最新のセキュリティ情報
10月22日(木)今日
Pillow: Infinite loop in MIC n_frames when the embedded TIFF
影響: pip:Pillow >= 7.2.0, < 13.0.0 → 13.0.0 ============================================================================ Infinite loop in MIC n_frames when the embedded TIFF has 3+ IFDs Location: src/PIL/MicImagePlugin.py:86 in MicImageFile.tell() Commit: a707c6b21c313880d0771e54965d142dd42358b6 ============================================================================ A crafted 5.6 KB image file makes Pillow loop forever at 100% CPU when an application asks how many frames the image has. This only affects installations that have the o…
Pillow: NULL dereference in ImagingExpand via rank filters on zero-size images
影響: pip:Pillow <= 12.3.0 → 13.0.0 ============================================================================ NULL dereference in ImagingExpand via rank filters on zero-size images Location: src/libImaging/Filter.c:79 in ImagingExpand() Commit: a707c6b21c313880d0771e54965d142dd42358b6 ============================================================================ Applying Pillow's median, minimum, maximum or rank filter to an image with zero width or zero height crashes the whole Python process instead of raising an error. Empty…
Pillow: NULL pointer dereference in Image.merge via an unvalidated band 0
影響: pip:pillow >= 12.0.0, < 13.0.0 → 13.0.0 Summary Image.merge() checks the mode of every input band except band 0. If band 0 is a single-band I or F image, the native merge routine reads a pixel pointer that is NULL for those modes and the process crashes. The IPTC plugin reaches this from a plain Image.open() followed by a load, and IPTC has no magic-byte prefilter, so a crafted file with no recognizable header can drive it. Details The validation loop skips band 0: - src/PIL/Image.py:3795 iterates for band in bands[1:] and checks mod…
Pillow: Invalid free in FreeType glyph rendering when a stroker is active
影響: pip:pillow >= 10.0.0, < 13.0.0 → 13.0.0 Summary When text is drawn with a non-zero stroke width, Pillow creates a FreeType stroker and then loads each glyph. If FT_Load_Glyph fails for a glyph, the cleanup path calls FT_Done_Glyph on the glyph variable. That variable is not initialized before the first measurement loop, and in the render loop it is not reset to NULL after each glyph is freed. A malformed font loaded from untrusted bytes can force the load error and reach this free. This is a latent memory-safety defect; whether it cr…
Pillow: Double free in ImagingScaleAffine on calloc failure via Image.transform
影響: pip:Pillow <= 12.3.0 → 13.0.0 ============================================================================ Double free in ImagingScaleAffine on calloc failure via Image.transform Location: src/libImaging/Geometry.c:866 in ImagingScaleAffine() Commit: a707c6b21c313880d0771e54965d142dd42358b6 ============================================================================ There is a double free in Pillow's Image.transform() that crashes the process when an oversized transform runs out of memory. Instead of only raising MemoryErro…
Pillow: Argument Injection in Ghostscript call, potentially leading into RCE
影響: pip:Pillow >= 2.6.0, < 13.0.0 → 13.0.0 Summary PIL.EpsImagePlugin.Ghostscript() builds the Ghostscript command line using the input file path (fp.name) without sanitization, placing it at -f . A filename beginning with - is interpreted by Ghostscript as an option, giving command-line argument injection; chainable to RCE (see Impact). Reproduces with Pillow's default invocation (with -dSAFER enabled). Details _Give all details on the vulnerability. Pointing to the incriminated source code is very helpful for the maintainer._ Type CWE…
virtualenv bash activate runs commands from an environment name with a backslash before $
影響: pip:virtualenv <= 21.14.6 → 21.14.7 Summary The bash activate script escapes the environment name for only one of the two passes bash makes over PS1, so a backslash in the name undoes the escaping and a name containing \$(...) runs as commands in the user's shell each time bash draws the prompt. Affected area src/virtualenv/activation/bash/activate.sh, the block that prepends the environment name to PS1. Attacker-controlled input The environment name: the environment directory's name, or the --prompt or VIRTUALENV_PROMPT value. A…
virtualenv activate runs commands from the environment name in zsh with PROMPT_SUBST
影響: pip:virtualenv <= 21.14.3 → 21.14.4 Impact zsh users activate an environment with the bash activate script, which puts the environment name into PS1. Since 21.13.0 the script escapes backslashes, dollar signs and backticks in that name, but only when BASH_VERSION is set, so zsh gets the raw value. With the PROMPT_SUBST option set, zsh runs parameter expansion, command substitution and arithmetic expansion on PS1 each time it draws the prompt. A name that contains $(...), backticks or ${...} then runs as commands in the user's she…
virtualenv activate.fish runs commands from a path or prompt with a backslash before a quote
影響: pip:virtualenv <= 21.14.1 → 21.14.2 Impact FishActivator defines no quote(), so it inherits ViaTemplateActivator.quote, which returns shlex.quote(string). That function follows POSIX sh rules, where a backslash inside single quotes stays a literal character. fish reads \' inside single quotes as an escaped quote and \\ as an escaped backslash. A value with a backslash before a quote therefore ends the literal somewhere other than where shlex.quote put the end, and fish expands the command substitution that follows. The environmen…
virtualenv activation scripts run code from a path that contains a placeholder name
影響: pip:virtualenv >= 20.26.6, <= 21.14.1 → 21.14.2 Impact ViaTemplateActivator.instantiate_template replaces the placeholders in an activation template one key at a time, each across the whole text. When a value that it already substituted and quoted contains the name of a later placeholder, the later pass rewrites that name inside the quoted literal. The inserted value brings its own quotes, which close the outer literal, and the rest of the path runs as code when a user activates the environment. __VIRTUAL_NAME__ holds the environment's direc…
10月21日(水)昨日
Pillow: Out-of-bounds access in _imagingmorph on a zero-width image
影響: pip:Pillow <= 12.3.0 → 13.0.0 Summary A PPM or PGM file can declare a width of 0, which Pillow accepts, producing an image of size (0, N). Passing that image to ImageMorph.MorphOp.apply() makes the native morphology code index a row buffer at outrow[width - 1], which is outrow[-1] when the width is 0. The process crashes. Details The PPM parser reads width and height with no lower-bound check: - src/PIL/PpmImagePlugin.py:119 The native apply() writes the row edges with no guard that the width is positive: - src/_imagingmorp…
Pillow: GIF seek keeps rejected size after DecompressionBombError, allowing DoS
影響: pip:Pillow >= 9.2.0, < 13.0.0 → 13.0.0 ============================================================================ GIF seek keeps rejected size after DecompressionBombError, allowing DoS Location: src/PIL/GifImagePlugin.py:293 in GifImageFile._seek() Commit: a707c6b21c313880d0771e54965d142dd42358b6 ============================================================================ A GIF of about 60 bytes can make Pillow allocate gigabytes of memory. This affects applications that catch the "image too large" error raised while stepping to…
Pillow: TiffDecode returns uninitialized memory as pixels for short JPEG strips
影響: pip:Pillow >= 5.3.0, < 13.0.0 → 13.0.0 ============================================================================ TiffDecode returns uninitialized memory as pixels for short JPEG strips Location: src/libImaging/TiffDecode.c:554 in _decodeStrip() Commit: a707c6b21c313880d0771e54965d142dd42358b6 ============================================================================ Pillow hands back leftover process memory as image pixels when it opens a small crafted TIFF file. Anyone who can get an application to open their image, and can se…
Pillow: TIFF encoder ColorMap plane-size mismatch causes a heap out-of-bounds read
影響: pip:Pillow <= 12.3.0 → 13.0.0 Summary A small attacker-supplied TIFF can be opened and loaded normally, then reach an out-of-bounds read when an application saves it back to TIFF with retained metadata. The fixed reproducer is a 1×1, 16-bit grayscale, PackBits-compressed TIFF containing tag 320 (ColorMap) with 768 SHORT values: three zero-filled planes of 256 entries each. No Python object is forged and no metadata is injected after loading. Pillow's TIFF encoder allocates 768 × 2 = 1536 bytes, then passes three plane point…
Pillow: Unbounded recursion parsing a PDF page tree or trailer chain (incomplete fix for CVE-2026-42310)
影響: pip:pillow >= 5.1.0, < 13.0.0 → 13.0.0 Summary When an application appends to an existing PDF with Image.save(..., format="PDF", append=True), Pillow parses that file with PdfParser. Two recursive parsers have no effective bound. linearize_page_tree follows /Kids with no visited set or depth limit, so a cyclic or duplicated page tree recurses without end. read_prev_trailer rejects only an exactly repeated /Prev offset, so a long chain of unique offsets still recurses. The trailer-loop guard added for CVE-2026-42310 does not cover ei…
Pillow: OOB read in TiffDecode.c tile and RGBA paths leaks heap memory into pixels
影響: pip:Pillow >= 8.1.0, < 13.0.0 → 13.0.0 ============================================================================ OOB read in TiffDecode.c tile and RGBA paths leaks heap memory into pixels Location: src/libImaging/TiffDecode.c:483 in _decodeTile() Commit: a707c6b21c313880d0771e54965d142dd42358b6 ============================================================================ Pillow reads past the end of a heap buffer when decoding certain malformed compressed TIFF files, and copies the bytes it reads into the pixels of the image it re…
Pillow: Heap buffer overflow in ImagingJpegDecode
影響: pip:Pillow <= 12.3.0 → 13.0.0 Summary JpegImageFile.draft() — which Image.thumbnail() calls automatically — requests 1/2, 1/4 or 1/8 scaled JPEG output and shrinks self._size and the tile extents to match, so _setimage() allocates a single-row decode buffer of ceil(W/s) samples. ImagingJpegDecode() sets cinfo.scale_num/scale_denom, calls jpeg_start_decompress(), and then reads scanlines into that buffer without ever comparing cinfo.output_width, cinfo.output_height or cinfo.out_color_components against state->xsize, state->…
AIOHTTP: File descriptor exhaustion in multipart requests
影響: pip:aiohttp >= 2.0.0, < 3.14.4 → 3.14.4 Summary An attacker can exhaust file descriptors with specially crafted multipart requests. Impact If a handler uses Request.post(), it may be possible for an attacker to use an unlimited number of file descriptors, potentially resulting in resource exhaustion.
uv's bundled CA store trusts an emSign root whose intermediate CA keys are compromised
影響: pip:uv < 0.13.4 → 0.13.4 By default, uv verifies TLS connections against a vendored copy of the webpki-root-certs bundle. Versions before 0.13.4 include the emSign ECC Root CA - G3 root. Eight eMudhra intermediate CA certificates that chain to that root have compromised private keys, and the CA has revoked them. An attacker with one of the compromised keys can issue certificates that uv accepts for any hostname, and can be used to issue certificates to enable MITM attacks. uv 0.13.4 removes the root from its vendored b…
certifi bundles emSign root CAs with compromised intermediate CA keys
影響: pip:certifi >= 2019.03.09, < 2026.10.19 → 2026.10.19 Certifi versions before 2026.10.18 include the emSign ECC Root CA - G3 root certificate in their bundled CA store. Eight eMudhra intermediate CA certificates that chain to this root have compromised private keys and the CA has revoked them. An attacker with one of the compromised keys can issue valid-looking certificates for any hostname. If the attacker is also on-path, they can intercept or modify TLS traffic from clients that trust the certifi bundle. Examples include requests, urllib3 and p…
10月20日(火)
aiohttp server lacks an initial request/header timeout
影響: pip:aiohttp <= 3.14.3 → 3.14.4 Summary The keepalive timeout was not used during the initial portion of a request. Impact An attacker could keep an idle connection open indefinitely before sending any data. Workaround Use a reverse proxy (as recommended for all production deployments) with sensible keepalive limits.
aiohttp: Multiple instances of excessive or unbounded memory/CPU use
影響: pip:aiohttp <= 3.14.3 → 3.14.4 Summary Multiple cases were found where aiohttp could use excessive or unbounded memory, or excessive CPU consumption on attacker controlled requests. Impact An attacker could cause resource exhaustion through specially crafted requests.
Mercury: Unauthenticated Remote Code Execution in /api/terminals - access control bypass
影響: pip:mercury >= 3.0.0, <= 3.2.3 → 3.2.4 Summary A missing comma in mercury_app/block_handler.py's BLOCKED_PATTERNS list causes the blocklist to fail to cover the /api/terminals endpoint. As a result, any unauthenticated attacker can spawn a full, interactive OS-level shell on the host running Mercury. Details The blocklist in mercury_app/block_handler.py is defined as: BLOCKED_PATTERNS = [ # JupyterLab UI + API r"/lab(?!/(?:extensions/|api/settings(?:/|$)|api/translations(?:/|$)))(?:/.)?" r"/api/terminals(?:/.)?", r"/api/shutdown(?:/…
Mercury: Unauthenticated Remote Code Execution via /api/kernels
影響: pip:mercury <= 3.2.5 → 3.2.6 Mercury runs a JupyterLab server with anonymous access by default (mercury_app/__main__.py sets --IdentityProvider.token='' when no --token/MERCURY_TOKEN is given; when tokenless it also sets --ServerApp.disable_check_xsrf=True). It relies on a blocklist (mercury_app/block_handler.py BLOCKED_PATTERNS: /lab, /api/terminals, /api/shutdown, /files) to keep anonymous users off dangerous Jupyter endpoints. The vulnerability /api/kernels is NOT in the blocklist (and cannot be — Mercury needs kernels…
LoopX serve-status permissive CORS policy exposes control-plane state and private Markdown files
影響: pip:loopx >= 0.0.1, < 0.4.5 → 0.4.5 Summary loopx serve-status sends Access-Control-Allow-Origin: on every response, including its unauthenticated GET routes. Because the endpoint is unauthenticated and bound to a fixed, well-known loopback port, any website the operator visits can read LoopX control-plane state and the contents of Markdown files inside every registered goal repo, using a plain fetch() with no user interaction. The write endpoints are not affected — they are correctly Origin-checked. This report is strictly about…
10月17日(土)
LMCache: Remote code execution via unsafe deserialization in multiprocess mode transport
影響: pip:lmcache >= 0.3.9, < 0.5.6 → 0.5.6 Summary LMCache is vulnerable to Unauthenticated Remote Code Execution via Pickle Deserialization on the Multiprocess ZMQ Transport Details LMCache multiprocess mode, also called distributed mode, opens an unauthenticated ZeroMQ ROUTER so worker processes can register and share KV cache blocks. The intended clients are sibling LMCache processes. There is no CURVE, ZAP, password, or message authentication on that socket. LMCache used only inside a vLLM process does not open this port. The transp…
Claude Agent SDK: Argument Injection via resume Option Allows Arbitrary Command Execution
影響: pip:claude-agent-sdk < 0.2.121 → 0.2.121 The Claude Agent SDK for Python passed the resume option to the Claude CLI without validation, allowing a value beginning with - to be interpreted as a separate CLI flag. An attacker who controlled the resume value could inject an --mcp-config flag defining a stdio MCP server, resulting in arbitrary command execution at CLI startup that bypassed the SDK's permission controls. Exploitation required an application to pass untrusted input as the session ID to resume. Users are advised to update to…