Описание
Pillow is a Python imaging library. Prior to 12.3.0, Pillow's public rank-filter API can trigger a native heap out-of-bounds write when given a very large odd filter size because ImageFilter.RankFilter.filter() calls image.expand(size // 2, size // 2) before rank-filter size validation and ImagingExpand() computes output dimensions with unchecked signed int arithmetic. This issue is fixed in version 12.3.0.
A flaw was found in Pillow prior to 12.3.0. The public RankFilter API can trigger a native heap out-of-bounds write when given a very large odd filter size. ImageFilter.RankFilter.filter() calls image.expand(size // 2, size // 2) before rank-filter size validation, and ImagingExpand() computes output dimensions with unchecked signed integer arithmetic. This can lead to denial of service and limited integrity impact via heap corruption.
Отчет
Pillow's RankFilter API is vulnerable to a native heap out-of-bounds write when a caller supplies a very large odd filter size. Expansion runs before size validation and ImagingExpand uses unchecked signed integer arithmetic for output dimensions. A remote attacker who can drive RankFilter with attacker-controlled sizes may crash the process or corrupt heap memory. Fixed in Pillow 12.3.0.
Затронутые пакеты
| Платформа | Пакет | Состояние | Рекомендация | Релиз |
|---|---|---|---|---|
| Exploit Intelligence | exploit-intelligence-tech-preview/vulnerability-analysis-rhel9 | Affected | ||
| Lightspeed Core | lightspeed-core/lightspeed-stack-rhel9 | Affected | ||
| Lightspeed Core | lightspeed-core/rag-tool-cpu-rhel9 | Affected | ||
| Lightspeed Core | lightspeed-core/rag-tool-cuda-12.9-rhel9 | Affected | ||
| OpenShift Lightspeed | openshift-lightspeed/lightspeed-ocp-rag-rhel9 | Not affected | ||
| OpenShift Lightspeed | openshift-lightspeed/lightspeed-service-api-rhel9 | Affected | ||
| OpenShift Lightspeed | openshift-lightspeed-tech-preview/lightspeed-rag-tool-rhel9 | Not affected | ||
| Red Hat AI Inference Server | rhaiis/vllm-neuron-rhel9 | Will not fix | ||
| Red Hat AI Inference Server | rhaiis/vllm-tpu-rhel9 | Will not fix | ||
| Red Hat AI Inference Server | rhaii/vllm-gaudi-rhel9 | Will not fix |
Показывать по
Ссылки на источники
Дополнительная информация
Статус:
EPSS
8.2 High
CVSS3
Связанные уязвимости
Pillow is a Python imaging library. Prior to 12.3.0, Pillow's public rank-filter API can trigger a native heap out-of-bounds write when given a very large odd filter size because ImageFilter.RankFilter.filter() calls image.expand(size // 2, size // 2) before rank-filter size validation and ImagingExpand() computes output dimensions with unchecked signed int arithmetic. This issue is fixed in version 12.3.0.
Pillow is a Python imaging library. Prior to 12.3.0, Pillow's public rank-filter API can trigger a native heap out-of-bounds write when given a very large odd filter size because ImageFilter.RankFilter.filter() calls image.expand(size // 2, size // 2) before rank-filter size validation and ImagingExpand() computes output dimensions with unchecked signed int arithmetic. This issue is fixed in version 12.3.0.
Pillow is a Python imaging library. Prior to 12.3.0, Pillow's public r ...
Pillow: Heap out-of-bounds write in `ImageFilter.RankFilter` via integer overflow in `ImagingExpand`
Уязвимость функции ImageFilter.RankFilter.filter библиотеки для работы с изображениями Pillow, позволяющая нарушителю оказать воздействие на целостность и доступность защищаемой информации
EPSS
8.2 High
CVSS3