Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
114 results · page 2 of 3
Jul 6, 2026Pillow is a Python imaging library.CVE-2026-54060 · Other software · python-pillow · reported by GitHubHigh 7.5
Pillow is a Python imaging library. Prior to 12.3.0, PIL/FontFile.py FontFile.compile() assembled per-glyph images into a combined bitmap with Image.new("1", (xsize, ysize)) without calling Image._decompression_bomb_check(), allowing a font to trigger excessive allocation during conversion or saving. This issue is fixed in version 12.3.0.
- Product
- Pillow
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 6, 2026Pillow is a Python imaging library.CVE-2026-54059 · Other software · python-pillow · reported by GitHubHigh 7.5
Pillow is a Python imaging library. Prior to 12.3.0, PIL/PcfFontFile.py _load_bitmaps() read glyph dimensions from the PCF METRICS section and passed them directly to Image.frombytes() without calling Image._decompression_bomb_check(), allowing crafted PCF font data to cause excessive memory allocation. This issue is fixed in version 12.3.0.
- Product
- Pillow
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 9, 2026Pillow is a Python imaging library.CVE-2026-42311 · Other software · python-pillow · reported by GitHubHigh 8.6
Pillow is a Python imaging library. From version 10.3.0 to before version 12.2.0, processing a malicious PSD file could lead to memory corruption, potentially resulting in a crash or arbitrary code execution. This issue has been patched in version 12.2.0.
- Product
- Pillow
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 9, 2026Pillow is a Python imaging library.CVE-2026-42310 · Other software · python-pillow · reported by GitHubMedium 5.1
Pillow is a Python imaging library. From version 4.2.0 to before version 12.2.0, an attacker can supply a malicious PDF that causes the process to hang indefinitely, consuming 100% CPU and making the application unresponsive. This issue has been patched in version 12.2.0.
- Product
- Pillow
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 9, 2026Pillow is a Python imaging library.CVE-2026-42309 · Other software · python-pillow · reported by GitHubMedium 5.1
Pillow is a Python imaging library. From version 11.2.1 to before version 12.2.0, passing nested lists as coordinates to APIs that accept coordinates such as ImagePath.Path, ImageDraw.ImageDraw.polygon and ImageDraw.ImageDraw.line could cause a heap buffer overflow, as nested lists were recursively unpacked beyond the allocated buffer. Coordinate lists are now validated to contain exactly two numeric coordinates. This issue has been patched in version 12.2.0.
- Product
- Pillow
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 9, 2026Pillow is a Python imaging library.CVE-2026-42308 · Other software · python-pillow · reported by GitHubMedium 5.1
Pillow is a Python imaging library. Prior to version 12.2.0, if a font advances for each glyph by an exceeding large amount, when Pillow keeps track of the current position, it may lead to an integer overflow. This issue has been patched in version 12.2.0.
- Product
- Pillow
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 15, 2026Pillow is a Python imaging library.CVE-2026-40192 · Other software · python-pillow · reported by GitHubHigh 8.7
Pillow is a Python imaging library. Versions 10.3.0 through 12.1.1 did not limit the amount of GZIP-compressed data read when decoding a FITS image, making them vulnerable to decompression bomb attacks. A specially crafted FITS file could cause unbounded memory consumption, leading to denial of service (OOM crash or severe performance degradation). If users are unable to immediately upgrade, they should only open specific image formats, excluding FITS, as a workaround.
- Product
- Pillow
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 27, 2026pillow_heif is a Python library for working with HEIF images and plugin for Pillow.CVE-2026-28231 · Other software · bigcat88 · reported by GitHubMedium 5.5
pillow_heif is a Python library for working with HEIF images and plugin for Pillow. Prior to version 1.3.0, an integer overflow in the encode path buffer validation of `_pillow_heif.c` allows an attacker to bypass bounds checks by providing large image dimensions, resulting in a heap out-of-bounds read. This can lead to information disclosure (server heap memory leaking into encoded images) or denial of service (process crash). No special configuration is required — this triggers under default settings. Version 1.3.0 fixes the issue.
- Product
- pillow_heif
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 11, 2026Pillow is a Python imaging library.CVE-2026-25990 · Other software · python-pillow · reported by GitHubHigh 8.6
Pillow is a Python imaging library. From 10.3.0 to before 12.1.1, an out-of-bounds write may be triggered when loading a specially crafted PSD image. This vulnerability is fixed in 12.1.1.
- Product
- Pillow
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 1, 2025Pillow is a Python imaging library.CVE-2025-48379 · Other software · python-pillow · reported by GitHubHigh 7.1
Pillow is a Python imaging library. In versions 11.2.0 to before 11.3.0, there is a heap buffer overflow when writing a sufficiently large (>64k encoded with default settings) image in the DDS format due to writing into a buffer without checking for available space. This only affects users who save untrusted data as a compressed DDS image. This issue has been patched in version 11.3.0.
- Product
- Pillow
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 2, 2024In _imagingcms.c in Pillow before 10.3.0, a buffer overflow exists because strcpy is used instead of strncpy.CVE-2024-28219 · Other software · fedoraproject · reported by MITREMedium 6.7
In _imagingcms.c in Pillow before 10.3.0, a buffer overflow exists because strcpy is used instead of strncpy.
- Product
- fedora
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlists.debian.orglists.fedoraproject.org
Jan 19, 2024Pillow through 10.1.0 allows PIL.ImageMath.eval Arbitrary Code Execution via the environment parameter, a different vulnerability than CVE-2022-22817 (which wasCVE-2023-50447 · Other software · python · reported by MITREHigh 8.1
Pillow through 10.1.0 allows PIL.ImageMath.eval Arbitrary Code Execution via the environment parameter, a different vulnerability than CVE-2022-22817 (which was about the expression parameter).
- Product
- pillow
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordopenwall.comdevhub.checkmarx.com
Nov 3, 2023An issue was discovered in Pillow before 10.0.0.CVE-2023-44271 · Other software · Python · reported by MITREHigh 7.5
An issue was discovered in Pillow before 10.0.0. It is a Denial of Service that uncontrollably allocates memory to process a given task, potentially causing a service to crash by having it run out of memory. This occurs for truetype in ImageFont when textlength in an ImageDraw instance operates on a long text argument.
- Product
- Pillow
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddevhub.checkmarx.comgithub.com
Sep 29, 2023pretix before 2023.7.2 allows Pillow to parse EPS files.CVE-2023-44464 · Other software · rami · reported by MITREHigh 7.8
pretix before 2023.7.2 allows Pillow to parse EPS files.
- Product
- pretix
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 14, 2022Pillow before 9.3.0 allows denial of service via SAMPLESPERPIXEL.CVE-2022-45199 · Other software · Python · reported by MITREHigh 7.5
Pillow before 9.3.0 allows denial of service via SAMPLESPERPIXEL.
- Product
- Pillow
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbugs.gentoo.orggithub.com
Nov 14, 2022Pillow before 9.2.0 performs Improper Handling of Highly Compressed GIF Data (Data Amplification).CVE-2022-45198 · Other software · Python · reported by MITREHigh 7.5
Pillow before 9.2.0 performs Improper Handling of Highly Compressed GIF Data (Data Amplification).
- Product
- Pillow
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbugs.gentoo.orgcwe.mitre.org
May 25, 2022libImaging/TgaRleDecode.c in Pillow 9.1.0 has a heap buffer overflow in the processing of invalid TGA image files.CVE-2022-30595 · Other software · Python · reported by MITRECritical 9.8
libImaging/TgaRleDecode.c in Pillow 9.1.0 has a heap buffer overflow in the processing of invalid TGA image files.
- Product
- Pillow
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.compillow.readthedocs.io
Mar 27, 2022Pillow before 9.0.1 allows attackers to delete files because spaces in temporary pathnames are mishandled.CVE-2022-24303 · Other software · Python · reported by MITRECritical 9.1
Pillow before 9.0.1 allows attackers to delete files because spaces in temporary pathnames are mishandled.
- Product
- Pillow
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comlists.fedoraproject.org
Jan 10, 2022PIL.ImageMath.eval in Pillow before 9.0.0 allows evaluation of arbitrary expressions, such as ones that use the Python exec method.CVE-2022-22817 · Other software · Python · reported by MITRECritical 9.8
PIL.ImageMath.eval in Pillow before 9.0.0 allows evaluation of arbitrary expressions, such as ones that use the Python exec method. A lambda expression could also be used.
- Product
- Pillow
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlists.debian.orglists.debian.org
Jan 10, 2022path_getbbox in path.c in Pillow before 9.0.0 has a buffer over-read during initialization of ImagePath.Path.CVE-2022-22816 · Other software · Python · reported by MITREMedium 6.5
path_getbbox in path.c in Pillow before 9.0.0 has a buffer over-read during initialization of ImagePath.Path.
- Product
- Pillow
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comlists.debian.org
Jan 10, 2022path_getbbox in path.c in Pillow before 9.0.0 improperly initializes ImagePath.Path.CVE-2022-22815 · Other software · Python · reported by MITREMedium 6.5
path_getbbox in path.c in Pillow before 9.0.0 improperly initializes ImagePath.Path.
- Product
- Pillow
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comlists.debian.org
Sep 3, 2021The package pillow 5.2.0 and before 8.3.2 are vulnerable to Regular Expression Denial of Service (ReDoS) via the getrgb function.CVE-2021-23437 · Other software · Python · reported by report@snyk.ioHigh 7.5
The package pillow 5.2.0 and before 8.3.2 are vulnerable to Regular Expression Denial of Service (ReDoS) via the getrgb function.
- Product
- Pillow
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comlists.debian.org
Jul 13, 2021Pillow through 8.2.0 and PIL (aka Python Imaging Library) through 1.1.7 allow an attacker to pass controlled parameters directly into a convert function to trigCVE-2021-34552 · Other software · Python · reported by MITRECritical 9.8
Pillow through 8.2.0 and PIL (aka Python Imaging Library) through 1.1.7 allow an attacker to pass controlled parameters directly into a convert function to trigger a buffer overflow in Convert.c.
- Product
- Pillow
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlists.debian.orglists.fedoraproject.org
Jun 2, 2021An issue was discovered in Pillow before 8.2.0.CVE-2021-28678 · Other software · Python · reported by MITREMedium 5.5
An issue was discovered in Pillow before 8.2.0. For BLP data, BlpImagePlugin did not properly check that reads (after jumping to file offsets) returned data. This could lead to a DoS where the decoder could be run a large number of times on empty data.
- Product
- Pillow
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comlists.fedoraproject.org
Jun 2, 2021An issue was discovered in Pillow before 8.2.0.CVE-2021-28677 · Other software · Python · reported by MITREHigh 7.5
An issue was discovered in Pillow before 8.2.0. For EPS data, the readline implementation used in EPSImageFile has to deal with any combination of \r and \n as line endings. It used an accidentally quadratic method of accumulating lines while looking for a line ending. A malicious EPS file could use this to perform a DoS of Pillow in the open phase, before an image was accepted for opening.
- Product
- Pillow
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comlists.debian.org
Jun 2, 2021An issue was discovered in Pillow before 8.2.0.CVE-2021-28676 · Other software · Python · reported by MITREHigh 7.5
An issue was discovered in Pillow before 8.2.0. For FLI data, FliDecode did not properly check that the block advance was non-zero, potentially leading to an infinite loop on load.
- Product
- Pillow
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 2, 2021An issue was discovered in Pillow before 8.2.0.CVE-2021-25288 · Other software · Python · reported by MITRECritical 9.1
An issue was discovered in Pillow before 8.2.0. There is an out-of-bounds read in J2kDecode, in j2ku_gray_i.
- Product
- Pillow
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comlists.fedoraproject.org
Jun 2, 2021An issue was discovered in Pillow before 8.2.0.CVE-2021-25287 · Other software · Python · reported by MITRECritical 9.1
An issue was discovered in Pillow before 8.2.0. There is an out-of-bounds read in J2kDecode, in j2ku_graya_la.
- Product
- Pillow
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comlists.fedoraproject.org
Jun 2, 2021An issue was discovered in Pillow before 8.2.0.CVE-2021-28675 · Other software · Python · reported by MITREMedium 5.5
An issue was discovered in Pillow before 8.2.0. PSDImagePlugin.PsdImageFile lacked a sanity check on the number of input layers relative to the size of the data block. This could lead to a DoS on Image.open prior to Image.load.
- Product
- Pillow
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlists.fedoraproject.orgpillow.readthedocs.io
Mar 19, 2021An issue was discovered in Pillow before 8.1.1.CVE-2021-25293 · Other software · Python · reported by MITREHigh 7.5
An issue was discovered in Pillow before 8.1.1. There is an out-of-bounds read in SGIRleDecode.c.
- Product
- Pillow
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpillow.readthedocs.iosecurity.gentoo.org
Mar 19, 2021An issue was discovered in Pillow before 8.1.1.CVE-2021-25292 · Other software · Python · reported by MITREMedium 6.5
An issue was discovered in Pillow before 8.1.1. The PDF parser allows a regular expression DoS (ReDoS) attack via a crafted PDF file because of a catastrophic backtracking regex.
- Product
- Pillow
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpillow.readthedocs.iosecurity.gentoo.org
Mar 19, 2021An issue was discovered in Pillow before 8.1.1.CVE-2021-25291 · Other software · Python · reported by MITREHigh 7.5
An issue was discovered in Pillow before 8.1.1. In TiffDecode.c, there is an out-of-bounds read in TiffreadRGBATile via invalid tile boundaries.
- Product
- Pillow
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpillow.readthedocs.iosecurity.gentoo.org
Mar 19, 2021An issue was discovered in Pillow before 8.1.1.CVE-2021-25290 · Other software · Python · reported by MITREHigh 7.5
An issue was discovered in Pillow before 8.1.1. In TiffDecode.c, there is a negative-offset memcpy with an invalid size.
- Product
- Pillow
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlists.debian.orgpillow.readthedocs.io
Mar 19, 2021An issue was discovered in Pillow before 8.1.1.CVE-2021-25289 · Other software · Python · reported by MITRECritical 9.8
An issue was discovered in Pillow before 8.1.1. TiffDecode has a heap-based buffer overflow when decoding crafted YCbCr files because of certain interpretation conflicts with LibTIFF in RGBA mode. NOTE: this issue exists because of an incomplete fix for CVE-2020-35654.
- Product
- Pillow
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpillow.readthedocs.iosecurity.gentoo.org
Mar 3, 2021Pillow before 8.1.2 allows attackers to cause a denial of service (memory consumption) because the reported size of a contained image is not properly checked foCVE-2021-27923 · Other software · Python · reported by MITREHigh 7.5
Pillow before 8.1.2 allows attackers to cause a denial of service (memory consumption) because the reported size of a contained image is not properly checked for an ICO container, and thus an attempted memory allocation can be very large.
- Product
- Pillow
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlists.fedoraproject.orglists.fedoraproject.org
Mar 3, 2021Pillow before 8.1.2 allows attackers to cause a denial of service (memory consumption) because the reported size of a contained image is not properly checked foCVE-2021-27922 · Other software · Python · reported by MITREHigh 7.5
Pillow before 8.1.2 allows attackers to cause a denial of service (memory consumption) because the reported size of a contained image is not properly checked for an ICNS container, and thus an attempted memory allocation can be very large.
- Product
- Pillow
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlists.fedoraproject.orglists.fedoraproject.org
Mar 3, 2021Pillow before 8.1.2 allows attackers to cause a denial of service (memory consumption) because the reported size of a contained image is not properly checked foCVE-2021-27921 · Other software · Python · reported by MITREHigh 7.5
Pillow before 8.1.2 allows attackers to cause a denial of service (memory consumption) because the reported size of a contained image is not properly checked for a BLP container, and thus an attempted memory allocation can be very large.
- Product
- Pillow
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlists.fedoraproject.orglists.fedoraproject.org
Jan 12, 2021In Pillow before 8.1.0, SGIRleDecode has a 4-byte buffer over-read when decoding crafted SGI RLE image files because offsets and length tables are mishandled.CVE-2020-35655 · Other software · Python · reported by MITREMedium 5.4
In Pillow before 8.1.0, SGIRleDecode has a 4-byte buffer over-read when decoding crafted SGI RLE image files because offsets and length tables are mishandled.
- Product
- Pillow
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlists.fedoraproject.orglists.fedoraproject.org
Jan 12, 2021In Pillow before 8.1.0, TiffDecode has a heap-based buffer overflow when decoding crafted YCbCr files because of certain interpretation conflicts with LibTIFF iCVE-2020-35654 · Other software · Python · reported by MITREHigh 8.8
In Pillow before 8.1.0, TiffDecode has a heap-based buffer overflow when decoding crafted YCbCr files because of certain interpretation conflicts with LibTIFF in RGBA mode.
- Product
- Pillow
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlists.fedoraproject.orglists.fedoraproject.org
Jan 12, 2021In Pillow before 8.1.0, PcxDecode has a buffer over-read when decoding a crafted PCX file because the user-supplied stride value is trusted for buffer calculatiCVE-2020-35653 · Other software · Python · reported by MITREHigh 7.1
In Pillow before 8.1.0, PcxDecode has a buffer over-read when decoding a crafted PCX file because the user-supplied stride value is trusted for buffer calculations.
- Product
- Pillow
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlists.debian.orglists.fedoraproject.org
Jun 25, 2020In libImaging/SgiRleDecode.c in Pillow through 7.0.0, a number of out-of-bounds reads exist in the parsing of SGI image files, a different issue than CVE-2020-5CVE-2020-11538 · Other software · Python · reported by MITREHigh 8.1
In libImaging/SgiRleDecode.c in Pillow through 7.0.0, a number of out-of-bounds reads exist in the parsing of SGI image files, a different issue than CVE-2020-5311.
- Product
- Pillow
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 25, 2020In libImaging/Jpeg2KDecode.c in Pillow before 7.1.0, there are multiple out-of-bounds reads via a crafted JP2 file.CVE-2020-10994 · Other software · Python · reported by MITREMedium 5.5
In libImaging/Jpeg2KDecode.c in Pillow before 7.1.0, there are multiple out-of-bounds reads via a crafted JP2 file.
- Product
- Pillow
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 25, 2020In Pillow before 7.1.0, there are two Buffer Overflows in libImaging/TiffDecode.c.CVE-2020-10379 · Other software · Python · reported by MITREHigh 7.8
In Pillow before 7.1.0, there are two Buffer Overflows in libImaging/TiffDecode.c.
- Product
- Pillow
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 25, 2020In libImaging/PcxDecode.c in Pillow before 7.1.0, an out-of-bounds read can occur when reading PCX files where state->shuffle is instructed to read beyond stateCVE-2020-10378 · Other software · Python · reported by MITREMedium 5.5
In libImaging/PcxDecode.c in Pillow before 7.1.0, an out-of-bounds read can occur when reading PCX files where state->shuffle is instructed to read beyond state->buffer.
- Product
- Pillow
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 25, 2020Pillow before 7.1.0 has multiple out-of-bounds reads in libImaging/FliDecode.c.CVE-2020-10177 · Other software · Python · reported by MITREMedium 5.5
Pillow before 7.1.0 has multiple out-of-bounds reads in libImaging/FliDecode.c.
- Product
- Pillow
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 5, 2020There is a DoS vulnerability in Pillow before 6.2.2 caused by FpxImagePlugin.py calling the range function on an unvalidated 32-bit integer if the number of banCVE-2019-19911 · Other software · Python · reported by MITREHigh 7.5
There is a DoS vulnerability in Pillow before 6.2.2 caused by FpxImagePlugin.py calling the range function on an unvalidated 32-bit integer if the number of bands is large. On Windows running 32-bit Python, this results in an OverflowError or MemoryError due to the 2 GB limit. However, on Linux running 64-bit Python this results in the process being terminated by the OOM killer.
- Product
- Pillow
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlists.fedoraproject.orgpillow.readthedocs.io
Jan 2, 2020libImaging/FliDecode.c in Pillow before 6.2.2 has an FLI buffer overflow.CVE-2020-5313 · Other software · Python · reported by MITREHigh 7.1
libImaging/FliDecode.c in Pillow before 6.2.2 has an FLI buffer overflow.
- Product
- Pillow
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comlists.fedoraproject.org
Jan 2, 2020libImaging/PcxDecode.c in Pillow before 6.2.2 has a PCX P mode buffer overflow.CVE-2020-5312 · Other software · Python · reported by MITRECritical 9.8
libImaging/PcxDecode.c in Pillow before 6.2.2 has a PCX P mode buffer overflow.
- Product
- Pillow
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordaccess.redhat.comaccess.redhat.com
Jan 2, 2020libImaging/SgiRleDecode.c in Pillow before 6.2.2 has an SGI buffer overflow.CVE-2020-5311 · Other software · Python · reported by MITRECritical 9.8
libImaging/SgiRleDecode.c in Pillow before 6.2.2 has an SGI buffer overflow.
- Product
- Pillow
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordaccess.redhat.comaccess.redhat.com
Jan 2, 2020libImaging/TiffDecode.c in Pillow before 6.2.2 has a TIFF decoding integer overflow, related to realloc.CVE-2020-5310 · Other software · Python · reported by MITREHigh 8.8
libImaging/TiffDecode.c in Pillow before 6.2.2 has a TIFF decoding integer overflow, related to realloc.
- Product
- Pillow
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comlists.fedoraproject.org
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.