131 matches found
CLEANSTART-2026-IB18470 libImaging/FliDecode
CVE-2020-5313 affects multiple packages. libImaging/FliDecode. See references for individual vulnerability details...
CLEANSTART-2026-YP59685 libImaging/PcxDecode
CVE-2020-5312 affects multiple packages. libImaging/PcxDecode. See references for individual vulnerability details...
CLEANSTART-2026-KD58899 libImaging/SgiRleDecode
CVE-2020-5311 affects multiple packages. libImaging/SgiRleDecode. See references for individual vulnerability details...
CLEANSTART-2026-FJ39986 libImaging/TiffDecode
CVE-2020-5310 affects multiple packages. libImaging/TiffDecode. See references for individual vulnerability details...
CLEANSTART-2026-JR73633 libImaging/TgaRleDecode
Security vulnerability affects the py3-pillow package. libImaging/TgaRleDecode...
Exploit for Out-of-bounds Write in Python Pillow
CVE-2026-96778 — Heap Buffer Overflow in Pillow JPEG Encoder...
PT-2026-120293
Summary Pillow's libImaging decodeTile decoder, used to decode tiled TIFF images, allocates a per-tile buffer using reallocstate-buffer, TIFFTileSizetiff. After each TIFFReadTile it then iterates tile y from 0 up to current tile length and calls the configured row unpacker here copy4 with the...
NULL Pointer Dereference
Overview Affected versions of this package are vulnerable to NULL Pointer Dereference via ImagingExpand in src/libImaging/Filter.c when processing a zero-dimension image through RankFilter or related filters. An attacker can supply an image with a width or height of zero, triggering undefined...
Heap-based Buffer Overflow
Overview Affected versions of this package are vulnerable to Heap-based Buffer Overflow via tiffWriteProc in src/libImaging/TiffDecode.c when saving a TIFF image to a BytesIO object. The buffer size calculation uses state-size instead of the current write location state-loc when determining wheth...
Heap-based Buffer Overflow
Overview Affected versions of this package are vulnerable to Heap-based Buffer Overflow via the JPEG decoder in src/libImaging/JpegDecode.c when processing a JPEG stream whose declared output width or component count exceeds the dimensions used to size the scanline buffer. Because the buffer is...
Heap-based Buffer Overflow
Overview Affected versions of this package are vulnerable to Heap-based Buffer Overflow in the FlashPix JPEG tile decoding spanning src/PIL/FpxImagePlugin.py and src/libImaging/JpegDecode.c, where the tile buffer is sized from the rawmode that the MODES table selects from the FPX color IDs, while...
NULL Pointer Dereference
Overview Affected versions of this package are vulnerable to NULL Pointer Dereference via the ImagingMerge function in src/libImaging/Bands.c when merging image32 4-bytes-per-pixel, single-band images. The function fails to reject bands whose pixelsize is 4, allowing an attacker to trigger a cras...
Use After Free
Overview Affected versions of this package are vulnerable to Use After Free via ImagingScaleAffine in src/libImaging/Geometry.c, which deletes a caller-owned output image when its lookup-table allocation fails. When resize calls ImagingTransform and the internal affine transform encounters a memo...
Astra Linux - vulnerability in pillow
Pillow is a Python imaging library. Versions 8.2.0 through 12.2.0 have a flaw in src/libImaging/Jpeg2KDecode.c: it accumulates totalcomponentwidth across every tile in a JPEG2000 image instead of recalculating it per tile. As a result, a specially crafted tiled JPEG2000 file can force significant...
CLSA-2026-1792164435 Fix CVE(s): CVE-2026-54058, CVE-2026-59199
SECURITY UPDATE: heap out-of-bounds write via paste box coordinates near the signed 32-bit integer limits ELSCVE-233283 - debian/patches/CVE-2026-59199.patch: compute the paste box dimensions as int64t in ImagingPaste and ImagingFill2 in src/libImaging/Paste.c. Adds a regression test in...
Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: python-pillow (UTSA-2026-090127)
The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-090127 advisory. Pillow before 7.1.0 has multiple out-of-bounds reads in libImaging/FliDecode.c. Tenable has extracted the preceding description block directly from the Unity Linux...
EUVD-2020-0130
Malware in sbrugna...
EUVD-2020-0131
Malware in sbrugna...