Filtered by vendor Python Subscriptions
Total 300 CVE
CVE Vendors Products Updated CVSS v3.1
CVE-2023-50447 3 Debian, Python, Redhat 8 Debian Linux, Pillow, Ansible Automation Platform and 5 more 2024-11-21 8.1 High
Pillow through 10.1.0 allows PIL.ImageMath.eval Arbitrary Code Execution via the environment parameter, a different vulnerability than CVE-2022-22817 (which was about the expression parameter).
CVE-2023-44271 3 Fedoraproject, Python, Redhat 4 Fedora, Pillow, Ansible Automation Platform and 1 more 2024-11-21 7.5 High
An issue was discovered in Pillow before 10.0.0. It is a Denial of Service that uncontrollably allocates memory to process a given task, potentially causing a service to crash by having it run out of memory. This occurs for truetype in ImageFont when textlength in an ImageDraw instance operates on a long text argument.
CVE-2023-41105 3 Netapp, Python, Redhat 3 Active Iq Unified Manager, Python, Enterprise Linux 2024-11-21 7.5 High
An issue was discovered in Python 3.11 through 3.11.4. If a path containing '\0' bytes is passed to os.path.normpath(), the path will be truncated unexpectedly at the first '\0' byte. There are plausible cases in which an application would have rejected a filename for security reasons in Python 3.10.x or earlier, but that filename is no longer rejected in Python 3.11.x.
CVE-2023-38898 1 Python 1 Python 2024-11-21 5.3 Medium
An issue in Python cpython v.3.7 allows an attacker to obtain sensitive information via the _asyncio._swap_current_task component. NOTE: this is disputed by the vendor because (1) neither 3.7 nor any other release is affected (it is a bug in some 3.12 pre-releases); (2) there are no common scenarios in which an adversary can call _asyncio._swap_current_task but does not already have the ability to call arbitrary functions; and (3) there are no common scenarios in which sensitive information, which is not already accessible to an adversary, becomes accessible through this bug.
CVE-2023-33595 1 Python 1 Python 2024-11-21 5.5 Medium
CPython v3.12.0 alpha 7 was discovered to contain a heap use-after-free via the function ascii_decode at /Objects/unicodeobject.c.
CVE-2022-48566 3 Debian, Netapp, Python 4 Debian Linux, Active Iq Unified Manager, Converged Systems Advisor Agent and 1 more 2024-11-21 5.9 Medium
An issue was discovered in compare_digest in Lib/hmac.py in Python through 3.9.1. Constant-time-defeating optimisations were possible in the accumulator variable in hmac.compare_digest.
CVE-2022-48565 3 Debian, Python, Redhat 3 Debian Linux, Python, Enterprise Linux 2024-11-21 9.8 Critical
An XML External Entity (XXE) issue was discovered in Python through 3.9.1. The plistlib module no longer accepts entity declarations in XML plist files to avoid XML vulnerabilities.
CVE-2022-48564 3 Netapp, Python, Redhat 4 Active Iq Unified Manager, Python, Enterprise Linux and 1 more 2024-11-21 6.5 Medium
read_ints in plistlib.py in Python through 3.9.1 is vulnerable to a potential DoS attack via CPU and RAM exhaustion when processing malformed Apple Property List files in binary format.
CVE-2022-48560 3 Debian, Python, Redhat 4 Debian Linux, Python, Enterprise Linux and 1 more 2024-11-21 7.5 High
A use-after-free exists in Python through 3.9 via heappushpop in heapq.
CVE-2022-45199 1 Python 1 Pillow 2024-11-21 7.5 High
Pillow before 9.3.0 allows denial of service via SAMPLESPERPIXEL.
CVE-2022-45198 1 Python 1 Pillow 2024-11-21 7.5 High
Pillow before 9.2.0 performs Improper Handling of Highly Compressed GIF Data (Data Amplification).
CVE-2022-30595 1 Python 1 Pillow 2024-11-21 9.8 Critical
libImaging/TgaRleDecode.c in Pillow 9.1.0 has a heap buffer overflow in the processing of invalid TGA image files.
CVE-2022-28470 1 Python 1 Pypi 2024-11-21 9.8 Critical
marcador package in PyPI 0.1 through 0.13 included a code-execution backdoor.
CVE-2022-26488 3 Microsoft, Netapp, Python 4 Windows, Active Iq Unified Manager, Ontap Select Deploy Administration Utility and 1 more 2024-11-21 7.0 High
In Python before 3.10.3 on Windows, local users can gain privileges because the search path is inadequately secured. The installer may allow a local attacker to add user-writable directories to the system search path. To exploit, an administrator must have installed Python for all users and enabled PATH entries. A non-administrative user can trigger a repair that incorrectly adds user-writable paths into PATH, enabling search-path hijacking of other users and system services. This affects Python (CPython) through 3.7.12, 3.8.x through 3.8.12, 3.9.x through 3.9.10, and 3.10.x through 3.10.2.
CVE-2022-24303 2 Fedoraproject, Python 2 Fedora, Pillow 2024-11-21 9.1 Critical
Pillow before 9.0.1 allows attackers to delete files because spaces in temporary pathnames are mishandled.
CVE-2022-22817 3 Debian, Python, Redhat 5 Debian Linux, Pillow, Enterprise Linux and 2 more 2024-11-21 9.8 Critical
PIL.ImageMath.eval in Pillow before 9.0.0 allows evaluation of arbitrary expressions, such as ones that use the Python exec method. A lambda expression could also be used.
CVE-2022-22816 3 Debian, Python, Redhat 5 Debian Linux, Pillow, Enterprise Linux and 2 more 2024-11-21 6.5 Medium
path_getbbox in path.c in Pillow before 9.0.0 has a buffer over-read during initialization of ImagePath.Path.
CVE-2022-22815 3 Debian, Python, Redhat 3 Debian Linux, Pillow, Enterprise Linux 2024-11-21 6.5 Medium
path_getbbox in path.c in Pillow before 9.0.0 improperly initializes ImagePath.Path.
CVE-2021-42576 2 Microco, Python 2 Bluemonday, Pybluemonday 2024-11-21 9.8 Critical
The bluemonday sanitizer before 1.0.16 for Go, and before 0.0.8 for Python (in pybluemonday), does not properly enforce policies associated with the SELECT, STYLE, and OPTION elements.
CVE-2021-34552 4 Debian, Fedoraproject, Python and 1 more 5 Debian Linux, Fedora, Pillow and 2 more 2024-11-21 9.8 Critical
Pillow through 8.2.0 and PIL (aka Python Imaging Library) through 1.1.7 allow an attacker to pass controlled parameters directly into a convert function to trigger a buffer overflow in Convert.c.