Free plan, no credit card, first error in minutes.
Create a Project for FreeDiscover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
A vulnerability in Pillow's MSP RLE decoder allows crafted images to trigger excessive memory allocation, leading to a denial of service. The issue affects versions from 4.1.0 prior to 13.0.0 and is resolved in version 13.0.0.
A vulnerability in Pillow multi-frame image loaders allows stale native image storage to be reused after mode transitions, potentially causing out-of-bounds writes, process crashes, or arbitrary code execution.
A vulnerability in Pillow causes repeated copying of long comments when saving GIF images. This can lead to excessive CPU consumption and potential denial of service when processing untrusted image uploads.
An out-of-bounds read vulnerability in Pillow allows certain decoders to read heap memory past the end of a buffer when processing specific image dimensions. This may disclose adjacent memory into decoded pixel data or cause an application crash.
Applying rank, median, minimum, or maximum filters to zero-width or zero-height images in Pillow triggers a NULL pointer dereference in ImagingExpand, causing Python worker processes to crash and enabling denial of service.
A vulnerability in Pillow allows crafted Microsoft Image Composer (MIC) files with embedded TIFF streams to cause an infinite loop and 100% CPU usage when checking frame counts, leading to denial of service in environments with olefile installed.
A NULL pointer dereference vulnerability in Pillow allows remote attackers to cause a denial of service (process crash) via crafted image files processed through the IPTC loader and Image.merge routine.
A vulnerability in Pillow allows an invalid or double free when rendering text with a stroke from untrusted fonts, potentially leading to memory corruption or crashes.
Pillow lacks sanitization when constructing Ghostscript commands from input filenames, permitting command-line argument injection that can be escalated to remote code execution.
A heap buffer overflow vulnerability in Pillow allows attackers to cause out-of-bounds writes when decoding specially crafted lossless JPEG images using draft scaling. This issue occurs when libjpeg-turbo silently ignores scaling requests, leading to memory corruption or crashes.
Unbounded recursion in Pillow when parsing PDF page trees or trailer chains can cause severe CPU and memory exhaustion or crashes during PDF append operations.
An issue in Pillow allows a maliciously crafted GIF to cause excessive memory allocation when an application handles decompression errors during frame seeking and reuses the image object. This can lead to memory exhaustion and denial of service.
Pillow is vulnerable to an out-of-bounds write when processing zero-width PPM or PGM images during morphology operations. Opening a specially crafted image can cause an application crash and potential memory corruption.
An out-of-bounds read vulnerability in Pillow's tiled-TIFF decoder can allow a specially crafted TIFF image to crash the process or expose adjacent heap memory into the decoded pixel buffer.
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.