2026-10-21 归档

今日共收录 2917 条安全情报，包含 2077 个 CVE，435 篇安全通告，以及 100 篇研究论文。

漏洞预警2026-10-19 发布INFO

Pillow is a Python imaging library. From 9.1.0 until 13.0.0, Pillow can disclose uninitialized stack memory when Image.quantize() uses an empty palette. ImagingPaletteCacheUpdat...

CVE-2026-112898

Pillow is a Python imaging library. From 9.1.0 until 13.0.0, Pillow can disclose uninitialized stack memory when Image.q

历史摘要 · 未重新核验 · NVD

#cve #cwe-457

漏洞预警2026-10-19 发布INFO

Pillow is a Python imaging library. From 5.3.0 until 13.0.0, Pillow can return uninitialized memory as pixels when libtiff performs a short decode of JPEG-compressed or Group 4 ...

CVE-2026-112897

Pillow is a Python imaging library. From 5.3.0 until 13.0.0, Pillow can return uninitialized memory as pixels when libti

历史摘要 · 未重新核验 · NVD

#cve #cwe-908

漏洞预警2026-10-19 发布INFO

Pillow is a Python imaging library. Prior to 13.0.0, Pillow's TIFF encoder can read beyond a ColorMap buffer when retained TIFF metadata has a plane size inconsistent with BitsP...

CVE-2026-112896

Pillow is a Python imaging library. Prior to 13.0.0, Pillow's TIFF encoder can read beyond a ColorMap buffer when retain

历史摘要 · 未重新核验 · NVD

#cve #cwe-125

漏洞预警2026-10-19 发布INFO

Pillow is a Python imaging library. From 5.1.0 until 13.0.0, Pillow can exhaust resources while parsing an existing PDF during an append operation. PdfParser follows page-tree c...

CVE-2026-112895

Pillow is a Python imaging library. From 5.1.0 until 13.0.0, Pillow can exhaust resources while parsing an existing PDF

历史摘要 · 未重新核验 · NVD

#cve #cwe-674

漏洞预警2026-10-19 发布INFO

Pillow is a Python imaging library. From 5.1.0 until 13.0.0, Pillow takes quadratic time to reserve PDF object identifiers when saving many frames with save_all enabled. PdfPars...

CVE-2026-112894

Pillow is a Python imaging library. From 5.1.0 until 13.0.0, Pillow takes quadratic time to reserve PDF object identifie

历史摘要 · 未重新核验 · NVD

#cve #cwe-407

漏洞预警2026-10-19 发布INFO

Pillow is a Python imaging library. From 10.0.0 until 13.0.0, Pillow can free an invalid glyph pointer during FreeType rendering with an active stroker. If FT_Load_Glyph fails, ...

CVE-2026-112893

Pillow is a Python imaging library. From 10.0.0 until 13.0.0, Pillow can free an invalid glyph pointer during FreeType r

历史摘要 · 未重新核验 · NVD

#cve #cwe-457 #cwe-763

漏洞预警2026-10-19 发布INFO

Pillow is a Python imaging library. From 4.1.0 until 13.0.0, Pillow's MSP RLE decoder can expand a small file into an unbounded in-memory buffer. The decoder writes run-length o...

CVE-2026-112892

Pillow is a Python imaging library. From 4.1.0 until 13.0.0, Pillow's MSP RLE decoder can expand a small file into an un

历史摘要 · 未重新核验 · NVD

#cve #cwe-409

漏洞预警2026-10-19 发布INFO

Pillow is a Python imaging library. From 9.2.0 until 13.0.0, Pillow performs quadratic copying when saving a GIF with a long comment. _get_global_header() repeatedly copies port...

CVE-2026-112891

Pillow is a Python imaging library. From 9.2.0 until 13.0.0, Pillow performs quadratic copying when saving a GIF with a

历史摘要 · 未重新核验 · NVD

#cve #cwe-407

漏洞预警2026-10-19 发布INFO

Pillow is a Python imaging library. From 5.1.0 until 13.0.0, Pillow can enter an infinite loop while rewriting PDF pages. PdfParser.rewrite_pages() follows Parent relationships ...

CVE-2026-112406

Pillow is a Python imaging library. From 5.1.0 until 13.0.0, Pillow can enter an infinite loop while rewriting PDF pages

历史摘要 · 未重新核验 · NVD

#cve #cwe-835

漏洞预警2026-10-19 发布INFO

Pillow is a Python imaging library. From 12.0.0 until 13.0.0, Pillow's Image.merge() can dereference a null image8 plane. Validation skips the first input band, allowing a 32-bi...

CVE-2026-112405

Pillow is a Python imaging library. From 12.0.0 until 13.0.0, Pillow's Image.merge() can dereference a null image8 plane

历史摘要 · 未重新核验 · NVD

#cve #cwe-476

漏洞预警2026-10-19 发布INFO

Pillow is a Python imaging library. From 8.1.0 until 13.0.0, Pillow's TIFF tile and RGBA decode paths can read beyond row data produced by libtiff. In _decodeTile and the RGBA u...

CVE-2026-112404

Pillow is a Python imaging library. From 8.1.0 until 13.0.0, Pillow's TIFF tile and RGBA decode paths can read beyond ro

历史摘要 · 未重新核验 · NVD

#cve #cwe-126

漏洞预警2026-10-19 发布INFO

Pillow is a Python imaging library. Prior to 13.0.0, Pillow's JPEG decoder can write a full-width scanline into a buffer sized for a requested draft scale. ImagingJpegDecode doe...

CVE-2026-112403

Pillow is a Python imaging library. Prior to 13.0.0, Pillow's JPEG decoder can write a full-width scanline into a buffer

历史摘要 · 未重新核验 · NVD

#cve #cwe-122

漏洞预警2026-10-19 发布INFO

Pillow is a Python imaging library. Prior to 13.0.0, Pillow can double free image memory when ImagingScaleAffine encounters a selective allocation failure. The affected fast pat...

CVE-2026-112402

Pillow is a Python imaging library. Prior to 13.0.0, Pillow can double free image memory when ImagingScaleAffine encount

历史摘要 · 未重新核验 · NVD

#cve #cwe-416

漏洞预警2026-10-19 发布INFO

Pillow is a Python imaging library. From 5.4.0 until 13.0.0, Pillow performs quadratic copying while parsing GIF comments. GifImageFile._seek() repeatedly appends immutable byte...

CVE-2026-112401

Pillow is a Python imaging library. From 5.4.0 until 13.0.0, Pillow performs quadratic copying while parsing GIF comment

历史摘要 · 未重新核验 · NVD

#cve #cwe-407

漏洞预警2026-10-19 发布INFO

Pillow is a Python imaging library. From 9.2.0 until 13.0.0, Pillow can retain a rejected GIF frame size after a decompression-bomb exception. In GifImageFile._seek, a crafted G...

CVE-2026-112400

Pillow is a Python imaging library. From 9.2.0 until 13.0.0, Pillow can retain a rejected GIF frame size after a decompr

历史摘要 · 未重新核验 · NVD

#cve #cwe-400 #cwe-770

漏洞预警2026-10-19 发布INFO

Pillow is a Python imaging library. From 8.1.0 until 13.0.0, Pillow can allocate an APNG disposal background at the full canvas size before applying the decompression-bomb check...

CVE-2026-112399

Pillow is a Python imaging library. From 8.1.0 until 13.0.0, Pillow can allocate an APNG disposal background at the full

历史摘要 · 未重新核验 · NVD

#cve #cwe-789

漏洞预警2026-10-19 发布INFO

Pillow is a Python imaging library. Prior to 13.0.0, Pillow's FlashPix JPEG-tile decoder can write decoded scanlines beyond the allocated tile buffer. FlashPix (FPX) JPEG decodi...

CVE-2026-112398

Pillow is a Python imaging library. Prior to 13.0.0, Pillow's FlashPix JPEG-tile decoder can write decoded scanlines bey

历史摘要 · 未重新核验 · NVD

#cve #cwe-122 #cwe-787

漏洞预警2026-10-19 发布INFO

Pillow is a Python imaging library. Prior to 13.0.0, Pillow's ImageMorph.MorphOp.apply() can access memory before a row buffer for a zero-width image. PPM and PGM input can crea...

CVE-2026-112397

Pillow is a Python imaging library. Prior to 13.0.0, Pillow's ImageMorph.MorphOp.apply() can access memory before a row

历史摘要 · 未重新核验 · NVD

#cve #cwe-787

漏洞预警2026-10-19 发布INFO

Pillow is a Python imaging library. From 11.3.0 until 13.0.0, Pillow has a heap use-after-free when libtiff rejects a tag while encoding TIFF data to an in-memory buffer. When a...

CVE-2026-112396

Pillow is a Python imaging library. From 11.3.0 until 13.0.0, Pillow has a heap use-after-free when libtiff rejects a ta

历史摘要 · 未重新核验 · NVD

#cve #cwe-416

漏洞预警2026-10-19 发布INFO

A vulnerability has been found in Dolibarr up to 23.0.2. The impacted element is an unknown function of the file htdocs/document.php of the component CSP. Such manipulation lead...

CVE-2026-112361

A vulnerability has been found in Dolibarr up to 23.0.2. The impacted element is an unknown function of the file htdocs/

历史摘要 · 未重新核验 · NVD

#cve #cwe-693