Fedora 31 : python-pillow (2020-df444e464e)

Update to 6.2.2, fixes CVE-2020-5313, CVE-2020-5312, CVE-2020-5311, CVE-2020-5310. Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website. Tenable has attempted to automatically clean and format it as much as possible withou...

[SECURITY] [DLA 2057-1] pillow security update

Package : pillow Version : 2.6.1-2+deb8u4 CVE IDs : CVE-2019-19911 CVE-2020-5312 CVE-2020-5313 Debian Bug : 948224 It was discovered that there were three vulnerabilities in Pillow, an imaging library for the Python programming language: CVE-2019-19911: Prevent a denial-of-service vulnerability...

dcicsnovault (>=2.0.0b4, <=4.0.0b2), django-dynamic-scraper (>=0.11.4, <=0.13.1) +13 more potentially affected by CVE-2020-5312 via pillow (3.4.2)

pillow PYPI version 3.4.2 is affected by a known vulnerability. The following packages have a transitive dependency on pillow and may be impacted: - dcicsnovault =2.0.0b4, =0.11.4, =0.18.1, =0.6.12a2, =0.9.0, =0.2.1, =0.0.3, =1.6.0, =1.4.0, =1.12.0 - yulelog 0.0.3 Source cves: CVE-2020-5312 Sourc...

stoqdrivers (2.0.1) potentially affected by CVE-2020-5312 via pillow (3.1.2)

pillow PYPI version 3.1.2 is affected by a known vulnerability. The following packages have a transitive dependency on pillow and may be impacted: - stoqdrivers 2.0.1 Source cves: CVE-2020-5312 Source advisory: OSV:PYSEC-2020-83...

ayabinterface (0.0.8), hjun (0.2.2) +3 more potentially affected by CVE-2020-5312 via pillow (3.2.0)

pillow PYPI version 3.2.0 is affected by a known vulnerability. The following packages have a transitive dependency on pillow and may be impacted: - ayabinterface 0.0.8 - hjun 0.2.2 - kniteditor =0.0.8, =0.1.17, =0.1.19 - thumpy 0.3.2 Source cves: CVE-2020-5312 Source advisory: OSV:PYSEC-2020-83...

ayab (0.9.0), distribusi (>=0.0.2, <=0.0.4) potentially affected by CVE-2020-5312 via pillow (4.1.0)

pillow PYPI version 4.1.0 is affected by a known vulnerability. The following packages have a transitive dependency on pillow and may be impacted: - ayab 0.9.0 - distribusi =0.0.2, =0.0.4 Source cves: CVE-2020-5312 Source advisory: OSV:PYSEC-2020-83...

blockies (0.0.1), demosys-py (>=0.1.2, <=0.3.12) +17 more potentially affected by CVE-2020-5312 via pillow (4.0.0)

pillow PYPI version 4.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on pillow and may be impacted: - blockies 0.0.1 - demosys-py =0.1.2, =0.0.2, =1.6.3, =0.1.0, =0.1.0, =0.1.0, =0.1.0, =0.1.0, =2.0.0, =0.1.0, =3.0.0 and more Source cves: CVE-2020-53...

arpegio (>=0.1.3, <=0.3.4), django-versatileimagefield (1.6.1) +2 more potentially affected by CVE-2020-5312 via pillow (3.3.3)

pillow PYPI version 3.3.3 is affected by a known vulnerability. The following packages have a transitive dependency on pillow and may be impacted: - arpegio =0.1.3, =0.6.12a3, =0.6.12 Source cves: CVE-2020-5312 Source advisory: OSV:PYSEC-2020-83...

al-for-design (0.0.1), aug (0.1.0) +188 more potentially affected by CVE-2020-5312 via pillow (>=6.0.0, <=6.2.1)

pillow PYPI version =6.0.0, =0.0.5, =0.0.15b20201014, =0.0.15b20201024, =0.0.16b20210114, =0.0.15b20201024, =0.0.121, =0.0.1, =0.0.1, =0.0.1, =0.0.1, =0.0.2, =0.2.0, =0.2.1 and more Source cves: CVE-2020-5312 Source advisory: OSV:PYSEC-2020-83...

dcicsnovault (>=2.0.0b0, <=2.0.0b11), shot-detector (0.0.4.dev41) +2 more potentially affected by CVE-2020-5312 via pillow (3.3.0)

pillow PYPI version 3.3.0 is affected by a known vulnerability. The following packages have a transitive dependency on pillow and may be impacted: - dcicsnovault =2.0.0b0, =0.2.3, =0.0.1, =0.1.0 Source cves: CVE-2020-5312 Source advisory: OSV:PYSEC-2020-83...

CVE-2020-5312

CVE-2020-5312 is a Pillow vulnerability where libImaging/PcxDecode.c may overflow the PCX P mode buffer in Pillow versions before 6.2.2. The issue arises during decoding PCX images and could impact memory handling in affected builds. Public advisories and release notes indicate upgrading Pillow t...

Medium: libxml2

Issue Overview: A denial of service flaw was found in libxml2. A remote attacker could provide a specially crafted XML or HTML file that, when processed by an application using libxml2, would cause that application to leak potentially sensitive information.CVE-2015-8242 A denial of service flaw w...

Denial Of Service (DoS)

The libxml2 library is a development toolbox providing the implementation of various XML standards. Several denial of service flaws were found in libxml2, a library providing support for reading, modifying, and writing XML and HTML files. A remote attacker could provide a specially crafted XML or...

CVE-2019-5312

CVE-2019-5312 affects weixin-java-tools v3.3.0. An XXE vulnerability exists in BaseWxPayResult.getXmlDoc, tied to an incomplete fix for CVE-2018-20318. Public references indicate high/critical impact (NETWORK, no authentication, victim capable of network access) with both CVSS v2 (7.5, PARTIAL co...

CVE-2019-5312: Improper Restriction of XML External Entity Reference

An issue was discovered in weixin-java-tools v3.3.0. There is an XXE vulnerability in the getXmlDoc method of the BaseWxPayResult.java file. NOTE: this issue exists because of an incomplete fix for CVE-2018-20318...

Security Bulletin: jQuery UI title/default content cross-site scripting (CVE-2012-6662 and CVE-2010-5312)

Question Security Bulletin: jQuery UI title/default content cross-site scripting CVE-2012-6662 and CVE-2010-5312 Answer Abstract: The jQuery UI is vulnerable to cross-site scripting which is caused by improper validation of user-supplied input as well as input by the default content. A remote...

Security Bulletin: Fixes for Multiple Security Vulnerabilities in IBM Security Identity Manager Virtual Appliance available

Summary There are multiple security vulnerabilities in various components used by IBM Security Identity Manager Virtual Appliance Vulnerability Details CVEID: CVE-2016-0402 DESCRIPTION: An unspecified vulnerability in Oracle Java SE and Java SE Embedded related to the Networking component has no...

edificio-real-habinedita-5312.empreendimentos.com.pt XSS vulnerability

Open Bug Bounty ID: OBB-629066 Description| Value ---|--- Affected Website:| edificio-real-habinedita-5312.empreendimentos.com.pt Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-...

Design/Logic Flaw

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit Reader 8.3.2.25013. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the...

CVE-2018-9935

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit Reader 8.3.2.25013. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the...