Fixed packages 2
| Release | Package | Fixed in |
|---|---|---|
| Debian · 11 | pillow | 8.1.2+dfsg-0.3+deb11u2 |
| Debian · 12 | pillow | 9.4.0-1.1+deb12u1 |
Vulnerabilities 3
-
High 8.1
Arbitrary Code Execution in Pillow
Pillow through 10.1.0 allows PIL.ImageMath.eval Arbitrary Code Execution via the environment parameter, a different vulnerability than CVE-2022-22817 (which was about the expression parameter).
-
High 7.5
Pillow Denial of Service vulnerability
An issue was discovered in Pillow before 10.0.0. It is a Denial of Service that uncontrollably allocates memory to process a given task, potentially causing a service to crash by having it run out of memory. This occurs for truetype in ImageFont when textleng…
-
Medium 6.7
Pillow buffer overflow vulnerability
In _imagingcms.c in Pillow before 10.3.0, a buffer overflow exists because strcpy is used instead of strncpy.