Nixpkgs security tracker
5.1 MEDIUM
- CVSS version (CVSS): 4.0
- Attack Vector (AV): Local (L)
- Attack Complexity (AC): Low (L)
- Attack Requirement (AT): None (N)
- Privileges Required (PR): None (N)
- User Interaction (UI): None (N)
- Vulnerable System Impact Confidentiality (VC): None (N)
- Vulnerable System Impact Integrity (VI): None (N)
- Vulnerable System Impact Availability (VA): Low (L)
- Subsequent System Impact Confidentiality (SC): None (N)
- Subsequent System Impact Integrity (SI): None (N)
- Subsequent System Impact Availability (SA): None (N)
- Modified Attack Vector (MAV): Local (L)
- Modified Attack Complexity (MAC): Low (L)
- Modified Attack Requirement (MAT): None (N)
- Modified Privileges Required (MPR): None (N)
- Modified User Interaction (MUI): None (N)
- Modified Vulnerable System Impact Confidentiality (MVC): None (N)
- Modified Vulnerable System Impact Integrity (MVI): None (N)
- Modified Vulnerable System Impact Availability (MVA): Low (L)
- Modified Subsequent System Impact Confidentiality (MSC): Negligible (N)
- Modified Subsequent System Impact Integrity (MSI): Negligible (N)
- Modified Subsequent System Impact Availability (MSA): Negligible (N)
- Safety (S): Not Defined (X)
- Automatable (AU): Not Defined (X)
- Recovery (R): Not Defined (X)
- Value Density (V): Not Defined (X)
- Vulnerability Response Effort (RE): Not Defined (X)
- Provider Urgency (U): Not Defined (X)
- Confidentiality Req. (CR): Not Defined (X)
- Integrity Req. (IR): Not Defined (X)
- Availability Req. (AR): Not Defined (X)
- Exploit Maturity (E): Not Defined (X)
by @LeSuisse Activity log
- Created suggestion
-
@LeSuisse
ignored
17 packages
- python312Packages.pillow-heif
- python312Packages.pillow-jpls
- python312Packages.pillowfight
- python313Packages.pillow-heif
- python313Packages.pillow-jpls
- python313Packages.pillowfight
- python314Packages.pillow-heif
- python314Packages.pillow-jpls
- python314Packages.pillowfight
- python312Packages.types-pillow
- python313Packages.types-pillow
- python314Packages.types-pillow
- python312Packages.pypillowfight
- python313Packages.pypillowfight
- python314Packages.pypillowfight
- python312Packages.pillow-avif-plugin
- python313Packages.pillow-avif-plugin
- @LeSuisse ignored reference https://g…
- @LeSuisse accepted
- @LeSuisse ignored maintainer @mweinelt maintainer.ignore
- @LeSuisse published on GitHub
Pillow: Heap buffer overflow with nested list coordinates
Pillow is a Python imaging library. From version 11.2.1 to before version 12.2.0, passing nested lists as coordinates to APIs that accept coordinates such as ImagePath.Path, ImageDraw.ImageDraw.polygon and ImageDraw.ImageDraw.line could cause a heap buffer overflow, as nested lists were recursively unpacked beyond the allocated buffer. Coordinate lists are now validated to contain exactly two numeric coordinates. This issue has been patched in version 12.2.0.
References
-
https://github.com/python-pillow/Pillow/security/advisories/GHSA-5xmw-vc9v-4wf2 x_refsource_CONFIRM
Ignored references (1)
-
https://github.com/python-pillow/Pillow/releases/tag/12.2.0 x_refsource_MISC
Affected products
- ==>= 11.2.1, < 12.2.0
Matching in nixpkgs
pkgs.python312Packages.pillow
Friendly PIL fork (Python Imaging Library)
pkgs.python313Packages.pillow
Friendly PIL fork (Python Imaging Library)
pkgs.python314Packages.pillow
Friendly PIL fork (Python Imaging Library)
Ignored packages (17)
pkgs.python312Packages.pillow-heif
Python library for working with HEIF images and plugin for Pillow
pkgs.python312Packages.pillow-jpls
JPEG-LS plugin for the Python Pillow library
pkgs.python312Packages.pillowfight
Eases the transition from PIL to Pillow for Python packages
pkgs.python313Packages.pillow-heif
Python library for working with HEIF images and plugin for Pillow
pkgs.python313Packages.pillow-jpls
JPEG-LS plugin for the Python Pillow library
pkgs.python313Packages.pillowfight
Eases the transition from PIL to Pillow for Python packages
pkgs.python314Packages.pillow-heif
Python library for working with HEIF images and plugin for Pillow
pkgs.python314Packages.pillow-jpls
JPEG-LS plugin for the Python Pillow library
pkgs.python314Packages.pillowfight
Eases the transition from PIL to Pillow for Python packages
pkgs.python312Packages.types-pillow
Typing stubs for Pillow
-
nixos-25.11 10.2.0.20240822
- nixos-25.11-small 10.2.0.20240822
- nixpkgs-25.11-darwin 10.2.0.20240822
pkgs.python313Packages.types-pillow
Typing stubs for Pillow
-
nixos-unstable 10.2.0.20240822
- nixpkgs-unstable 10.2.0.20240822
- nixos-unstable-small 10.2.0.20240822
-
nixos-25.11 10.2.0.20240822
- nixos-25.11-small 10.2.0.20240822
- nixpkgs-25.11-darwin 10.2.0.20240822
pkgs.python314Packages.types-pillow
Typing stubs for Pillow
-
nixos-unstable 10.2.0.20240822
- nixpkgs-unstable 10.2.0.20240822
- nixos-unstable-small 10.2.0.20240822
pkgs.python312Packages.pypillowfight
Library containing various image processing algorithms
pkgs.python313Packages.pypillowfight
Library containing various image processing algorithms
pkgs.python314Packages.pypillowfight
Library containing various image processing algorithms
pkgs.python312Packages.pillow-avif-plugin
Pillow plugin that adds support for AVIF files
pkgs.python313Packages.pillow-avif-plugin
Pillow plugin that adds support for AVIF files
Package maintainers
Ignored maintainers (1)
-
@mweinelt Martin Weinelt <hexa@darmstadt.ccc.de>