PT-2026-33126

Name of the Vulnerable Software and Affected Versions GIMP affected versions not specified Description A flaw in the FITS image loader allows a remote attacker to trigger an integer overflow by providing a specially crafted FITS file. This leads to a zero-byte memory allocation, resulting in a he...

CVE-2026-40192: Allocation of Resources Without Limits or Throttling

Pillow is a Python imaging library. Versions 10.3.0 through 12.1.1 did not limit the amount of GZIP-compressed data read when decoding a FITS image, making them vulnerable to decompression bomb attacks. A specially crafted FITS file could cause unbounded memory consumption, leading to denial of...

GIMP 安全漏洞

GIMP is an open-source bitmap image editor developed by the GIMP team. GIMP has a security vulnerability, which stems from integer overflow in the FITS image loader. This could lead to a heap buffer overflow when processing specially crafted FITS files, potentially causing denial-of-service attac...

Pillow 安全漏洞

Pillow is an open-source image processing library developed by Pillow. Versions of Pillow from 10.3.0 to 12.1.1 contain security vulnerabilities. These vulnerabilities stem from the lack of restrictions on the amount of GZIP compressed data read during the decoding of FITS images, which may lead ...

Linux Distros Unpatched Vulnerability : CVE-2026-40915

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A flaw was found in GIMP. A remote attacker could exploit an integer overflow vulnerability in the FITS image loader by providing a specially crafted FITS file...

GHSA-WHJ4-6X5X-4V2J FITS GZIP decompression bomb in Pillow

Impact Pillow did not limit the amount of GZIP-compressed data read when decoding a FITS image, making it vulnerable to decompression bomb attacks. A specially crafted FITS file could cause unbounded memory consumption, leading to denial of service OOM crash or severe performance degradation...

FITS GZIP decompression bomb in Pillow

Impact Pillow did not limit the amount of GZIP-compressed data read when decoding a FITS image, making it vulnerable to decompression bomb attacks. A specially crafted FITS file could cause unbounded memory consumption, leading to denial of service OOM crash or severe performance degradation...

Allocation of Resources Without Limits or Throttling

Overview Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling via decompression bomb, in FitsGzipDecoder. An attacker can cause an OOM and crash the application or severely degrade its performance by supplying a malicious FITS file containing...

EUVD-2017-3363

Malware in sbrugna...

EUVD-2009-0262

Malware in sbrugna...

EUVD-2022-46591

Malicious code in bioql PyPI...

Linux Distros Unpatched Vulnerability : CVE-2022-43595

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Multiple denial of service vulnerabilities exist in the image output closing functionality of OpenImageIO Project OpenImageIO v2.4.4.2. Specially crafted...

Linux Distros Unpatched Vulnerability : CVE-2018-3847

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Multiple exploitable buffer overflow vulnerabilities exist in image parsing functionality of the CFITSIO library version 3.42. Specially crafted images parsed v...

Malicious code in a-vailable-al-bum-file-a-thing-called-the-divine-fits-zkxbj-wjiufg (npm)

The package a-vailable-al-bum-file-a-thing-called-the-divine-fits-zkxbj-wjiufg was found to contain malicious code...

MAL-2025-13927 Malicious code in a-vailable-al-bum-file-a-thing-called-the-divine-fits-zkxbj-wjiufg (npm)

The package a-vailable-al-bum-file-a-thing-called-the-divine-fits-zkxbj-wjiufg was found to contain malicious code...

CVE-2022-43595

Multiple denial of service vulnerabilities exist in the image output closing functionality of OpenImageIO Project OpenImageIO v2.4.4.2. Specially crafted ImageOutput Objects can lead to multiple null pointer dereferences. An attacker can provide malicious multiple inputs to trigger these...

Fedora: Security Advisory for nom-tam-fits (FEDORA-2024-129d8ca6fc)

The remote host is missing an update for the SPDX-FileCopyrightText: 2024 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

[SECURITY] Fedora 40 Update: nom-tam-fits-1.15.2-22.fc40

FITS Flexible Image Transport System is the standard data format in astronomy used for the transport, analysis, and archival storage of scientific data sets. This library provides efficient I/O for FITS images and binary tables. All basic FITS formats and GZIP compressed files are supported...

Debian dla-3382 : libopenimageio-dev - security update

The remote Debian 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the dla-3382 advisory. ------------------------------------------------------------------------- Debian LTS Advisory DLA-3382-1 [email protected]...

Fedora 37 : OpenImageIO (2023-c3d65c8f7b)

The remote Fedora 37 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2023-c3d65c8f7b advisory. Release 2.4.8.1 13 Feb 2023 -- compared to 2.4.8.0 Fixtarga: guard against corrupted tga files Fixes TALOS-2023-1707 / CVE-2023-24473, TALOS-2023-17...