps() read glyph dimensions from the PCF METRICS section and passed them directly to Image.frombytes() without calling Image._decompression_bomb_check(), allowing crafted PCF font data to cause exce
- affected < 5.1.1-21.el8_10fixed 5.1.1-21.el8_10
In _imagingcms.c in Pillow before 10.3.0, a buffer overflow exists because strcpy is used instead of strncpy.
- affected < 5.1.1-18.el8_9.1.alma.1fixed 5.1.1-18.el8_9.1.alma.1
Pillow through 10.1.0 allows PIL.ImageMath.eval Arbitrary Code Execution via the environment parameter, a different vulnerability than CVE-2022-22817 (which was about the expression parameter).
- affected < 5.1.1-20.el8fixed 5.1.1-20.el8
An issue was discovered in Pillow before 10.0.0. It is a Denial of Service that uncontrollably allocates memory to process a given task, potentially causing a service to crash by having it run out of memory. This occurs for truetype in ImageFont when textlength in an ImageDraw in
- affected < 5.1.1-18.el8_5fixed 5.1.1-18.el8_5
PIL.ImageMath.eval in Pillow before 9.0.0 allows evaluation of arbitrary expressions, such as ones that use the Python exec method. A lambda expression could also be used.
- affected < 5.1.1-18.el8_5fixed 5.1.1-18.el8_5
path_getbbox in path.c in Pillow before 9.0.0 has a buffer over-read during initialization of ImagePath.Path.
- affected < 5.1.1-16.el8fixed 5.1.1-16.el8
Pillow through 8.2.0 and PIL (aka Python Imaging Library) through 1.1.7 allow an attacker to pass controlled parameters directly into a convert function to trigger a buffer overflow in Convert.c.
- affected < 5.1.1-16.el8fixed 5.1.1-16.el8
An issue was discovered in Pillow before 8.2.0. For BLP data, BlpImagePlugin did not properly check that reads (after jumping to file offsets) returned data. This could lead to a DoS where the decoder could be run a large number of times on empty data.
- affected < 5.1.1-16.el8fixed 5.1.1-16.el8
An issue was discovered in Pillow before 8.2.0. For EPS data, the readline implementation used in EPSImageFile has to deal with any combination of \r and \n as line endings. It used an accidentally quadratic method of accumulating lines while looking for a line ending. A maliciou
- affected < 5.1.1-16.el8fixed 5.1.1-16.el8
An issue was discovered in Pillow before 8.2.0. For FLI data, FliDecode did not properly check that the block advance was non-zero, potentially leading to an infinite loop on load.
- affected < 5.1.1-16.el8fixed 5.1.1-16.el8
An issue was discovered in Pillow before 8.2.0. There is an out-of-bounds read in J2kDecode, in j2ku_gray_i.
- affected < 5.1.1-16.el8fixed 5.1.1-16.el8
An issue was discovered in Pillow before 8.2.0. There is an out-of-bounds read in J2kDecode, in j2ku_graya_la.
- affected < 5.1.1-16.el8fixed 5.1.1-16.el8
An issue was discovered in Pillow before 8.2.0. PSDImagePlugin.PsdImageFile lacked a sanity check on the number of input layers relative to the size of the data block. This could lead to a DoS on Image.open prior to Image.load.
- affected < 5.1.1-16.el8fixed 5.1.1-16.el8
An issue was discovered in Pillow before 8.1.1. There is an out-of-bounds read in SGIRleDecode.c.
- affected < 5.1.1-16.el8fixed 5.1.1-16.el8
An issue was discovered in Pillow before 8.1.1. The PDF parser allows a regular expression DoS (ReDoS) attack via a crafted PDF file because of a catastrophic backtracking regex.
Page 1 of 2