Summary
It was discovered that Pillow incorrectly handled the deletion of temporary
files when using a temporary directory that contains spaces. An attacker could
possibly use this issue to delete arbitrary files. This issue only affected
Ubuntu 20.04 LTS. (CVE-2022-24303)
It was discovered that Pillow incorrectly handled the decompression of highly
compressed GIF data. An attacker could possibly use this issue to cause Pillow
to crash, resulting in a denial of service. (CVE-2022-45198)
Fixed packages 2
| Release | Package | Fixed in |
|---|---|---|
| Ubuntu · 20.04 LTS 20.04:LTS | pillow | 7.0.0-4ubuntu0.7 |
| Ubuntu · 22.04 LTS 22.04:LTS | pillow | 9.0.1-1ubuntu0.1 |
Vulnerabilities 2
-
Critical 9.1
Path traversal in Pillow
Pillow before 9.0.1 allows attackers to delete files because spaces in temporary pathnames are mishandled.
-
High 7.5
Pillow vulnerable to Data Amplification attack.
Pillow before 9.2.0 performs Improper Handling of Highly Compressed GIF Data (Data Amplification).