GitHub Advisory Databaseの情報
2 ページ目
10月23日(金)
Pillow: PNG eXIf chunk makes EXIF parsing run in quadratic time
影響: pip:Pillow >= 11.0.0, < 13.0.0 → 13.0.0 A PNG file with a large eXIf chunk full of repeated 6-byte markers makes Pillow's EXIF parser take seconds of CPU instead of milliseconds. The cost grows with the square of the chunk size, so a normal small-photo-sized file is enough to cause real delay. ### Details Exif.load() in src/PIL/Image.py strips a marker from the start of the EXIF data like this: python while data and data.startswith(b"Exif\x00\x00"): data = data[6:] Each pass makes a new copy of the remaining data. A real camera write…
Pillow: TarIO negative size field causes infinite CPU-spin loop
影響: pip:Pillow < 13.0.0 → 13.0.0 TarIO.__init__ does not check that a tar header's size field is positive. A crafted header with a negative size makes it seek backward onto itself. This causes an infinite loop that uses 100% CPU and never returns. Details TarIO.__init__ reads 512-byte tar headers one at a time, looking for a member with a given name. For each header it reads the size field and skips ahead to the next header: python size = int(s[124:135], 8) ... self.fh.seek((size + 511) & (~511), io.SEEK_CUR) There is no check…
Pillow: Reachable undefined behavior in native integer operations, potentially leading to denial of service or logic integrity compromise
影響: pip:pillow < 13.0.0 → 13.0.0 Affected Object and Source Package: Pillow 12.3.0 Source: PyPI sdist pillow-12.3.0.tar.gz SHA-256: 3b8182a766685eaa002637e28b4ec8d6b18819a0c71f579bf0dbaa5830297cce Sink: src/_imaging.c:2809:15, xsize += dx Details The code in Pillow 12.3.0 is: c for (xsize = 0; text; text++) { int dx = self->glyphs[text].dx; if (dx > 0 && xsize > INT_MAX - dx) { PyErr_SetString(PyExc_OverflowError, "Width too large"); return -1; } xsize += dx; } The PILfont glyph advance is parsed from a signed 16-bit field, so…
Pillow PDF append accepts malformed shared page-tree DAG causing resource exhaustion
影響: pip:Pillow >= 5.1.0, < 13.0.0 → 13.0.0 Pillow's documented PDF append path can spend disproportionate CPU time on a compact malformed PDF page tree. An attacker who can supply an existing PDF to an application that appends an image with Image.save(..., format="PDF", append=True) can provide a malformed /Pages tree where each level repeats the same child /Pages reference in /Kids. Pillow treats the graph as a tree and expands each repeated reference in PdfParser.linearize_page_tree() without tracking visited or duplicate indirect ref…
Pillow multi-frame loaders can reuse stale native image storage after mode transitions
影響: pip:Pillow >= 11.0.0, < 13.0.0 → 13.0.0 Pillow multi-frame image loaders can retain native ImagingCore storage allocated for one frame while changing the Python-side image mode and decoder tiles for a later frame. If frame 0 allocates storage for a narrow mode such as L, and a later frame of the same dimensions switches to a wider mode such as RGB or CMYK, Pillow may decode wider pixels into the stale narrow native buffer. This causes native out-of-bounds writes and process crashes. In the MPO/JPEG path, I also demonstrated command e…
Pillow: BMP RLE decoder memory-amplification DoS via unbounded delta escape / absolute mode
影響: pip:pillow >= 9.1.0, < 13.0.0 → 13.0.0 BmpRleDecoder can be forced to allocate gigabytes of memory from a kilobyte-sized crafted BMP file via unbounded growth in the delta escape and absolute mode branches. Affected versions All versions up to and including current HEAD (v13.0.0.dev0, commit e7a7ea84) Root cause BmpRleDecoder.decode() (BmpImagePlugin.py:327-395) builds a Python bytearray data with dest_length = xsizeysize, looping while len(data) up to ~255xsize bytes in ONE iteration. - absolute mode (line 385): data += bytes_read…
Pillow: Decompression bomb check bypass in SpiderImagePlugin.seek() leads to unbounded allocation DoS
影響: pip:pillow < 13.0.0 → 13.0.0 SpiderImagePlugin's seek() bypasses the decompression bomb check, allowing a tiny ( DecompressionBombWarning fires correctly. - BYPASS: Image.open(stack, frame0=1x1) passes; im.seek(1) sets size (100,100) with NO DecompressionBombWarning/Error -> the check is bypassed. Real-world impact: a large frame-1 nsam/nrow (e.g. 40000x40000) causes im.load() to allocate ~6.4 GB (mode F) with the bomb check fully bypassed, from a file under 1 KB. Suggested fix Call Image._decompression_bomb_check(self.siz…
Pillow: Decompression-bomb protection bypass via multi-frame seek() in MPO and DCX (MpoImageFile.seek / DcxImageFile.seek)
影響: pip:Pillow < 13.0.0 → 13.0.0 Pillow's decompression-bomb protection (Image._decompression_bomb_check, gated by Image.MAX_IMAGE_PIXELS) is enforced only on the first frame, inside Image.open(). For multi-frame formats, seek() re-parses the target frame's header and resets self._size. GifImagePlugin and TiffImagePlugin re-run the bomb check on seek(), but MpoImageFile.seek() and DcxImageFile.seek() do not. A crafted MPO or DCX whose first frame is tiny (passing the check) but whose later frame declares enormous dimensions th…
PyJWT: HS256/384/512 verify accepts empty HMAC key via oct JWK (PyJWK/PyJWKClient) enabling token forgery
影響: pip:pyjwt <= 2.13.0 → 2.14.0 HMACAlgorithm.from_jwk accepts a symmetric (kty=oct) JWK whose k value is the empty string and returns a zero-length key without raising. When a token is then verified with that key object (a PyJWK, or a PyJWK resolved by PyJWKSet / PyJWKClient), the HMAC verifier computes HMAC(key=b"", signing_input) and accepts any token an attacker forged with the same empty key. The attacker needs no secret knowledge: they reproduce the digest locally with an empty key and set the token's kid to the empty-k…
Jupyter Server: Gateway WebSocket handler bypasses kernel execute authorization
影響: pip:jupyter-server >= 2.0.0, < 2.6.0 → 2.6.0 Jupyter Server's gateway WebSocket handler checks that a user is authenticated, but it does not ask the configured Authorizer whether that user may execute kernels. In Jupyter Server 2.0.0 through 2.5.0, enabling GatewayClient.url automatically replaced the normal kernel channel handler with this gateway-specific handler. An authenticated user who is denied the execute action on the kernels resource can therefore still open a kernel channel and send messages to the upstream kernel. Details The…
Brotli: Out-of-bounds write in the Brotli decoder ("Node2Shell") also affects the PyPI Brotli package
影響: pip:brotli >= 1.0.3, < 1.2.1 → 1.2.1, pip:brotlicffi >= 1.0.3, < 1.2.1.0 → 1.2.1.0 A buffer overflow vulnerability in the Brotli decoder (c/dec/decode.c) in Google Brotli versions 1.0.3 through 1.2.0 on all platforms allows a remote unauthenticated attacker to corrupt adjacent decoder state memory, disclose sensitive memory contents, cause a denial of service, or potentially execute arbitrary code using a crafted Brotli-compressed stream. Users need to update any Brotli libraries or binaries between 1.0.3 through 1.2.0 to the latest available version: 1.0.10 or 1.1.1 or 1.2.1.
10月22日(木)
virtualenv: Builtin creation follows linked environment directories
影響: pip:virtualenv < 21.14.9 → 21.14.9 The builtin creator accepts existing directory symlinks through ensure_dir() and writes environment files through those directories. This permits writes outside the requested destination. Anthropic's OSS Scanner reported this as ANT-2026-MUFJEG11 in virtualenv-20261015-005, received on 15 October 2026. Affected area Directory preparation before environment files are created. Attacker-controlled input Another account must be able to prepare linked entries below the chosen destination before crea…
virtualenv: Deletion recovery can change a symlink target's mode
影響: pip:virtualenv < 21.14.9 → 21.14.9 The deletion error handler obtains permission bits with lstat() but applies them through chmod(), which follows symlinks. On an eligible unlink failure this can change permissions outside the destination. Anthropic's OSS Scanner reported this as ANT-2026-UK90QC27 in virtualenv-20261015-005, received on 15 October 2026. Affected area Permission recovery after a filesystem deletion error. Attacker-controlled input A deletion must fail on a symbolic-link entry and enter the permission-recovery bra…
virtualenv: Generated POSIX console launchers interpret destination paths as shell syntax
影響: pip:virtualenv < 21.14.9 → 21.14.9 A destination path supplied to virtualenv can be interpreted as shell syntax by a generated POSIX console launcher. The app-data seeder and pip delegate launcher generation to distlib but supply the interpreter path in a form that does not preserve it as literal data in the shell wrapper. Affected area POSIX console scripts generated by the app-data seeder or pip when the interpreter path requires a shell wrapper. Windows executable launchers are not affected by this path. Attacker-controlled i…
Pillow: Memory disclosure and segfault in libtiff encoder via crafted TIFF tags
影響: pip:Pillow <= 12.3.0 → 13.0.0 ============================================================================ Memory disclosure and segfault in libtiff encoder via crafted TIFF tags Location: src/encode.c:1014 in PyImaging_LibTiffEncoderNew() Commit: a707c6b21c313880d0771e54965d142dd42358b6 ============================================================================ A crafted TIFF file of a few hundred bytes makes Pillow copy an attacker-chosen amount of its own process memory into the TIFF it writes back out, or crash the pro…
Pillow: Heap buffer overflow in _tiffWriteProc when saving TIFF to BytesIO
影響: pip:Pillow >= 2.0.0, < 13.0.0 → 13.0.0 ============================================================================ Heap buffer overflow in _tiffWriteProc when saving TIFF to BytesIO Location: src/libImaging/TiffDecode.c:94 in _tiffWriteProc() Commit: a707c6b21c313880d0771e54965d142dd42358b6 ============================================================================ Pillow can write attacker-chosen data past the end of a heap buffer when it saves a TIFF image to an in-memory destination such as io.BytesIO rather than to a file. The…
Pillow: Heap use-after-free when encoding TIFF to an in-memory buffer
影響: pip:pillow >= 11.3.0, < 13.0.0 → 13.0.0 Saving an image as TIFF to an in-memory buffer can trigger a heap use-after-free if libtiff rejects a tag at encode time. When TIFFWriteScanline fails, the encoder frees its output buffer but leaves the libtiff handle open. Later, when the encoder object is torn down, TIFFClose flushes buffered bytes through the write callback and writes into the freed buffer. An application that re-encodes attacker-influenced images to TIFF in memory can be crashed and is a candidate for remote code execution.…
Pillow: Infinite loop in PdfParser.rewrite_pages on page tree Parent cycle
影響: pip:Pillow >= 5.1.0, < 13.0.0 → 13.0.0 ============================================================================ Infinite loop in PdfParser.rewrite_pages on page tree Parent cycle Location: src/PIL/PdfParser.py:505 in PdfParser.rewrite_pages() Commit: a707c6b21c313880d0771e54965d142dd42358b6 ============================================================================ A PDF file of a few hundred bytes makes Pillow hang forever, holding one processor core at 100%, when an application tries to append an image to it. Anyone who can s…
Pillow: APNG background disposal allocates full canvas before decompression bomb check
影響: pip:Pillow >= 8.1.0, < 13.0.0 → 13.0.0 ============================================================================ APNG background disposal allocates full canvas before decompression bomb check Location: src/PIL/PngImagePlugin.py:1000 in PngImageFile._seek() Commit: a707c6b21c313880d0771e54965d142dd42358b6 ============================================================================ A 126-byte animated PNG file makes Pillow's Image.open() allocate and fill memory sized by the image dimensions the file claims, before Pillow's built-i…
Pillow: MSP RLE decoder expands a tiny file into unbounded memory
影響: pip:pillow >= 4.1.0, < 13.0.0 → 13.0.0 The MSP RLE decoder expands run-length data into an in-memory buffer with no cap tied to the declared image size. A small file that passes the pixel-count check can force hundreds of megabytes or more of allocation when the application loads pixels. Details The MSP decoder writes each run into an unbounded io.BytesIO and can expand roughly 85x per run: - src/PIL/MspImagePlugin.py:144-146 Impact Memory-exhaustion denial of service from a tiny crafted image in any application that loads pixels. T…
Pillow: Quadratic-time DoS in PDF save_all (PdfParser.next_object_id)
影響: pip:Pillow >= 5.1.0, < 13.0.0 → 13.0.0 ============================================================================ Quadratic-time DoS in PDF save_all (PdfParser.next_object_id) Location: src/PIL/PdfParser.py:629 in next_object_id() Commit: a707c6b21c313880d0771e54965d142dd42358b6 ============================================================================ Pillow's PDF writer takes time proportional to the square of the number of frames when it saves a multi-frame image as a multi-page PDF. Anyone who can get an application to conve…
Pillow: PdfParser can recurse without limit in get_value() and linearize_page_tree()
影響: pip:Pillow >= 5.1.0, < 13.0.0 → 13.0.0 PdfParser's get_value() can recurse without any limit and crash with an uncaught RecursionError. It is reachable through Image.save(im, fp= , format="PDF", append=True) when the existing PDF file is attacker-controlled. This is the same class of bug as https://github.com/advisories/GHSA-r73j-pqj5-w3x7 (the /Prev trailer chain loop, fixed earlier this year), in the same file, but in two different functions that fix did not touch. Details get_value() in src/PIL/PdfParser.py This is a clas…
Pillow: ReDoS in XbmImagePlugin: 512-byte file stalls Image.open() for minutes
影響: pip:Pillow <= 12.3.0 → 13.0.0 ============================================================================ ReDoS in XbmImagePlugin: 512-byte file stalls Image.open() for minutes Location: src/PIL/XbmImagePlugin.py:58 in XbmImageFile._open() Commit: a707c6b21c313880d0771e54965d142dd42358b6 ============================================================================ A crafted 512-byte file makes Pillow's Image.open() spend about six minutes of processor time on one core before it gives up with UnidentifiedImageError. Anyone w…
Pillow: Image.quantize() with empty palette leaks uninitialized stack memory
影響: pip:Pillow >= 9.1.0, < 13.0.0 → 13.0.0 ============================================================================ Image.quantize() with empty palette leaks uninitialized stack memory Location: src/libImaging/Palette.c:216 in ImagingPaletteCacheUpdate() Commit: a707c6b21c313880d0771e54965d142dd42358b6 ============================================================================ When an application lets a user supply the palette image for Pillow's Image.quantize(palette=...), the user can get back 512 bytes of the server process's st…
Pillow: Quadratic GIF comment concatenation allows DoS in Image.open()
影響: pip:Pillow >= 5.4.0, < 13.0.0 → 13.0.0 ============================================================================ Quadratic GIF comment concatenation allows DoS in Image.open() Location: src/PIL/GifImagePlugin.py:266 in GifImageFile._seek() Commit: a707c6b21c313880d0771e54965d142dd42358b6 ============================================================================ Opening a crafted GIF file with Image.open() takes time that grows with the square of the file's size, so anyone who can submit an image to a service that uses Pillow ca…
Pillow: Infinite loop in MIC n_frames when the embedded TIFF
影響: pip:Pillow >= 7.2.0, < 13.0.0 → 13.0.0 ============================================================================ Infinite loop in MIC n_frames when the embedded TIFF has 3+ IFDs Location: src/PIL/MicImagePlugin.py:86 in MicImageFile.tell() Commit: a707c6b21c313880d0771e54965d142dd42358b6 ============================================================================ A crafted 5.6 KB image file makes Pillow loop forever at 100% CPU when an application asks how many frames the image has. This only affects installations that have the o…
Pillow: Quadratic GIF comment copying during save
影響: pip:pillow >= 9.2.0, < 13.0.0 → 13.0.0 On Pillow 12.3.0 and upstream main (ad277e2761b489681e71b51e91367d46b0ceabb9), a GIF with a long comment makes _get_global_header() copy portions of the comment repeatedly when saving, including comments carried over from untrusted images. I suggest provisional Moderate severity for crafted-image CPU denial of service, with CVSS-B 6.9 assuming a network service automatically opens unauthenticated uploads and they are resaved as GIFs; impact depends on input-size, concurrency, and worker CPU lim…
Pillow: NULL dereference in ImagingExpand via rank filters on zero-size images
影響: pip:Pillow <= 12.3.0 → 13.0.0 ============================================================================ NULL dereference in ImagingExpand via rank filters on zero-size images Location: src/libImaging/Filter.c:79 in ImagingExpand() Commit: a707c6b21c313880d0771e54965d142dd42358b6 ============================================================================ Applying Pillow's median, minimum, maximum or rank filter to an image with zero width or zero height crashes the whole Python process instead of raising an error. Empty…
Pillow: NULL pointer dereference in Image.merge via an unvalidated band 0
影響: pip:pillow >= 12.0.0, < 13.0.0 → 13.0.0 Image.merge() checks the mode of every input band except band 0. If band 0 is a single-band I or F image, the native merge routine reads a pixel pointer that is NULL for those modes and the process crashes. The IPTC plugin reaches this from a plain Image.open() followed by a load, and IPTC has no magic-byte prefilter, so a crafted file with no recognizable header can drive it. Details The validation loop skips band 0: - src/PIL/Image.py:3795 iterates for band in bands[1:] and checks mod…
Pillow: Invalid free in FreeType glyph rendering when a stroker is active
影響: pip:pillow >= 10.0.0, < 13.0.0 → 13.0.0 When text is drawn with a non-zero stroke width, Pillow creates a FreeType stroker and then loads each glyph. If FT_Load_Glyph fails for a glyph, the cleanup path calls FT_Done_Glyph on the glyph variable. That variable is not initialized before the first measurement loop, and in the render loop it is not reset to NULL after each glyph is freed. A malformed font loaded from untrusted bytes can force the load error and reach this free. This is a latent memory-safety defect; whether it cr…
Pillow: Double free in ImagingScaleAffine on calloc failure via Image.transform
影響: pip:Pillow <= 12.3.0 → 13.0.0 ============================================================================ Double free in ImagingScaleAffine on calloc failure via Image.transform Location: src/libImaging/Geometry.c:866 in ImagingScaleAffine() Commit: a707c6b21c313880d0771e54965d142dd42358b6 ============================================================================ There is a double free in Pillow's Image.transform() that crashes the process when an oversized transform runs out of memory. Instead of only raising MemoryErro…
Pillow: P;2L and P;4L decoders may read 1 to 3 bytes past the passed buffer size
影響: pip:Pillow <= 12.3.0 → 13.0.0 On main, even with the guard in #9725, it's possible to have these decoders read 1 to 3 bytes past the end of the passed buffer with a suitable width/height. Details ImagingRawDecode and the P;2L / P;4L unpackers disagree about how many bytes a line of data occupies. The raw decoder derives the line size from the bits per pixel c state->bytes = (state->xsize state->bits + 7) / 8; and uses it both for the bounds check and to advance to the next line. For P;2L and P;4L, bits is 2 and 4 re…
Pillow: Argument Injection in Ghostscript call, potentially leading into RCE
影響: pip:Pillow >= 2.6.0, < 13.0.0 → 13.0.0 PIL.EpsImagePlugin.Ghostscript() builds the Ghostscript command line using the input file path (fp.name) without sanitization, placing it at -f . A filename beginning with - is interpreted by Ghostscript as an option, giving command-line argument injection; chainable to RCE (see Impact). Reproduces with Pillow's default invocation (with -dSAFER enabled). Details _Give all details on the vulnerability. Pointing to the incriminated source code is very helpful for the maintainer._ Type CWE…
pypdf: Unvalidated JPEG image data loading
影響: pip:pypdf < 6.21.1 → 6.21.1 An attacker who uses this vulnerability can craft a PDF which leads to arbitrary image parsers being called. This requires loading an image which claims to use the /DCTDecode filter (JPEG data). Users which do not have the optional Pillow dependency installed in their environment are not affected. Patches This has been fixed in [pypdf==6.21.1](https://github.com/py-pdf/pypdf/releases/tag/6.21.1). Workarounds If you cannot upgrade yet, consider applying the changes from PR [#4222](https:/…
djust: Arbitrary absolute-path file read in the find_handlers_for_template MCP tool
影響: pip:djust >= 0.9.0, <= 1.0.9 → 1.0.10, pip:djust >= 1.1.0, <= 1.1.6 → 1.1.7, pip:djust >= 1.2.0.dev0, <= 1.2.3 → 1.2.4, pip:djust >= 1.3.0.dev0, <= 1.3.0rc7 → 1.3.0rc8 Affected version / file / line Version: djust v1.1.4 (latest release, published 2026-09-23). File: python/djust/mcp/server.py:354-433 (MCP tool find_handlers_for_template). Confirmed identical on the commit used for triage, a7e4fafd1667b4db0b1465652d4a63cb17117a07. Description @mcp.tool() def find_handlers_for_template(template_path: str) -> str: """ Args: template_path: Either a logical template name (e.g. 'demos/counter.html' — what you'd pass to render) OR an absolute filesystem path. Both a…
pypdf: Possible infinite loop in PdfWriter.find_outline_item
影響: pip:pypdf < 6.20.1 → 6.20.1 An attacker who uses this vulnerability can craft a PDF which leads to an infinite loop. This requires calling find_outline_item on a PdfWriter. Patches This has been fixed in [pypdf==6.20.1](https://github.com/py-pdf/pypdf/releases/tag/6.20.1). Workarounds If you cannot upgrade yet, consider applying the changes from PR [#4188](https://github.com/py-pdf/pypdf/pull/4188).
pypdf: Possible infinite loop when removing tree items
影響: pip:pypdf < 6.20.1 → 6.20.1 An attacker who uses this vulnerability can craft a PDF which leads to an infinite loop. This requires removing an object from a tree, for example an outline item. Patches This has been fixed in [pypdf==6.20.1](https://github.com/py-pdf/pypdf/releases/tag/6.20.1). Workarounds If you cannot upgrade yet, consider applying the changes from PR [#4188](https://github.com/py-pdf/pypdf/pull/4188).
pypdf: Possible infinite loop when hitting EOF in standard xref table
影響: pip:pypdf < 6.20.0 → 6.20.0 An attacker who uses this vulnerability can craft a PDF which leads to an infinite loop. This requires an incomplete file which ends inside the xref table. Patches This has been fixed in [pypdf==6.20.0](https://github.com/py-pdf/pypdf/releases/tag/6.20.0). Workarounds If you cannot upgrade yet, consider applying the changes from PR [#4170](https://github.com/py-pdf/pypdf/pull/4170). Notes This has been reported through both the secure channel and as a public issue at [#4169](https://gith…
virtualenv bash activate runs commands from an environment name with a backslash before $
影響: pip:virtualenv <= 21.14.6 → 21.14.7 The bash activate script escapes the environment name for only one of the two passes bash makes over PS1, so a backslash in the name undoes the escaping and a name containing \$(...) runs as commands in the user's shell each time bash draws the prompt. Affected area src/virtualenv/activation/bash/activate.sh, the block that prepends the environment name to PS1. Attacker-controlled input The environment name: the environment directory's name, or the --prompt or VIRTUALENV_PROMPT value. A…
pypdf: Possible large memory usage for streams with multiple filters
影響: pip:pypdf < 6.20.0 → 6.20.0 An attacker who uses this vulnerability can craft a PDF which leads to large memory consumption. This requires accessing any stream with a large amount of filters or multiple filters which pass around large amounts of data. Patches This has been fixed in [pypdf==6.20.0](https://github.com/py-pdf/pypdf/releases/tag/6.20.0). Workarounds If you cannot upgrade yet, consider applying the changes from PR [#4173](https://github.com/py-pdf/pypdf/pull/4173).
virtualenv activate runs commands from the environment name in zsh with PROMPT_SUBST
影響: pip:virtualenv <= 21.14.3 → 21.14.4 zsh users activate an environment with the bash activate script, which puts the environment name into PS1. Since 21.13.0 the script escapes backslashes, dollar signs and backticks in that name, but only when BASH_VERSION is set, so zsh gets the raw value. With the PROMPT_SUBST option set, zsh runs parameter expansion, command substitution and arithmetic expansion on PS1 each time it draws the prompt. A name that contains $(...), backticks or ${...} then runs as commands in the user's she…
virtualenv activate.fish runs commands from a path or prompt with a backslash before a quote
影響: pip:virtualenv <= 21.14.1 → 21.14.2 FishActivator defines no quote(), so it inherits ViaTemplateActivator.quote, which returns shlex.quote(string). That function follows POSIX sh rules, where a backslash inside single quotes stays a literal character. fish reads \' inside single quotes as an escaped quote and \\ as an escaped backslash. A value with a backslash before a quote therefore ends the literal somewhere other than where shlex.quote put the end, and fish expands the command substitution that follows. The environmen…
virtualenv activation scripts run code from a path that contains a placeholder name
影響: pip:virtualenv >= 20.26.6, <= 21.14.1 → 21.14.2 ViaTemplateActivator.instantiate_template replaces the placeholders in an activation template one key at a time, each across the whole text. When a value that it already substituted and quoted contains the name of a later placeholder, the later pass rewrites that name inside the quoted literal. The inserted value brings its own quotes, which close the outer literal, and the rest of the path runs as code when a user activates the environment. __VIRTUAL_NAME__ holds the environment's direc…
10月21日(水)
Pillow: Out-of-bounds access in _imagingmorph on a zero-width image
影響: pip:Pillow <= 12.3.0 → 13.0.0 A PPM or PGM file can declare a width of 0, which Pillow accepts, producing an image of size (0, N). Passing that image to ImageMorph.MorphOp.apply() makes the native morphology code index a row buffer at outrow[width - 1], which is outrow[-1] when the width is 0. The process crashes. Details The PPM parser reads width and height with no lower-bound check: - src/PIL/PpmImagePlugin.py:119 The native apply() writes the row edges with no guard that the width is positive: - src/_imagingmorp…
Pillow: GIF seek keeps rejected size after DecompressionBombError, allowing DoS
影響: pip:Pillow >= 9.2.0, < 13.0.0 → 13.0.0 ============================================================================ GIF seek keeps rejected size after DecompressionBombError, allowing DoS Location: src/PIL/GifImagePlugin.py:293 in GifImageFile._seek() Commit: a707c6b21c313880d0771e54965d142dd42358b6 ============================================================================ A GIF of about 60 bytes can make Pillow allocate gigabytes of memory. This affects applications that catch the "image too large" error raised while stepping to…
Pillow: EPS load(scale) lets Ghostscript render past the decompression bomb limit
影響: pip:Pillow >= 2.3.0, <= 12.3.0 → 13.0.0 ============================================================================ EPS load(scale) lets Ghostscript render past the decompression bomb limit Location: src/PIL/EpsImagePlugin.py:92 in Ghostscript() Commit: a707c6b21c313880d0771e54965d142dd42358b6 ============================================================================ When an application opens an untrusted Encapsulated PostScript file and asks Pillow to render it at a larger scale, Pillow has Ghostscript produce an image several ti…
Pillow: TiffDecode returns uninitialized memory as pixels for short JPEG strips
影響: pip:Pillow >= 5.3.0, < 13.0.0 → 13.0.0 ============================================================================ TiffDecode returns uninitialized memory as pixels for short JPEG strips Location: src/libImaging/TiffDecode.c:554 in _decodeStrip() Commit: a707c6b21c313880d0771e54965d142dd42358b6 ============================================================================ Pillow hands back leftover process memory as image pixels when it opens a small crafted TIFF file. Anyone who can get an application to open their image, and can se…
Pillow: TIFF encoder ColorMap plane-size mismatch causes a heap out-of-bounds read
影響: pip:Pillow <= 12.3.0 → 13.0.0 A small attacker-supplied TIFF can be opened and loaded normally, then reach an out-of-bounds read when an application saves it back to TIFF with retained metadata. The fixed reproducer is a 1×1, 16-bit grayscale, PackBits-compressed TIFF containing tag 320 (ColorMap) with 768 SHORT values: three zero-filled planes of 256 entries each. No Python object is forged and no metadata is injected after loading. Pillow's TIFF encoder allocates 768 × 2 = 1536 bytes, then passes three plane point…
Pillow: Unbounded recursion parsing a PDF page tree or trailer chain (incomplete fix for CVE-2026-42310)
影響: pip:pillow >= 5.1.0, < 13.0.0 → 13.0.0 When an application appends to an existing PDF with Image.save(..., format="PDF", append=True), Pillow parses that file with PdfParser. Two recursive parsers have no effective bound. linearize_page_tree follows /Kids with no visited set or depth limit, so a cyclic or duplicated page tree recurses without end. read_prev_trailer rejects only an exactly repeated /Prev offset, so a long chain of unique offsets still recurses. The trailer-loop guard added for CVE-2026-42310 does not cover ei…
Pillow tiled-TIFF decoder reads past tile buffer in copy4 (Unpack.c:1290)
影響: pip:pillow >= 8.2.0, < 13.0.0 → 13.0.0 Pillow's libImaging _decodeTile decoder, used to decode tiled TIFF images, allocates a per-tile buffer using realloc(state->buffer, TIFFTileSize(tiff)). After each TIFFReadTile it then iterates tile_y from 0 up to current_tile_length and calls the configured row unpacker (here copy4) with the source pointer state->buffer + tile_y row_byte_size. When libtiff returns a tile_bytes_size smaller than the worst-case row_byte_size tile_length, the inner stride-and-copy loop walks past the real…