CVE Vulnerability Catalog

Pillow from 5.4.0 until 13.0.0 performs quadratic copying while parsing GIF comments. GifImageFile._seek() repeatedly appends immutable bytes for comment sub-blocks and multiple comment extensions, and frame zero is parsed during Image.open().

Pillow from 9.2.0 until 13.0.0 can retain a rejected GIF frame size after a decompression-bomb exception. In GifImageFile._seek, a crafted GIF can leave rejected dimensions stored after Image.DecompressionBombError; if an application catches that exception and continues processing the same image object, later seek or load operations allocate according to those dimensions and can exhaust memory, denying service.

Pillow from 8.1.0 until 13.0.0 can allocate an APNG disposal background at the full canvas size before applying the decompression-bomb check. A crafted APNG with a small first frame, a very large declared canvas, and background disposal or first-frame OP_PREVIOUS reaches PngImageFile._seek while Image.open() positions frame zero. The full-canvas allocation occurs inside Image.open() without requiring pixel loading or frame iteration, which can exhaust memory and deny service.

Pillow before version 13.0.0's ImageMorph.MorphOp.apply() can access memory before a row buffer for a zero-width image. PPM and PGM input can create an image with width zero, and the native morphology routine indexes outrow[width - 1] without rejecting that geometry. An attacker can supply such an image to an application that applies a morphology operation, causing a process crash.

Pillow before version 13.0.0's rank-based filters can dereference invalid image storage for a zero-size image. ImagingExpand() allocates a non-empty output and then faults while replicating edges by reading the first pixel from empty input storage; ImagingRankFilter is never reached. An attacker can supply or cause creation of a zero-size image to an application that applies a rank, median, minimum, or maximum filter, causing a native process crash.

A security vulnerability has been detected in Netis EAP930 version 1.250905.115454. The issue affects the function return200 of the file /cgi-bin/debug of the CGI Endpoint component. Manipulation of the SIGNATURE argument leads to a backdoor. The attack may be initiated remotely but requires a high degree of complexity; exploitability is assessed as difficult. The vendor was contacted early about this disclosure but did not respond.

A flaw was found in GIMP. Opening a crafted XCF that selects a path and then fails to load that path can cause a use-after-free in the main process, leading to a crash and potentially arbitrary code execution.

A flaw was found in GIMP. The XCF loader can leave a dangling pointer in the linked-channels list when a linked channel is later destroyed via a selection property. Opening a crafted XCF file can cause a use-after-free in the main GIMP process, leading to a crash and potentially arbitrary code execution.

A flaw was found in GIMP. The PSD thumbnail resource loader performs a BGR-to-RGB channel swap with a fixed 3-byte stride and does not verify that the JPEG thumbnail is RGB. A crafted grayscale PSD thumbnail can cause a heap out-of-bounds read and write in the plug-in process, leading to a crash and potentially arbitrary code execution when the victim browses or opens the file.

TP-Link Tapo C210 V3.60 may expose shared credential material and cryptographic metadata through unauthenticated DS JSON API requests. The exposed shared credential can be accepted by the Streamd Digest authentication mechanism as an administrative password, allowing an unauthenticated adjacent-network attacker to establish encrypted media sessions without knowledge of the device account password.

Stack buffer overflow vulnerability in the OSDP Control Panel reply parser cp_decode_response() in Zephyr OS. For REPLY_KEYPPAD and REPLY_RAW reply types, the payload length is taken from the received frame without an upper bound check, allowing writes past the fixed 64-byte arrays in struct osdp_event. Requires CONFIG_OSDP in CP mode and a registered event callback.

Pillow (Python imaging library) before 13.0.0 has raw decoders P;2L and P;4L that can read past the end of an input buffer. A mismatch between the calculated packed-pixel row size and the unpacker's actual footprint can disclose up to three adjacent heap bytes in output pixels or crash the process.

Pillow from 5.1.0 until 13.0.0 allows PdfParser.get_value() to recurse without limit when reading nested PDF objects. An attacker can supply a deeply nested PDF to an application saving an image with PDF append enabled, causing an uncaught RecursionError or worker termination.

Pillow versions from 7.2.0 until 13.0.0 can enter an infinite loop while determining the frame count of a MIC image. MicImageFile inherits TIFF frame traversal, but MicImageFile.tell reports the OLE stream index and its seek() resets TIFF frame state, so an embedded TIFF with at least three IFDs never advances. When an application with olefile installed reads n_frames or saves all frames from a crafted MIC file, the non-advancing traversal can hold a worker at full CPU indefinitely.

A security flaw was discovered in orbitale imagemagick-php up to version 3.3.5. The Command::font function in src/Command.php is affected; manipulation of the fontFile argument results in OS command injection. The attack can be executed remotely, the exploit has been released publicly and may be used in attacks, and the vendor did not respond to the disclosure.

Dell Application Store versions prior to 26.05.0.7 contain a Missing Authentication for Critical Function vulnerability. An unauthenticated attacker with adjacent network access could potentially exploit this vulnerability, leading to arbitrary code execution.

Dell Application Store versions prior to 26.05.0.7 contain an Uncontrolled Path Element vulnerability. A low-privileged attacker with local access could potentially exploit this vulnerability, leading to Elevation of Privilege and arbitrary code execution.

Dell Application Store versions prior to 26.05.0.7 contain an Incorrect Permission Assignment for Critical Resource vulnerability. A low-privileged attacker with local access could potentially exploit this vulnerability, leading to disclosure of sensitive information.

Grav 1.7.53 before 1.7.53.5 and 2.0.0-rc.8 before 2.2.2 contain a resource exhaustion vulnerability that allows anonymous visitors to bypass the system.images.max_pixels limit when system.images.url_actions is enabled. Attackers can send single-dimension or percentage forceResize, zoomCrop, or chained image actions to make GD allocate multi-gigabyte canvases, exhausting server memory and taking the site down.

Grav from 2.0.15 before 2.2.2 contains an allowlist bypass vulnerability that allows page editors to call arbitrary public static methods by renaming Flex form fields with replace-name@. Attackers with page-edit permission can smuggle data-*@ directives past the callable check to invoke Folder::delete, Folder::move, or Utils::download, deleting directories, overwriting files, or reading files.