CVE Vulnerability Catalog

In Pillow from 5.3.0 until 13.0.0, the library can return uninitialized memory as pixels when libtiff performs a short decode of JPEG-compressed or Group 4 fax TIFF data. The _decodeStrip and _decodeTile buffers can be larger than the bytes written by libtiff, and Pillow does not clear the unwritten tail. An attacker can supply a crafted TIFF to an application that loads and returns or re-encodes its pixels.

In Pillow prior to 13.0.0, the TIFF encoder can read beyond a ColorMap buffer when retained TIFF metadata has a plane size inconsistent with BitsPerSample. A small TIFF can be opened normally and then retain a crafted ColorMap that is reused when the image is saved. An application that re-encodes the attacker's TIFF with libtiff can trigger the out-of-bounds read.

In Pillow from 5.1.0 until 13.0.0, the library can exhaust resources while parsing an existing PDF during an append operation. PdfParser follows page-tree child references without cycle or duplication tracking and follows previous-trailer chains with only an exact repeated-offset guard, so deep or cyclic page trees and long chains of unique trailer offsets can exhaust the Python stack. An attacker can supply such a PDF to an application that calls Image.save with PDF append enabled.

In Pillow from 5.1.0 until 13.0.0, reserving PDF object identifiers when saving many frames with save_all enabled takes quadratic time. PdfParser.next_object_id() repeatedly rebuilds and scans all previously reserved identifiers for every object. An attacker can supply a multi-frame image, including a small APNG with a large declared frame count, to an application that converts it to a multipage PDF.

In Pillow from 10.0.0 until 13.0.0, the library can free an invalid glyph pointer during FreeType rendering with an active stroker. If FT_Load_Glyph fails, cleanup may call FT_Done_Glyph on an uninitialized or stale glyph variable. An attacker can supply a malformed font as untrusted bytes to an application that draws text with a nonzero stroke width.

In Pillow from 4.1.0 until 13.0.0, the MSP RLE decoder can expand a small file into an unbounded in-memory buffer. The decoder writes run-length output to BytesIO without limiting expansion to the declared image size. An attacker can supply a crafted MSP image to an application that loads its pixels.

Pillow from 9.2.0 until 13.0.0 performs quadratic copying when saving a GIF with a long comment. _get_global_header() repeatedly copies portions of comment data, including comments from an untrusted input image, which can consume excessive CPU.

In Pillow from 5.1.0 until 13.0.0, the library can enter an infinite loop while rewriting PDF pages. PdfParser.rewrite_pages() follows Parent relationships without detecting a cycle in the page tree. An attacker can supply a cyclic PDF to an application that appends an image to that PDF.

In Pillow from 12.0.0 until 13.0.0, Image.merge() can dereference a null image8 plane. Validation skips the first input band, allowing a 32-bit integer or floating-point image backed by image32 storage to be merged as a narrower multiband image. A crafted IPTC file can reach this path when an application opens and loads it, or a caller can invoke Image.merge() directly with such a first band.

In Pillow from 8.1.0 until 13.0.0, the TIFF tile and RGBA decode paths can read beyond row data produced by libtiff. In _decodeTile and the RGBA unpacker path, when Pillow and libtiff interpret duplicated PhotometricInterpretation or BitsPerSample tags differently, Pillow does not verify that the required input row fits inside the row libtiff produced (the strip path has this validation). Loading pixels from such a crafted TIFF can expose adjacent heap data in output pixels or crash the process.

Pillow prior to 13.0.0 has a JPEG decoder vulnerability where a full-width scanline can be written into a buffer sized for a requested draft scale. ImagingJpegDecode does not verify libjpeg's actual output width after scaling, and an 8-bit lossless SOF3 JPEG decoded by libjpeg-turbo 3.x can ignore the requested downscaling geometry.

Pillow before version 13.0.0 can double free image memory when ImagingScaleAffine encounters a selective allocation failure. This affects the fast path for Transform.EXTENT or pure scale-and-translate Transform.AFFINE operations with default NEAREST resampling. An attacker can trigger the failure by driving a large Image.transform() operation under memory pressure.

Pillow from 5.4.0 until 13.0.0 performs quadratic copying while parsing GIF comments. GifImageFile._seek() repeatedly appends immutable bytes for comment sub-blocks and multiple comment extensions, and frame zero is parsed during Image.open().

Pillow from 9.2.0 until 13.0.0 can retain a rejected GIF frame size after a decompression-bomb exception. In GifImageFile._seek, a crafted GIF can leave rejected dimensions stored after Image.DecompressionBombError; if an application catches that exception and continues processing the same image object, later seek or load operations allocate according to those dimensions and can exhaust memory, denying service.

Pillow from 8.1.0 until 13.0.0 can allocate an APNG disposal background at the full canvas size before applying the decompression-bomb check. A crafted APNG with a small first frame, a very large declared canvas, and background disposal or first-frame OP_PREVIOUS reaches PngImageFile._seek while Image.open() positions frame zero. The full-canvas allocation occurs inside Image.open() without requiring pixel loading or frame iteration, which can exhaust memory and deny service.

Pillow prior to 13.0.0 has a FlashPix JPEG-tile decoder vulnerability that can write decoded scanlines beyond the allocated tile buffer. FlashPix (FPX) JPEG decoding selects raw mode LA with two bytes per pixel, while an unrecognized JPEG mode can be decoded as JCS_UNKNOWN with four components, causing ImagingJpegDecode to write four-component scanlines into the two-byte tile buffer.

Pillow before version 13.0.0's ImageMorph.MorphOp.apply() can access memory before a row buffer for a zero-width image. PPM and PGM input can create an image with width zero, and the native morphology routine indexes outrow[width - 1] without rejecting that geometry. An attacker can supply such an image to an application that applies a morphology operation, causing a process crash.

Pillow from 11.3.0 until 13.0.0 has a heap use-after-free when libtiff rejects a tag while encoding TIFF data to an in-memory buffer. The error path frees the output buffer without closing the TIFF handle, and later cleanup flushes through the write callback into freed memory.

Pillow before version 13.0.0's rank-based filters can dereference invalid image storage for a zero-size image. ImagingExpand() allocates a non-empty output and then faults while replicating edges by reading the first pixel from empty input storage; ImagingRankFilter is never reached. An attacker can supply or cause creation of a zero-size image to an application that applies a rank, median, minimum, or maximum filter, causing a native process crash.

Dolibarr up to 23.0.2 contains a vulnerability in an unknown function of htdocs/document.php in the CSP component. Manipulation leads to protection mechanism failure, and the attack can be executed remotely.