Fixed packages 1
| Release | Package | Fixed in |
|---|---|---|
| Debian · 11 | pillow | 8.1.2+dfsg-0.3+deb11u3 |
Vulnerabilities 3
-
Critical 9.1
Path traversal in Pillow
Pillow before 9.0.1 allows attackers to delete files because spaces in temporary pathnames are mishandled.
-
High 7.5
Regular Expression Denial of Service (ReDoS)
The package pillow 5.2.0 and before 8.3.2 are vulnerable to Regular Expression Denial of Service (ReDoS) via the getrgb function.
-
High 7.5
Pillow vulnerable to Data Amplification attack.
Pillow before 9.2.0 performs Improper Handling of Highly Compressed GIF Data (Data Amplification).