-
Notifications
You must be signed in to change notification settings - Fork 62
/
PYSEC-2023-175.yaml
119 lines (119 loc) · 1.65 KB
/
PYSEC-2023-175.yaml
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
id: PYSEC-2023-175
details: Pillow versions before v10.0.1 bundled libwebp binaries in wheels that are
vulnerable to CVE-2023-5129 (previously CVE-2023-4863). Pillow v10.0.1 upgrades the bundled libwebp binary
to v1.3.2.
modified: '2023-09-25T17:25:13.946374Z'
related:
- CVE-2023-4863
- CVE-2023-5129
references:
- type: ADVISORY
url: https://github.com/python-pillow/Pillow/blob/main/CHANGES.rst#1001-2023-09-15
- type: ADVISORY
url: https://nvd.nist.gov/vuln/detail/CVE-2023-5129
- type: ADVISORY
url: https://nvd.nist.gov/vuln/detail/CVE-2023-4863
affected:
- package:
name: pillow
ecosystem: PyPI
purl: pkg:pypi/pillow
ranges:
- type: ECOSYSTEM
events:
- introduced: '0'
- fixed: 10.0.1
versions:
- '1.0'
- '1.1'
- '1.2'
- '1.3'
- '1.4'
- '1.5'
- '1.6'
- 1.7.0
- 1.7.1
- 1.7.2
- 1.7.3
- 1.7.4
- 1.7.5
- 1.7.6
- 1.7.7
- 1.7.8
- 10.0.0
- 2.0.0
- 2.1.0
- 2.2.0
- 2.2.1
- 2.2.2
- 2.3.0
- 2.3.1
- 2.3.2
- 2.4.0
- 2.5.0
- 2.5.1
- 2.5.2
- 2.5.3
- 2.6.0
- 2.6.1
- 2.6.2
- 2.7.0
- 2.8.0
- 2.8.1
- 2.8.2
- 2.9.0
- 3.0.0
- 3.1.0
- 3.1.0.rc1
- 3.1.0rc1
- 3.1.1
- 3.1.2
- 3.2.0
- 3.3.0
- 3.3.1
- 3.3.2
- 3.3.3
- 3.4.0
- 3.4.1
- 3.4.2
- 4.0.0
- 4.1.0
- 4.1.1
- 4.2.0
- 4.2.1
- 4.3.0
- 5.0.0
- 5.1.0
- 5.2.0
- 5.3.0
- 5.4.0
- 5.4.0.dev0
- 5.4.1
- 6.0.0
- 6.1.0
- 6.2.0
- 6.2.1
- 6.2.2
- 7.0.0
- 7.1.0
- 7.1.1
- 7.1.2
- 7.2.0
- 8.0.0
- 8.0.1
- 8.1.0
- 8.1.1
- 8.1.2
- 8.2.0
- 8.3.0
- 8.3.1
- 8.3.2
- 8.4.0
- 9.0.0
- 9.0.1
- 9.1.0
- 9.1.1
- 9.2.0
- 9.3.0
- 9.4.0
- 9.5.0