2854 matches found
MAL-2026-10974 Malicious code in rasterkit (PyPI)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 115c87298c4a239bd4954e39a155929c2480510343aefe1fa7c0b631b467af6b The rasterkit 1.0.2 distribution installs its modules under the top-level PIL/ package name owned by Pillow. toplevel.txt declares PIL and the wheel'...
[SECURITY] Fedora 43 Update: python-pillow-11.3.0-10.fc43
Python image processing library, fork of the Python Imaging Library PIL This library provides extensive file format support, an efficient internal representation, and powerful image processing capabilities. There are four subpackages: tk tk interface, qt PIL image wrapper for Qt, devel developmen...
CVE-2026-59197
creationtimestamp| type| source ---|---|--- 2026-07-21 00:35:21+00:00| published-proof-of-concept| https://github.com/python-pillow/Pillow/security/advisories/GHSA-xj96-63gp-2gmr 2026-07-21 12:31:41+00:00| seen| https://gist.github.com/alon710/a3a7380a4e0465c6c32d9063bd8033a6 2026-07-22...
CVE-2026-59198
creationtimestamp| type| source ---|---|--- 2026-07-21 00:35:19+00:00| published-proof-of-concept| https://github.com/python-pillow/Pillow/security/advisories/GHSA-fj7v-r99m-22gq 2026-07-21 11:31:12+00:00| seen| https://gist.github.com/alon710/48f3deb1ca1eafb4018fbe6276da18c1...
CVE-2026-59199
creationtimestamp| type| source ---|---|--- 2026-07-21 00:35:17+00:00| published-proof-of-concept| https://github.com/python-pillow/Pillow/security/advisories/GHSA-6r8x-57c9-28j4 2026-07-21 10:31:21+00:00| seen| https://gist.github.com/alon710/8369d28698d5eaa2f4badffaca60e4b4...
CVE-2026-59200
creationtimestamp| type| source ---|---|--- 2026-07-21 00:35:14+00:00| published-proof-of-concept| https://github.com/python-pillow/Pillow/security/advisories/GHSA-jjj6-mw9f-p565 2026-07-21 09:31:09+00:00| seen| https://gist.github.com/alon710/58614afe66c43fc333bb604ba1de657d 2026-07-22...
CVE-2026-59203
creationtimestamp| type| source ---|---|--- 2026-07-21 00:35:12+00:00| published-proof-of-concept| https://github.com/python-pillow/Pillow/security/advisories/GHSA-pg7v-jwj7-p798 2026-07-21 08:31:39+00:00| seen| https://gist.github.com/alon710/afd430e951c08264a9a3f3da451132a3...
CVE-2026-59205
creationtimestamp| type| source ---|---|--- 2026-07-21 00:35:08+00:00| published-proof-of-concept| https://github.com/python-pillow/Pillow/security/advisories/GHSA-9hw9-ch79-4vh6 2026-07-21 06:31:17+00:00| seen| https://gist.github.com/alon710/c194376028b5fea9d1333b8a7894f724...
EulerOS Virtualization 2.12.1 (EulerOS-SA-2026-2751)
According to the versions of the package installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities : Pillow is a Python imaging library. From version 4.2.0 to before version 12.2.0, an attacker can supply a malicious PDF that causes the...
EulerOS Virtualization 2.12.0 : python-pillow (EulerOS-SA-2026-2797)
According to the versions of the python-pillow package installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities : Pillow is a Python imaging library. From version 4.2.0 to before version 12.2.0, an attacker can supply a malicious PDF that...
EUVD-2026-43746
Pillow: Controlled heap out-of-bounds write in Pillow ImageCmsTransform.apply via output mode mismatch...
GHSA-9HW9-CH79-4VH6 Pillow: Controlled heap out-of-bounds write in Pillow `ImageCmsTransform.apply()` via output mode mismatch
Summary Pillow's public ImageCms.ImageCmsTransform.applyim, imOut API can trigger controlled native heap corruption when the caller supplies an output image whose mode does not match the transform's declared output mode. For example, a transform built as RGBA - RGBA can be applied to an L output...
GHSA-VJC4-5QP5-M44J Pillow JPEG2000 tiled decode retains a growing scratch buffer and can be used for denial of service
Summary src/libImaging/Jpeg2KDecode.c:853 accumulates totalcomponentwidth across every tile in a JPEG2000 image instead of recomputing it per tile. That accumulated value is then used in the tilebytes calculation at src/libImaging/Jpeg2KDecode.c:868, which can make the decoder grow state-buffer v...
EUVD-2026-43730
Pillow JPEG2000 tiled decode retains a growing scratch buffer and can be used for denial of service...
Pillow JPEG2000 tiled decode retains a growing scratch buffer and can be used for denial of service
Summary src/libImaging/Jpeg2KDecode.c:853 accumulates totalcomponentwidth across every tile in a JPEG2000 image instead of recomputing it per tile. That accumulated value is then used in the tilebytes calculation at src/libImaging/Jpeg2KDecode.c:868, which can make the decoder grow state-buffer v...
GHSA-PG7V-JWJ7-P798 Pillow EpsImagePlugin negative %%BeginBinary byte count causes infinite loop denial of service
Summary Pillow's EPS parser PIL/EpsImagePlugin.py accepts a negative byte count in the %%BeginBinary directive. A crafted EPS file can cause Image.open to seek backwards to the same directive and parse it repeatedly, resulting in an infinite loop and CPU denial of service. The issue is triggered...
EUVD-2026-43741
Pillow EpsImagePlugin negative %%BeginBinary byte count causes infinite loop denial of service...
EUVD-2026-43753
Pillow: Decompression Bomb DoS via PdfParser.PdfStream.decode...
GHSA-JJJ6-MW9F-P565 Pillow: Decompression Bomb DoS via PdfParser.PdfStream.decode()
Summary PdfParser.PdfStream.decode in Pillow's PdfParser.py calls zlib.decompress with the bufsize parameter set to the value of the PDF stream's Length field, without any upper bound on the actual decompressed output size. Python's zlib.decompress bufsize argument is an initial output buffer hin...