203 matches found
PIL-RCE-Ghostscript-CVE-2018-16509
Python PIL/Pillow Remote Shell Command Execution via Ghostscript CVE-2018-16509 Inspired by https://github.com/ysrc/PIL-RCE-By-GhostButt PIL/Pillow RCE via CVE-2017-8291. This docker environment version is using the newer version of Ghostscript v9.23 and newer exploit CVE-2018-16509. Ghostscript ...
PIL-RCE-By-GhostButt
Exploiting Python PIL Module Command Execution Vulnerability Attack Python applications developed with PIL and achieve remote command execution. This project is used to host the paper and the source code and Dockerfile used in the experiments. Paper : https://xianzhi.aliyun.com/forum/read/2163.ht...
PIL-CVE-2017-8291
Python PIL Remote Command Execution Vulnerability GhostButt The PIL Pillow module for processing images in Python is affected by the GhostButt vulnerability CVE-2017-8291 because it calls GhostScript internally, resulting in a remote command execution vulnerability. Vulnerability Summary PIL...
PIL-CVE-2017-8291-study
PIL-CVE-2017-8291 White Hat School 3rd term, Class 13, Baek Seung-hoon @shun1403 https://github.com/shun1403/PIL-CVE-2017-8291.git Environment: Ubuntu Linux Environment Setup Upgrade to V2 via sudo apt install -y docker-ce docker-ce-cli containerd.io docker-buildx-plugin docker-compose-plugin If...
SUSE CVE-2026-96637
Pillow is a Python imaging library. Prior to 13.0.0, SpiderImageFile.seek in src/PIL/SpiderImagePlugin.py reparses a later SPIDER stack frame and replaces self.size without rerunning Image.decompressionbombcheck. A tiny file can use a safe first frame to pass Image.open and then declare very larg...
SUSE CVE-2026-96642
Pillow is a Python imaging library. Prior to 13.0.0, the TarIO initializer in src/PIL/TarIO.py accepts a negative octal member size and computes a backward seek that returns to the same 512-byte header. When the requested member name does not match, the parser repeatedly reads that header, consum...
SUSE CVE-2026-96644
Pillow is a Python imaging library. Prior to 13.0.0 on Windows, src/PIL/WmfImagePlugin.py passes unchecked 32-bit WMF or EMF dimensions to the native drawwmf handler in src/display.c. The handler sizes a DIB allocation from 16-bit-truncated bcWidth and bcHeight fields but copies pixel data using...
Security Bulletin: IBM Watson Speech Services Cartridge is vulnerable to multiple memory allocation issues in Pillow (CVE-2026-54059, CVE-2026-54060, CVE-2026-55379, CVE-2026-55380).
Summary IBM Watson Speech Services Cartridge is vulnerable to multiple memory allocation issues in Pillow. Pillow is used in our Speech runtimes. These vulnerabilities have been addressed. Please read the details for remediation below. Vulnerability Details CVEID:CVE-2026-54059 DESCRIPTION: Pillo...
EUVD-2026-107561
Pillow: TarIO negative size field causes infinite CPU-spin loop...
EUVD-2026-107570
Pillow PDF append accepts malformed shared page-tree DAG causing resource exhaustion...
EUVD-2026-107569
Pillow: Decompression bomb check bypass in SpiderImagePlugin.seek leads to unbounded allocation DoS...
Linux Distros Unpatched Vulnerability : CVE-2026-96640
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Pillow is a Python imaging library. From 5.1.0 until 13.0.0, PdfParser.linearizepagetree in src/PIL/PdfParser.py treats a PDF /Pages graph as a tree without...
Linux Distros Unpatched Vulnerability : CVE-2026-96642
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Pillow is a Python imaging library. Prior to 13.0.0, the TarIO initializer in src/PIL/TarIO.py accepts a negative octal member size and computes a backward seek...
PYSEC-2026-4341
Pillow is a Python imaging library. Prior to 13.0.0, the TarIO initializer in src/PIL/TarIO.py accepts a negative octal member size and computes a backward seek that returns to the same 512-byte header. When the requested member name does not match, the parser repeatedly reads that header, consum...
DEBIAN-CVE-2026-96642
Pillow is a Python imaging library. Prior to 13.0.0, the TarIO initializer in src/PIL/TarIO.py accepts a negative octal member size and computes a backward seek that returns to the same 512-byte header. When the requested member name does not match, the parser repeatedly reads that header, consum...
PYSEC-2026-4342
Pillow is a Python imaging library. From 11.0.0 until 13.0.0, Exif.load in src/PIL/Image.py repeatedly slices the remaining EXIF data while it begins with the six-byte Exif header. src/PIL/PngImagePlugin.py accepts an uncapped PNG eXIf chunk, so a file filled with repeated headers causes a new...
PYSEC-2026-4343
Pillow is a Python imaging library. Prior to 13.0.0 on Windows, src/PIL/WmfImagePlugin.py passes unchecked 32-bit WMF or EMF dimensions to the native drawwmf handler in src/display.c. The handler sizes a DIB allocation from 16-bit-truncated bcWidth and bcHeight fields but copies pixel data using...
PYSEC-2026-4341
Pillow is a Python imaging library. Prior to 13.0.0, the TarIO initializer in src/PIL/TarIO.py accepts a negative octal member size and computes a backward seek that returns to the same 512-byte header. When the requested member name does not match, the parser repeatedly reads that header, consum...
PYSEC-2026-4342
Pillow is a Python imaging library. From 11.0.0 until 13.0.0, Exif.load in src/PIL/Image.py repeatedly slices the remaining EXIF data while it begins with the six-byte Exif header. src/PIL/PngImagePlugin.py accepts an uncapped PNG eXIf chunk, so a file filled with repeated headers causes a new...
PYSEC-2026-4343
Pillow is a Python imaging library. Prior to 13.0.0 on Windows, src/PIL/WmfImagePlugin.py passes unchecked 32-bit WMF or EMF dimensions to the native drawwmf handler in src/display.c. The handler sizes a DIB allocation from 16-bit-truncated bcWidth and bcHeight fields but copies pixel data using...