drawy (1.0.1) potentially affected by CVE-2025-27363 via skia-python (86.1.0)

skia-python PYPI version 86.1.0 is affected by a known vulnerability. The following packages have a transitive dependency on skia-python and may be impacted: - drawy 1.0.1 Source cves: CVE-2025-27363 Source advisory: OSV:GHSA-2MHW-8QCG-GR96...

drawy (1.0.2) potentially affected by CVE-2025-27363 via skia-python (87.0.0)

skia-python PYPI version 87.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on skia-python and may be impacted: - drawy 1.0.2 Source cves: CVE-2025-27363 Source advisory: OSV:GHSA-2MHW-8QCG-GR96...

iceberg-dsl (>=0.0.6, <=0.1.2) potentially affected by CVE-2025-27363 via skia-python (87.5.0)

skia-python PYPI version 87.5.0 is affected by a known vulnerability. The following packages have a transitive dependency on skia-python and may be impacted: - iceberg-dsl =0.0.6, =0.1.2 Source cves: CVE-2025-27363 Source advisory: OSV:GHSA-2MHW-8QCG-GR96...

antotate (0.0.0) potentially affected by CVE-2025-27363 via skia-python (87.6.0)

skia-python PYPI version 87.6.0 is affected by a known vulnerability. The following packages have a transitive dependency on skia-python and may be impacted: - antotate 0.0.0 Source cves: CVE-2025-27363 Source advisory: OSV:GHSA-2MHW-8QCG-GR96...

dynrender-skia (>=0.1.0, <=0.2.5), dynrender-skia-opt (0.3.8) +2 more potentially affected by CVE-2025-27363 via skia-python (87.9.0)

skia-python PYPI version 87.9.0 is affected by a known vulnerability. The following packages have a transitive dependency on skia-python and may be impacted: - dynrender-skia =0.1.0, =3.3.1, =0.1.0, =0.6.1 Source cves: CVE-2025-27363 Source advisory: OSV:GHSA-2MHW-8QCG-GR96...

flitter-lang (>=1.0.0b7, <=1.0.0b11), pytamaro (>=0.6.2, <=0.7.1) potentially affected by CVE-2025-27363 via skia-python (121.0.0b6)

skia-python PYPI version 121.0.0b6 is affected by a known vulnerability. The following packages have a transitive dependency on skia-python and may be impacted: - flitter-lang =1.0.0b7, =0.6.2, =0.7.1 Source cves: CVE-2025-27363 Source advisory: OSV:GHSA-2MHW-8QCG-GR96...

dynrender-skia (>=0.2.6, <=0.2.8), flitter-lang (1.0.0b12) potentially affected by CVE-2025-27363 via skia-python (126.0.0b8)

skia-python PYPI version 126.0.0b8 is affected by a known vulnerability. The following packages have a transitive dependency on skia-python and may be impacted: - dynrender-skia =0.2.6, =0.2.8 - flitter-lang 1.0.0b12 Source cves: CVE-2025-27363 Source advisory: OSV:GHSA-2MHW-8QCG-GR96...

pytamaro (>=0.7.2, <=0.7.3) potentially affected by CVE-2025-27363 via skia-python (128.0.0b9)

skia-python PYPI version 128.0.0b9 is affected by a known vulnerability. The following packages have a transitive dependency on skia-python and may be impacted: - pytamaro =0.7.2, =0.7.3 Source cves: CVE-2025-27363 Source advisory: OSV:GHSA-2MHW-8QCG-GR96...

pytamaro (1.0.0) potentially affected by CVE-2025-27363 via skia-python (132.0.0b11)

skia-python PYPI version 132.0.0b11 is affected by a known vulnerability. The following packages have a transitive dependency on skia-python and may be impacted: - pytamaro 1.0.0 Source cves: CVE-2025-27363 Source advisory: OSV:GHSA-2MHW-8QCG-GR96...

django-cfg (>=1.7.65, <=2.2.162), html2pic (>=0.1.1, <=0.2.2) +6 more potentially affected by CVE-2025-27363 via skia-python (138.0.0)

skia-python PYPI version 138.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on skia-python and may be impacted: - django-cfg =1.7.65, =0.1.1, =0.1.0, =2.1.1, =0.2.1, =1.6.0a0, =0.1.0a0, =0.3.3 Source cves: CVE-2025-27363 Source advisory:...

GHSA-2MHW-8QCG-GR96 skia-python vendors vulnerable libfreetype because of pinned cibuildwheel version

Impact The Linux wheels for skia-python vendor a vulnerable version of libfreetype that is affected by CVE-2025-27363 1. The root cause is a chain of unfortunate events: 1. skia-python builds wheels using pinned pypa/[email protected] 2 2. cibuildwheel 2.21.3 in turn pins manylinux container...

django-cfg (>=1.7.65, <=2.2.162), html2pic (>=0.1.1, <=0.2.2) +6 more potentially affected by CVE-2025-27363 via skia-python (138.0.0)

skia-python PYPI version 138.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on skia-python and may be impacted: - django-cfg =1.7.65, =0.1.1, =0.1.0, =2.1.1, =0.2.1, =1.6.0a0, =0.1.0a0, =0.3.3 Source cves: CVE-2025-27363 Source advisory:...

skia-python vendors vulnerable libfreetype because of pinned cibuildwheel version

Impact The Linux wheels for skia-python vendor a vulnerable version of libfreetype that is affected by CVE-2025-27363 1. The root cause is a chain of unfortunate events: 1. skia-python builds wheels using pinned pypa/[email protected] 2 2. cibuildwheel 2.21.3 in turn pins manylinux container...

Out-of-bounds Write

Overview Affected versions of this package are vulnerable to Out-of-bounds Write when attempting to parse font subglyph structures related to TrueType GX and variable font files, an out of bounds write occurs. This issue arises from assigning a signed short value to an unsigned long and then addi...