logo

Database

Out-of-bounds read In pillow

Description

Out-of-bounds Read in Pillow path_getbbox in path.c in Pillow before 9.0.0 has a buffer over-read during initialization of ImagePath.Path.

Mitigation

Update Impact

Minimal update. May introduce new vulnerabilities or breaking changes.

Ecosystem
Package
Affected version
Patched versions

Aliases

1. CVE-2022-228162. NVD-2022-228163. OSV-2022-228164. OSV-ALPINE-2022-228165. OSV-DEBIAN-2022-228166. GHSA-xrcv-f9gm-v42c7. GCVE-2022-228168. lists.debian.org9. security.gentoo.org10. SECURITY-CVE-2022-2281611. SECURITY-TRACKER-CVE-2022-22816

References

1. https://github.com/python-pillow/Pillow/pull/59202. https://github.com/python-pillow/Pillow/commit/5543e4e2d409cd9e409bc64cdc77be0af007a31f3. https://github.com/pypa/advisory-database/tree/main/vulns/pillow/PYSEC-2022-9.yaml4. https://github.com/python-pillow/Pillow/blob/c5d9223a8b5e9295d15b5a9b1ef1dae44c8499f3/src/path.c#L3315. https://pillow.readthedocs.io/en/stable/releasenotes/9.0.0.html#fixed-imagepath-path-array-handling6. https://www.debian.org/security/2022/dsa-5053

Does your application use this vulnerable software?

During the free trial, our tools assess your application, identify vulnerabilities, and provide recommendations for their remediation.