It was discovered that Pillow incorrectly handled certain long text arguments. An attacker could possibly use this issue to cause Pillow to consume resources, leading to a denial of service. This issue only affected Ubuntu 20.04 LTS, and Ubuntu 22.04 LTS. (CVE-2023-44271)
Duarte Santos discovered that Pillow incorrectly handled the environment parameter to PIL.ImageMath.eval. An attacker could possibly use this issue to execute arbitrary code. (CVE-2023-50447)
{ "binaries": [ { "binary_name": "python-pil-doc", "binary_version": "7.0.0-4ubuntu0.8" }, { "binary_name": "python3-pil", "binary_version": "7.0.0-4ubuntu0.8" }, { "binary_name": "python3-pil-dbg", "binary_version": "7.0.0-4ubuntu0.8" }, { "binary_name": "python3-pil.imagetk", "binary_version": "7.0.0-4ubuntu0.8" }, { "binary_name": "python3-pil.imagetk-dbg", "binary_version": "7.0.0-4ubuntu0.8" } ], "availability": "No subscription required" }
{ "binaries": [ { "binary_name": "python-pil-doc", "binary_version": "9.0.1-1ubuntu0.2" }, { "binary_name": "python3-pil", "binary_version": "9.0.1-1ubuntu0.2" }, { "binary_name": "python3-pil-dbgsym", "binary_version": "9.0.1-1ubuntu0.2" }, { "binary_name": "python3-pil.imagetk", "binary_version": "9.0.1-1ubuntu0.2" }, { "binary_name": "python3-pil.imagetk-dbgsym", "binary_version": "9.0.1-1ubuntu0.2" } ], "availability": "No subscription required" }