Nixpkgs security tracker
5.3 MEDIUM
- CVSS version (CVSS): 3.1
- Attack Vector (AV): Network (N)
- Attack Complexity (AC): Low (L)
- Privileges Required (PR): None (N)
- User Interaction (UI): None (N)
- Scope (S): Unchanged (U)
- Confidentiality (C): None (N)
- Integrity (I): None (N)
- Availability (A): Low (L)
- Modified Attack Vector (MAV): Network (N)
- Modified Attack Complexity (MAC): Low (L)
- Modified Privileges Required (MPR): None (N)
- Modified User Interaction (MUI): None (N)
- Modified Confidentiality (MC): None (N)
- Modified Scope (MS): Unchanged (U)
- Modified Integrity (MI): None (N)
- Modified Availability (MA): Low (L)
Activity log
- Created suggestion
Pillow EpsImagePlugin negative %%BeginBinary byte count causes infinite loop denial of service
Pillow is a Python imaging library. From 12.0.0 through 12.2.0, Pillow's EPS parser in PIL/EpsImagePlugin.py accepts a negative byte count in the %%BeginBinary directive, allowing a crafted EPS file to cause Image.open() to seek backwards to the same directive and parse it repeatedly in an infinite loop. This issue is fixed in version 12.3.0.
References
-
https://github.com/python-pillow/Pillow/security/advisories/GHSA-pg7v-jwj7-p798 x_refsource_CONFIRM
-
https://github.com/python-pillow/Pillow/pull/9708 x_refsource_MISC
-
https://github.com/python-pillow/Pillow/releases/tag/12.3.0 x_refsource_MISC
Affected products
- ==>= 12.0.0, < 12.3.0
Matching in nixpkgs
pkgs.python313Packages.pillow
Friendly PIL fork (Python Imaging Library)
pkgs.python314Packages.pillow
Friendly PIL fork (Python Imaging Library)
pkgs.python313Packages.pillow-heif
Python library for working with HEIF images and plugin for Pillow
pkgs.python313Packages.pillow-jpls
JPEG-LS plugin for the Python Pillow library
pkgs.python313Packages.pillowfight
Eases the transition from PIL to Pillow for Python packages
pkgs.python314Packages.pillow-heif
Python library for working with HEIF images and plugin for Pillow
pkgs.python314Packages.pillow-jpls
JPEG-LS plugin for the Python Pillow library
pkgs.python314Packages.pillowfight
Eases the transition from PIL to Pillow for Python packages
pkgs.python313Packages.types-pillow
Typing stubs for Pillow
-
nixos-unstable 10.2.0.20240822
- nixpkgs-unstable 10.2.0.20240822
- nixos-unstable-small 10.2.0.20240822
-
nixos-26.05 10.2.0.20240822
- nixos-26.05-small 10.2.0.20240822
- nixpkgs-26.05-darwin 10.2.0.20240822
pkgs.python314Packages.types-pillow
Typing stubs for Pillow
-
nixos-unstable 10.2.0.20240822
- nixpkgs-unstable 10.2.0.20240822
- nixos-unstable-small 10.2.0.20240822
-
nixos-26.05 10.2.0.20240822
- nixos-26.05-small 10.2.0.20240822
- nixpkgs-26.05-darwin 10.2.0.20240822
pkgs.python313Packages.pypillowfight
Library containing various image processing algorithms
Package maintainers
-
@mweinelt Martin Weinelt <hexa@darmstadt.ccc.de>
-
@D4ndellion Daniel Olsen <daniel@dodsorf.as>
-
@kuflierl Kennet Flierl <kuflierl@gmail.com>
-
@bcdarwin Ben Darwin <bcdarwin@gmail.com>
-
@pyrox0 Pyrox <pyrox@pyrox.dev>
-
@arjan-s Arjan Schrijver <github@anymore.nl>