python-pillow: Out-of-bounds read in SGI RLE image reader

An issue was discovered in Pillow before 8.1.1. There is an out-of-bounds read in SGIRleDecode.c.

python-pillow: Regular expression DoS in PDF format parser

An issue was discovered in Pillow before 8.1.1. The PDF parser allows a regular expression DoS (ReDoS) attack via a crafted PDF file because of a catastrophic backtracking regex.

python-pillow: out-of-bounds read in TiffReadRGBATile in TiffDecode.c

An issue was discovered in Pillow before 8.1.1. In TiffDecode.c, there is an out-of-bounds read in TiffreadRGBATile via invalid tile boundaries.

python-pillow: Negative-offset memcpy in TIFF image reader

An issue was discovered in Pillow before 8.1.1. In TiffDecode.c, there is a negative-offset memcpy with an invalid size.

python-pillow: insufficent fix for CVE-2020-35654 due to incorrect error checking in TiffDecode.c

An issue was discovered in Pillow before 8.1.1. TiffDecode has a heap-based buffer overflow when decoding crafted YCbCr files because of certain interpretation conflicts with LibTIFF in RGBA mode. NOTE: this issue exists because of an incomplete fix for CVE-2020-35654.

python-pillow: Out-of-bounds read in J2K image reader

An issue was discovered in Pillow before 8.2.0. There is an out-of-bounds read in J2kDecode, in j2ku_gray_i.

python-pillow: Out-of-bounds read in J2K image reader

An issue was discovered in Pillow before 8.2.0. There is an out-of-bounds read in J2kDecode, in j2ku_graya_la.

Regular Expression Denial of Service (ReDoS)

The package pillow 5.2.0 and before 8.3.2 are vulnerable to Regular Expression Denial of Service (ReDoS) via the getrgb function.

python-urllib3: inefficient algorithm allows a DoS (CPU consumption) in _encode_invalid_chars function in util/url.py

The _encode_invalid_chars function in util/url.py in the urllib3 library 1.25.2 through 1.25.7 for Python allows a denial of service (CPU consumption) because of an inefficient algorithm. The percent_encodings array contains all matches of percent encodings. It is not deduplicated. For a URL of length N, the size of percent_encodings may be up to O(N). The next step (normalize existing percent-encoded bytes) also takes up to O(N) for each step, so the total time is O(N^2). If percent_encodings were deduplicated, the time to compute _encode_invalid_chars would be O(kN), where k is at most 484 ((10+6*2)^2).

python-pillow: out-of-bounds read in ImagingFliDecode when loading FLI images

libImaging/FliDecode.c in Pillow before 6.2.2 has an FLI buffer overflow.

python-pillow: improperly restricted operations on memory buffer in libImaging/PcxDecode.c

libImaging/PcxDecode.c in Pillow before 6.2.2 has a PCX P mode buffer overflow.

python-pillow: out-of-bounds write in expandrow in libImaging/SgiRleDecode.c

libImaging/SgiRleDecode.c in Pillow before 6.2.2 has an SGI buffer overflow.

python-pillow: Integer overflow leading to buffer overflow in ImagingLibTiffDecode

libImaging/TiffDecode.c in Pillow before 6.2.2 has a TIFF decoding integer overflow, related to realloc.

python-pillow: Buffer over-read in SGI RLE image reader

In Pillow before 8.1.0, SGIRleDecode has a 4-byte buffer over-read when decoding crafted SGI RLE image files because offsets and length tables are mishandled.

python-pillow: decoding crafted YCbCr files could result in heap-based buffer overflow

In Pillow before 8.1.0, TiffDecode has a heap-based buffer overflow when decoding crafted YCbCr files because of certain interpretation conflicts with LibTIFF in RGBA mode.

python-pillow: Buffer over-read in PCX image reader

In Pillow before 8.1.0, PcxDecode has a buffer over-read when decoding a crafted PCX file because the user-supplied stride value is trusted for buffer calculations.

A sandboxing issue in Odoo Community 11.0 through 13.0 and Odoo Enterprise 11.0 through 13.0, when running with Python 3.6 or later, allows remote authenticated users to execute arbitrary code, leading to privilege escalation.

python-urllib3: CRLF injection via HTTP request method

urllib3 before 1.25.9 allows CRLF injection if the attacker controls the HTTP request method, as demonstrated by inserting CR and LF control characters in the first argument of putrequest(). NOTE: this is similar to CVE-2020-26116.

An exploitable vulnerability exists in the configuration-loading functionality of the jw.util package before 2.3 for Python. When loading a configuration with FromString or FromStream with YAML, one can execute arbitrary Python code, resulting in OS command execution, because safe_load is not used.

python-pillow: out-of-bounds reads/writes in the parsing of SGI image files in expandrow/expandrow2

In libImaging/SgiRleDecode.c in Pillow through 7.0.0, a number of out-of-bounds reads exist in the parsing of SGI image files, a different issue than CVE-2020-5311.