libwebp: OOB write in BuildHuffmanTable
Affected range
ECOSYSTEM: introduced 0; fixed 10.0.1Fixed versions: 10.0.1
Evidence path
Version, exploitation, severity
RequestGuard keeps these facts separate. A KEV match refers to a CVE, while OSV supplies the package and version match.
1
Latest version
12.3.0
No matching published advisory returned
2
Known exploitation
No KEV match
Checked by exact CVE identifier
3
Highest advisory severity
Critical
79 active advisories
Check an exact version
The registry confirms the version, then OSV checks advisories for that exact value.
Published records
Advisories
GHSA-3f63-hfp8-52jq critical
Arbitrary Code Execution in Pillow
Affected range
ECOSYSTEM: introduced 0; fixed 10.2.0Fixed versions: 10.2.0
GHSA-hr8g-f6r6-mr22 critical
Buffer over-flow in Pillow
Affected range
ECOSYSTEM: introduced 9.1.0; fixed 9.1.1Fixed versions: 9.1.1
GHSA-9j59-75qj-795w critical
Path traversal in Pillow
Affected range
ECOSYSTEM: introduced 0; fixed 9.0.1Fixed versions: 9.0.1
GHSA-8vj2-vxx3-667w critical
Arbitrary expression injection in Pillow
Affected range
ECOSYSTEM: introduced 0; fixed 9.0.1ECOSYSTEM: introduced 0; fixed 9.0.0Fixed versions: 9.0.1, 9.0.0
GHSA-rwv7-3v45-hg29 critical
Pillow Out-of-bounds Read vulnerability
Affected range
ECOSYSTEM: introduced 2.4.0; fixed 8.2.0ECOSYSTEM: introduced 0; fixed 8.2.0Fixed versions: 8.2.0
GHSA-77gc-v2xv-rvvh critical
Out-of-bounds Read in Pillow
Affected range
ECOSYSTEM: introduced 2.4.0; fixed 8.2.0ECOSYSTEM: introduced 0; fixed 8.2.0Fixed versions: 8.2.0
GHSA-8m9x-pxwq-j236 critical
Pillow command injection
Affected range
ECOSYSTEM: introduced 0; fixed 2.5.0Fixed versions: 2.5.0
GHSA-7534-mm45-c74v critical
Buffer Overflow in Pillow
Affected range
ECOSYSTEM: introduced 0; fixed 8.3.0Fixed versions: 8.3.0
GHSA-43fq-w8qq-v88h critical
Out-of-bounds read in Pillow
Affected range
ECOSYSTEM: introduced 0; fixed 7.1.0Fixed versions: 7.1.0
GHSA-p49h-hjvm-jg3h critical
PCX P mode buffer overflow in Pillow
Affected range
ECOSYSTEM: introduced 0; fixed 6.2.2GIT: introduced 0; fixed 93b22b846e0269ee9594ff71a72bec02d2bea8fdFixed versions: 6.2.2, 93b22b846e0269ee9594ff71a72bec02d2bea8fd
GHSA-r7rm-8j6h-r933 critical
Buffer Copy without Checking Size of Input in Pillow
Affected range
ECOSYSTEM: introduced 0; fixed 6.2.2GIT: introduced 0; fixed a79b65c47c7dc6fe623aadf09aa6192fc54548f3Fixed versions: 6.2.2, a79b65c47c7dc6fe623aadf09aa6192fc54548f3
GHSA-vcqg-3p29-xw73 critical
Integer overflow in Pillow
Affected range
ECOSYSTEM: introduced 0; fixed 6.2.2GIT: introduced 0; fixed 4e2def2539ec13e53a82e06c4b3daf00454100c4Fixed versions: 6.2.2, 4e2def2539ec13e53a82e06c4b3daf00454100c4
GHSA-57h3-9rgr-c24m critical
Out of bounds write in Pillow
Affected range
ECOSYSTEM: introduced 0; fixed 8.1.1Fixed versions: 8.1.1
GHSA-hvr8-466p-75rh critical
Pillow Integer overflow in ImagingResampleHorizontal
Affected range
ECOSYSTEM: introduced 0; fixed 3.1.1GIT: introduced 0; fixed 4e0d9b0b9740d258ade40cce248c93777362ac1eFixed versions: 3.1.1, 4e0d9b0b9740d258ade40cce248c93777362ac1e
GHSA-phj9-mv4w-65pm high
Pillow `GdImageFile._open()`: image dimensions accepted without `_decompression_bomb_check()`
Affected range
ECOSYSTEM: introduced 0; fixed 12.3.0Fixed versions: 12.3.0
GHSA-9hw9-ch79-4vh6 high
Pillow: Controlled heap out-of-bounds write in Pillow `ImageCmsTransform.apply()` via output mode mismatch
Affected range
ECOSYSTEM: introduced 0; fixed 12.3.0Fixed versions: 12.3.0
GHSA-8v84-f9pq-wr9x high
Pillow `PcfFontFile._load_bitmaps()`: `Image.frombytes()` called without `_decompression_bomb_check()` — bomb protection bypass via PCF font loading
Affected range
ECOSYSTEM: introduced 0; fixed 12.3.0Fixed versions: 12.3.0
GHSA-6r8x-57c9-28j4 high
Pillow: Heap out-of-bounds write `Image.paste()` / `Image.crop()` via signed coordinate overflow
Affected range
ECOSYSTEM: introduced 0; fixed 12.3.0Fixed versions: 12.3.0
GHSA-62p4-gmf7-7g93 high
Pillow: Out-of-bounds read via attacker-controlled row stride on Pillow's mmap path (McIdas AREA files)
Affected range
ECOSYSTEM: introduced 0; fixed 12.3.0Fixed versions: 12.3.0
GHSA-5x94-69rx-g8h2 high
Pillow: `FontFile.compile()`: `Image.new()` called without `_decompression_bomb_check()`
Affected range
ECOSYSTEM: introduced 0; fixed 12.3.0Fixed versions: 12.3.0
GHSA-whj4-6x5x-4v2j high
FITS GZIP decompression bomb in Pillow
Affected range
ECOSYSTEM: introduced 10.3.0; fixed 12.2.0Fixed versions: 12.2.0
GHSA-cfh3-3jmp-rvhc high
Pillow affected by out-of-bounds write when loading PSD images
Affected range
ECOSYSTEM: introduced 10.3.0; fixed 12.1.1Fixed versions: 12.1.1
GHSA-xj96-63gp-2gmr high
Pillow: Heap out-of-bounds write in `ImageFilter.RankFilter` via integer overflow in `ImagingExpand`
Affected range
ECOSYSTEM: introduced 0; fixed 12.3.0Fixed versions: 12.3.0
GHSA-vjc4-5qp5-m44j high
Pillow JPEG2000 tiled decode retains a growing scratch buffer and can be used for denial of service
Affected range
ECOSYSTEM: introduced 8.2.0; fixed 12.3.0Fixed versions: 12.3.0
Show 54 more advisories
GHSA-pg7v-jwj7-p798 Pillow EpsImagePlugin negative %%BeginBinary byte count causes infinite loop denial of service
GHSA-45hq-cxwh-f6vc Pillow `BdfFontFile`: `Image.new()` called without `_decompression_bomb_check()` — bomb protection bypass via font loading
GHSA-pwv6-vv43-88gr Pillow has an OOB Write with Invalid PSD Tile Extents (Integer Overflow)
GHSA-xg8h-j46f-w952 Pillow vulnerability can cause write buffer overflow on BCn encoding
GHSA-jjj6-mw9f-p565 Pillow: Decompression Bomb DoS via PdfParser.PdfStream.decode()
GHSA-44wm-f244-xhp3 Pillow buffer overflow vulnerability
GHSA-3c5c-7235-994j Pillow buffer overflow in ImagingPcdDecode
GHSA-f4w8-cv6p-x6r5 Pillow Denial of Service by Uncontrolled Resource Consumption
GHSA-95q3-8gr9-gm8w Pillow Denial of Service by Uncontrolled Resource Consumption
GHSA-3wvg-mj6g-m9cv Pillow Uncontrolled Resource Consumption
GHSA-8843-m7mw-mxqm Buffer overflow in Pillow
GHSA-3xv8-3j54-hgrp Out-of-bounds read in Pillow
GHSA-jgpv-4h4c-xhw3 Uncontrolled Resource Consumption in pillow
GHSA-j6f7-g425-4gmx Pillow is vulnerable to Denial of Service (DOS) in the Jpeg2KImagePlugin
GHSA-q5hq-fp76-qmrc Uncontrolled Resource Consumption in Pillow
GHSA-8ghj-p4vj-mr35 Pillow Denial of Service vulnerability
GHSA-q4mp-jvh2-76fj Pillow subject to DoS via SAMPLESPERPIXEL tag
GHSA-vqcj-wrf2-7v73 Pillow Out-of-bounds Write
GHSA-m2vv-5vj5-2hm7 Pillow vulnerable to Data Amplification attack.
GHSA-7r7m-5h27-29hp Potential infinite loop in Pillow
GHSA-cqhg-xjhh-p8hf Out-of-bounds reads in Pillow
GHSA-mvg9-xffr-p774 Out of bounds read in Pillow
GHSA-v9pc-9mvp-x87g Pillow Buffer overflow in Jpeg2KEncode.c
GHSA-j7mj-748x-7p78 DOS attack in Pillow when processing specially crafted image files
GHSA-98vv-pw6r-q6q4 Uncontrolled Resource Consumption in pillow
GHSA-h5rf-vgqx-wjv2 Pillow denial of service via PNG bomb
GHSA-8xjv-v9xq-m5h9 Pillow Buffer overflow in ImagingFliDecode
GHSA-p43w-g3c5-g5mq Out of bounds read in Pillow
GHSA-x895-2wrm-hvp7 PIL and Pillow Vulnerable to Symlink Attack on Tmpfiles
GHSA-g6rj-rv7j-xwp4 Pillow denial of service
GHSA-vj42-xq3r-hr3r Out-of-bounds reads in Pillow
GHSA-8xjq-8fcg-g5hw Out-of-bounds Write in Pillow
GHSA-cfmr-38g9-f2h7 Pillow denial of service via Crafted Block Size
GHSA-5gm3-px64-rw72 Uncontrolled Resource Consumption in Pillow
GHSA-f5g8-5qq7-938w Pillow Out-of-bounds Read
GHSA-hj69-c76v-86wr Out-of-bounds Read in Pillow
GHSA-w4vg-rf63-f3j3 Arbitrary code using "crafted image file" approach affecting Pillow
GHSA-4x4j-2g7c-83w6 Pillow: WindowsViewer.get_command() OS command injection via unescaped shell path
GHSA-5xmw-vc9v-4wf2 Pillow has a heap buffer overflow with nested list coordinates
GHSA-r73j-pqj5-w3x7 Pillow has a PDF Parsing Trailer Infinite Loop (DoS)
GHSA-fj7v-r99m-22gq Pillow TGA RLE encoder can serialize up to ~57 KB of adjacent heap data into generated images
GHSA-wjx4-4jcj-g98j Pillow has an integer overflow when processing fonts
GHSA-r854-96gq-rfg3 Pillow Temporary file name leakage
GHSA-hjfx-8p6c-g7gx Insufficient Verification of Data Authenticity in Pillow
GHSA-xrcv-f9gm-v42c Out-of-bounds Read in Pillow
GHSA-pw3c-h7wp-cvhx Improper Initialization in Pillow
GHSA-9hx2-hgq2-2g4f Regular Expression Denial of Service (ReDoS) in Pillow
GHSA-hggx-3h72-49ww Pillow Buffer overflow in ImagingLibTiffDecode
GHSA-hf64-x4gq-p99h Pillow Out-of-bounds Read
GHSA-rwr3-c2q8-gm56 Pillow Integer overflow in Map.c
GHSA-4fx9-vc88-q2xc Infinite loop in Pillow
PYSEC-2023-175 Pillow versions before v10.0.1 bundled libwebp binaries in wheels that are vulnerable to CVE-2023-5129 (previously CVE-2023-4863). Pillow v10.0.1 upgrades the bundled libwebp binary to v1.3.2.
OSV-2022-1074 Invalid-free in _dealloc
OSV-2022-715 Segv on unknown address in jpeg_read_scanlines