PyPI/pillow CVE-2022-30595: critical 9.8, EPSS 2.33%

libImaging/TgaRleDecode.c in Pillow 9.1.0 has a heap buffer overflow in the processing of invalid TGA image files.

Action: Upgrade pillow to 9.1.1 or later.

pip install pillow==9.1.1

Affected

Fixed versions

Sources

• osv: PYSEC-2022-43145
• https://pillow.readthedocs.io/en/stable/releasenotes/9.1.1.html
• https://github.com/python-pillow/Pillow/blob/main/src/libImaging/TgaRleDecode.c

CVE-2022-30595 · published 2022-05-25T12:15:00Z · modified 2024-11-25T22:42:00.503393Z · JSON