583 matches found
Pillow command injection
Python Image Library PIL 1.1.7 and earlier and Pillow before 2.5.0 might allow remote attackers to execute arbitrary commands via shell metacharacters in unspecified vectors related to CVE-2014-1932, possibly JpegImagePlugin.py...
GHSA-8M9X-PXWQ-J236 Pillow command injection
Python Image Library PIL 1.1.7 and earlier and Pillow before 2.5.0 might allow remote attackers to execute arbitrary commands via shell metacharacters in unspecified vectors related to CVE-2014-1932, possibly JpegImagePlugin.py...
PIL and Pillow Vulnerable to Symlink Attack on Tmpfiles
The 1 loaddjpeg function in JpegImagePlugin.py, 2 Ghostscript function in EpsImagePlugin.py, 3 load function in IptcImagePlugin.py, and 4 copy function in Image.py in Python Image Library PIL 1.1.7 and earlier and Pillow before 2.3.1 do not properly create temporary files, which allow local users...
DEBIAN-CVE-2022-29977
There is an assertion failure error in stbijpeghuffdecode, stbimage.h:1894 in libsixel img2sixel 1.8.6. Remote attackers could leverage this vulnerability to cause a denial-of-service via a crafted JPEG file...
DEBIAN-CVE-2022-28506
There is a heap-buffer-overflow in GIFLIB 5.2.1 function DumpScreen2RGB in gif2rgb.c:298:45...
DEBIAN-CVE-2022-28041
stbimage.h v2.27 was discovered to contain an integer overflow via the function stbijpegdecodeblockprogdc. This vulnerability allows attackers to cause a Denial of Service DoS via unspecified vectors...
UBUNTU-CVE-2022-28048
STB v2.27 was discovered to contain an integer shift of invalid size in the component stbijpegdecodeblockprogac...
[SECURITY] Fedora 36 Update: giflib-5.2.1-11.fc36
giflib is a library for reading and writing gif images...
GHSA-85P9-J7C9-V4GR containers/image library Insufficiently Protects Credentials
The containers/image library used by the container tools Podman, Buildah, and Skopeo in Red Hat Enterprise Linux version 8 and CRI-O in OpenShift Container Platform, does not enforce TLS connections to the container registry authorization service. An attacker could use this vulnerability to launc...
containers/image library Insufficiently Protects Credentials
The containers/image library used by the container tools Podman, Buildah, and Skopeo in Red Hat Enterprise Linux version 8 and CRI-O in OpenShift Container Platform, does not enforce TLS connections to the container registry authorization service. An attacker could use this vulnerability to launc...
ROS-20220128-02
A vulnerability in the Python Pillow image library is related to buffer re-reading during the ImagePath.Path initialization in the pathgetbbox function in path.c. Exploitation of the vulnerability could allow an attacker acting remotely to pass a specially crafted file to a vulnerable library and...
Piwigo Cross-Site Scripting Vulnerability (CNVD-2021-101688)
Piwigo is a set of Web-based open source image library software. Piwigo has a cross-site scripting vulnerability in version 11.5.0, which stems from a lack of user-supplied data and output data validation filtering. An attacker could exploit this vulnerability to conduct XSS attacks via the syste...
CVE-2021-44017
A vulnerability has been identified in JT2Go All versions V13.2.0.5, Teamcenter Visualization All versions V13.2.0.5. The Image.dll is vulnerable to an out of bounds read past the end of an allocated buffer when parsing specially crafted TIF files. An attacker could leverage this vulnerability to...
@htmlacademy/autocheck (>=1.5.0 <=1.5.4), @htmlacademy/courses-task-checks (>=1.0.10-14 <=1.1.38) +16 more potentially affected by CVE-2020-28248 via png-img (>=0.2.1 <=2.3.0)
png-img NPM version =0.2.1, =1.5.0, =1.0.10-14, =1.0.1, =1.0.0, =1.10.1, =4.0.0, =0.0.1, =0.9.0, =2.2.0, =0.7.0, =1.0.11, =0.79.5, =0.1.0, =0.0.1, =0.0.18 and more Source cves: CVE-2020-28248 Source advisory: OSV:GHSA-Q5WR-FVPQ-P67G...
Piwigo SQL Injection Vulnerability (CNVD-2021-100297)
Piwigo is a set of Web-based open source image library software. Piwigo v11.5 contains a security vulnerability in /admin/batchmanagerglobal.php in which the parameter pwgtoken is not sufficiently escaped and filtered. No details of the vulnerability are available at this time...
exiv2: DoS due to quadratic complexity in ProcessUTF8Portion
There's a flaw in the xmpsdk component shipped with exiv2. An attacker who is able to submit a crafted file to be processed by an application linked with the exiv2 library could cause an excessive consumption of resources, potentially leading to denial of service. The greatest impact of this flaw...
The vulnerability of the Leptonica image processing library, related to the implementation of an incorrect control flow, allows a hacker to trigger a service failure.
The vulnerability of the Leptonica image processing library is related to the implementation of an incorrect control flow. Exploiting this vulnerability can allow a remote attacker to cause a service failure...
CLSA-2021-1635459219 Fix CVE(s): CVE-2021-40812, CVE-2021-40145, CVE-2021-38115, CVE-2017-6363
SECURITY UPDATE: unhandled memory allocation error in gdImageGd2Ptr - debian/patches/CVE-2021-40145.patch: check for non-zero return code from gdImageGd2 - CVE-2021-40145 SECURITY UPDATE: unhandled value returned from gdPutBuf - debian/patches/CVE-2021-40812.patch: handle possible gdPutBuf error ...
The vulnerability of the Convert.c component in the Pillow image processing library, related to buffer overflow in memory, allows an attacker to access confidential data, compromise its integrity, and cause service interruptions.
The vulnerability of the Convert.c component in the Pillow image processing library relates to the ability to pass parameters directly to the function. Exploiting this vulnerability can allow a remote attacker to gain access to confidential data, compromise its integrity, and cause service failur...