Browse CVEs

HIGH 7.5 CVE-2021-28677 An issue was discovered in Pillow before 8.2.0. For EPS data, the readline implementation used in EPSImageFile has to deal with any combination of \r… Pillow 8.2.0+ Fix from $1,9502021-06-02 MEDIUM 5.5 CVE-2021-28678 An issue was discovered in Pillow before 8.2.0. For BLP data, BlpImagePlugin did not properly check that reads (after jumping to file offsets) return… Pillow 8.2.0+ Fix from $1,6002021-06-02 MEDIUM 5.5 CVE-2021-28675 An issue was discovered in Pillow before 8.2.0. PSDImagePlugin.PsdImageFile lacked a sanity check on the number of input layers relative to the size … Pillow 8.2.0+ Fix from $1,6002021-06-02 MEDIUM 5.7 CVE-2021-3426 There's a flaw in Python 3's pydoc. A local or adjacent attacker who discovers or is able to convince another local or adjacent user to start a pydoc… Python 2.7.18 / 3.6.13+ Fix from $1,6002021-05-20 CRITICAL 9.8 CVE-2021-29921EPSS 7% In Python before 3,9,5, the ipaddress library mishandles leading zero characters in the octets of an IP address string. This (in some situations) all… Python 3.8.12 / 3.9.5+ Fix from $2,3002021-05-06 CRITICAL 9.8 CVE-2021-25289 An issue was discovered in Pillow before 8.1.1. TiffDecode has a heap-based buffer overflow when decoding crafted YCbCr files because of certain inte… Pillow 8.1.1+ Fix from $2,3002021-03-19 HIGH 7.5 CVE-2021-25290 An issue was discovered in Pillow before 8.1.1. In TiffDecode.c, there is a negative-offset memcpy with an invalid size. Pillow 8.1.1+ Fix from $1,9502021-03-19 HIGH 7.5 CVE-2021-25291 An issue was discovered in Pillow before 8.1.1. In TiffDecode.c, there is an out-of-bounds read in TiffreadRGBATile via invalid tile boundaries. Pillow 8.1.1+ Fix from $1,9502021-03-19 HIGH 7.5 CVE-2021-25293 An issue was discovered in Pillow before 8.1.1. There is an out-of-bounds read in SGIRleDecode.c. Pillow 8.1.1+ Fix from $1,9502021-03-19 MEDIUM 6.5 CVE-2021-25292 An issue was discovered in Pillow before 8.1.1. The PDF parser allows a regular expression DoS (ReDoS) attack via a crafted PDF file because of a cat… Pillow 8.1.1+ Fix from $1,6002021-03-19 MEDIUM 6.5 CVE-2021-28363 The urllib3 library 1.26.x before 1.26.4 for Python omits SSL certificate validation in some cases involving HTTPS to HTTPS proxies. The initial conn… Urllib3 1.26.4+ Fix from $1,6002021-03-15 HIGH 7.5 CVE-2021-27921 Pillow before 8.1.2 allows attackers to cause a denial of service (memory consumption) because the reported size of a contained image is not properly… Pillow 8.1.1+ Fix from $1,9502021-03-03 HIGH 7.5 CVE-2021-27922 Pillow before 8.1.2 allows attackers to cause a denial of service (memory consumption) because the reported size of a contained image is not properly… Pillow 8.1.1+ Fix from $1,9502021-03-03 HIGH 7.5 CVE-2021-27923 Pillow before 8.1.2 allows attackers to cause a denial of service (memory consumption) because the reported size of a contained image is not properly… Pillow 8.1.1+ Fix from $1,9502021-03-03 MEDIUM 5.9 CVE-2021-23336EPSS 36% The package python/cpython from 0 and before 3.6.13, from 3.7.0 and before 3.7.10, from 3.8.0 and before 3.8.8, from 3.9.0 and before 3.9.2 are vulne… Python 2.2.19 / 3.0.13+ Fix from $1,6002021-02-15 CRITICAL 9.8 CVE-2021-3177EPSS 23% Python 3.x through 3.9.1 has a buffer overflow in PyCArg_repr in _ctypes/callproc.c, which may lead to remote code execution in certain Python applic… Python after 3.9.1 Fix from $2,3002021-01-19 HIGH 8.8 CVE-2020-35654 In Pillow before 8.1.0, TiffDecode has a heap-based buffer overflow when decoding crafted YCbCr files because of certain interpretation conflicts wit… Pillow 8.1.0+ Fix from $1,9502021-01-12 HIGH 7.1 CVE-2020-35653 In Pillow before 8.1.0, PcxDecode has a buffer over-read when decoding a crafted PCX file because the user-supplied stride value is trusted for buffe… Pillow 8.1.0+ Fix from $1,9502021-01-12 MEDIUM 5.4 CVE-2020-35655 In Pillow before 8.1.0, SGIRleDecode has a 4-byte buffer over-read when decoding crafted SGI RLE image files because offsets and length tables are mi… Pillow 8.1.0+ Fix from $1,6002021-01-12 CRITICAL 9.8 CVE-2020-27619EPSS 8% In Python 3 through 3.9.0, the Lib/test/multibytecodec_support.py CJK codec tests call eval() on content retrieved via HTTP. Python 3.6.13 / 3.7.10+ Fix from $2,3002020-10-22 MEDIUM 6.5 CVE-2020-26137 urllib3 before 1.25.9 allows CRLF injection if the attacker controls the HTTP request method, as demonstrated by inserting CR and LF control characte… Urllib3 1.25.9+ Fix from $1,6002020-09-30 HIGH 7.2 CVE-2020-26116EPSS 6% http.client in Python 3.x before 3.5.10, 3.6.x before 3.6.12, 3.7.x before 3.7.9, and 3.8.x before 3.8.5 allows CRLF injection if the attacker contro… Python 3.5.10 / 3.6.12+ Fix from $1,9502020-09-27 CRITICAL 9.8 CVE-2020-15801 In Python 3.8.4, sys.path restrictions specified in a python38._pth file are ignored, allowing code to be loaded from arbitrary locations. The <execu… Python 3.7.9 / 3.8.5+ Fix from $2,3002020-07-17 HIGH 7.5 CVE-2019-20907EPSS 6% In Lib/tarfile.py in Python through 3.8.3, an attacker is able to craft a TAR archive leading to an infinite loop when opened by tarfile.open, becaus… Python 3.5.10 / 3.6.12+ Fix from $1,9502020-07-13 HIGH 7.8 CVE-2020-15523 In Python 3.6 through 3.6.10, 3.7 through 3.7.8, 3.8 through 3.8.4rc1, and 3.9 through 3.9.0b4 on Windows, a Trojan horse python3.dll might be used i… Python 3.5.10 / 3.6.12+ Fix from $1,9502020-07-04 HIGH 8.1 CVE-2020-11538 In libImaging/SgiRleDecode.c in Pillow through 7.0.0, a number of out-of-bounds reads exist in the parsing of SGI image files, a different issue than… Pillow after 7.0.0 Fix from $1,9502020-06-25 HIGH 7.8 CVE-2020-10379 In Pillow before 7.1.0, there are two Buffer Overflows in libImaging/TiffDecode.c. Pillow 7.1.0+ Fix from $1,9502020-06-25 MEDIUM 5.5 CVE-2020-10177 Pillow before 7.1.0 has multiple out-of-bounds reads in libImaging/FliDecode.c. Pillow 7.1.0+ Fix from $1,6002020-06-25 MEDIUM 5.5 CVE-2020-10378 In libImaging/PcxDecode.c in Pillow before 7.1.0, an out-of-bounds read can occur when reading PCX files where state->shuffle is instructed to read b… Pillow 7.1.0+ Fix from $1,6002020-06-25 MEDIUM 5.5 CVE-2020-10994 In libImaging/Jpeg2KDecode.c in Pillow before 7.1.0, there are multiple out-of-bounds reads via a crafted JP2 file. Pillow 7.1.0+ Fix from $1,6002020-06-25