Red Hat Security AdvisoryRHSA-2021:4149
python-pillow security update
Released 2021-11-09 · Red Hat rating Moderate · View on Red Hat →
Fixed in
- Red Hat Enterprise Linux AppStream (v. 8) python-pillow-5.1.1-16.el8, python3-pillow-5.1.1-16.el8
Fixes 15 records
Priority MEDIUM 48
Pillow through 8.2.0 and PIL (aka Python Imaging Library) through 1.1.7 allow an attacker to pass controlled parameters directly into a convert function to trigger a buffer overflow in Convert.c.
CVSS 3.1CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.03188 · Published 2021-07-13 · Partial fix · 8.3.0 CWE-120
Priority MEDIUM 45
An issue was discovered in Pillow before 8.2.0.
CVSS 3.1CRITICAL 9.1· Network · No auth · No interaction · EPSS 0.02931 · Published 2021-06-02 · Partial fix · 8.2.0 CWE-125
Priority MEDIUM 44
An issue was discovered in Pillow before 8.2.0.
CVSS 3.1CRITICAL 9.1· Network · No auth · No interaction · EPSS 0.02388 · Published 2021-06-02 · Partial fix · 8.2.0 CWE-125
Priority MEDIUM 41
Pillow before 8.1.2 allows attackers to cause a denial of service (memory consumption) because the reported size of a contained image is not properly checked for an ICNS container, and thus an attempted memory allocation…
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.04851 · Published 2021-03-03 · Partial fix · 8.1.2 CWE-20
Priority LOW 39
Pillow before 8.1.2 allows attackers to cause a denial of service (memory consumption) because the reported size of a contained image is not properly checked for a BLP container, and thus an attempted memory allocation c…
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.0317 · Published 2021-03-03 · Partial fix · 8.1.2 CWE-20
Priority LOW 38
An issue was discovered in Pillow before 8.2.0.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.02469 · Published 2021-06-02 · Partial fix · 8.2.0 CWE-400
Priority LOW 38
An issue was discovered in Pillow before 8.2.0.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.02501 · Published 2021-06-02 · Partial fix · 8.2.0 CWE-835
Priority LOW 38
Pillow before 8.1.2 allows attackers to cause a denial of service (memory consumption) because the reported size of a contained image is not properly checked for an ICO container, and thus an attempted memory allocation…
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.03045 · Published 2021-03-03 · Partial fix · 8.1.2 CWE-20
Priority LOW 37
An issue was discovered in Pillow before 8.1.1.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.02372 · Published 2021-03-19 · Partial fix · 8.1.1 CWE-787
Priority LOW 36
An issue was discovered in Pillow before 8.1.1.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.01601 · Published 2021-03-19 · Partial fix · 8.1.1 CWE-125
Priority LOW 35
In Pillow before 8.1.0, PcxDecode has a buffer over-read when decoding a crafted PCX file because the user-supplied stride value is trusted for buffer calculations.
CVSS 3.1HIGH 7.1· Network · No auth · User interaction · EPSS 0.0164 · Published 2021-01-12 · Partial fix · 8.1.0 CWE-125
Priority LOW 32
An issue was discovered in Pillow before 8.1.1.
CVSS 3.1MEDIUM 6.5· Network · No auth · User interaction · EPSS 0.01727 · Published 2021-03-19 · Partial fix · 8.1.1 CWE-1333
Priority LOW 28
In Pillow before 8.1.0, SGIRleDecode has a 4-byte buffer over-read when decoding crafted SGI RLE image files because offsets and length tables are mishandled.
CVSS 3.1MEDIUM 5.4· Network · No auth · User interaction · EPSS 0.01663 · Published 2021-01-12 · Partial fix · 8.1.0 CWE-125
Priority LOW 27
An issue was discovered in Pillow before 8.2.0.
CVSS 3.1MEDIUM 5.5· Local · No auth · User interaction · EPSS 0.00956 · Published 2021-06-02 · Partial fix · 8.2.0 CWE-252
Priority LOW 26
An issue was discovered in Pillow before 8.2.0.
CVSS 3.1MEDIUM 5.5· Local · No auth · User interaction · EPSS 0.00732 · Published 2021-06-02 · Partial fix · 8.2.0 CWE-345
THREATIST.IORead the docs