pillow@8.4.0 vulnerabilities

Affected versions of this package are vulnerable to Buffer Overflow via the strcpy function in _imagingcms.c, due to two calls that were able to copy too much data into fixed length strings.

Upgrade pillow to version 10.3.0 or higher.

Affected versions of this package are vulnerable to Denial of Service (DoS) when using arbitrary strings as text input and the number of characters passed into PIL.ImageFont.ImageFont.getmask() is over a certain limit. This can lead to a system crash.

Upgrade pillow to version 10.2.0 or higher.

Affected versions of this package are vulnerable to Denial of Service (DoS) if the size of individual glyphs extends beyond the bitmap image, when using PIL.ImageFont.ImageFont function. Exploiting this vulnerability could lead to a system crash.

Upgrade pillow to version 10.2.0 or higher.

Affected versions of this package are vulnerable to Eval Injection via the PIL.ImageMath.eval function when an attacker has control over the keys passed to the environment argument.

Upgrade pillow to version 10.2.0 or higher.

Affected versions of this package are vulnerable to Uncontrolled Resource Consumption ('Resource Exhaustion') when the ImageFont truetype in an ImageDraw instance operates on a long text argument. An attacker can cause the service to crash by processing a task that uncontrollably allocates memory.

Upgrade pillow to version 10.0.0 or higher.

Pillow is a PIL (Python Imaging Library) fork.

Affected versions of this package are vulnerable to Heap-based Buffer Overflow when the ReadHuffmanCodes() function is used. An attacker can craft a special WebP lossless file that triggers the ReadHuffmanCodes() function to allocate the HuffmanCode buffer with a size that comes from an array of precomputed sizes: kTableSize. The color_cache_bits value defines which size to use. The kTableSize array only takes into account sizes for 8-bit first-level table lookups but not second-level table lookups. libwebp allows codes that are up to 15-bit (MAX_ALLOWED_CODE_LENGTH). When BuildHuffmanTable() attempts to fill the second-level tables it may write data out-of-bounds. The OOB write to the undersized array happens in ReplicateValue.

Notes:

This is only exploitable if the color_cache_bits value defines which size to use.

This vulnerability was also published on libwebp CVE-2023-5129

Changelog:

2023-09-12: Initial advisory publication

2023-09-27: Advisory details updated, including CVSS, references

2023-09-27: CVE-2023-5129 rejected as a duplicate of CVE-2023-4863

2023-09-28: Research and addition of additional affected libraries

2024-01-28: Additional fix information

Upgrade Pillow to version 10.0.1 or higher.

Affected versions of this package are vulnerable to Denial of Service (DoS) due to a missing GIF decompression bomb check.

Upgrade pillow to version 9.2.0 or higher.

Pillow is a PIL (Python Imaging Library) fork.

Affected versions of this package are vulnerable to Denial of Service (DoS) due to a missing GIF decompression bomb check.

Upgrade Pillow to version 9.2.0 or higher.

Pillow is a PIL (Python Imaging Library) fork.

Affected versions of this package are vulnerable to Improper Input Validation. When the path to the temporary directory on Linux or macOS contained a space, this would break removal of the temporary image file after im.show() (and related actions), and potentially remove an unrelated file.

Upgrade Pillow to version 9.0.1 or higher.

Pillow is a PIL (Python Imaging Library) fork.

Affected versions of this package are vulnerable to Buffer Over-read via the path_getbbox method in path.c during initialization of ImagePath.Path.

Upgrade Pillow to version 9.0.0 or higher.

Pillow is a PIL (Python Imaging Library) fork.

Affected versions of this package are vulnerable to Improper Initialization of ImagePath.Path in path_getbbox at path.c.

Upgrade Pillow to version 9.0.0 or higher.

Pillow is a PIL (Python Imaging Library) fork.

Affected versions of this package are vulnerable to Arbitrary Code Execution via PIL.ImageMath.eval which allows evaluation of arbitrary expressions, such as ones that use the Python exec method.

Upgrade Pillow to version 9.0.0 or higher.

Pillow is a PIL (Python Imaging Library) fork.

Affected versions of this package are vulnerable to Denial of Service (DoS). The JpegImagePlugin may append an EOF marker to the end of a truncated file, so that the last segment of the data will still be processed by the decoder. If the EOF marker is not detected as such, this can lead to an infinite loop where JpegImagePlugin keeps trying to end the file.

Upgrade Pillow to version 9.0.0 or higher.