Parse Server versions before 8.6.98 and 9.0.0 before 9.10.3 have a vulnerability in the _Session class where create and addField class-level permissions are not enforced. This allows an authenticated user or anyone with that user's session token to create additional sessions and add fields to the _Session class. These additional sessions remain active even after the original session is logged out.
Parse Server versions before 8.6.99 and versions 9.0.0 up to but not including 9.10.3 contain an information disclosure vulnerability. This flaw allows an unauthorized user to confirm guessed usernames, emails, and under certain password policy settings, current or previous passwords by observing responses during user update attempts. The vulnerability arises because checks against the target account are evaluated before authorization, leaking information in the response. This issue has been fixed in versions 8.6.99 and 9.10.3.
Pillow versions prior to 13.0.0 contain a regular-expression denial of service (ReDoS) vulnerability in the XBM image header parser. Specifically, the XbmImagePlugin applies a backtracking regex to attacker-controlled XBM headers when Image.open() is called, causing the process to stall for minutes and resulting in a denial of service. This issue is resolved in Pillow version 13.0.0.
Pillow versions from 2.6.0 up to but not including 13.0.0 are vulnerable to argument injection when processing EPS files via Ghostscript. The vulnerability arises because the filename passed to Ghostscript is not sanitized, allowing attacker-controlled filenames starting with a hyphen to be interpreted as Ghostscript options. Exploitation requires control of a filename and an argument file referenced by a leading @, enabling arbitrary command execution. This issue is fixed in Pillow version 13.0.0.
Pillow versions from 9.1.0 up to but not including 13.0.0 have a vulnerability in the Image.quantize() function where using an empty palette can cause uninitialized stack memory to be disclosed. This occurs because a local cache array is left uninitialized when the palette has zero entries, and those uninitialized bytes are emitted as output pixel indices. An attacker controlling the palette image can extract stack contents, including addresses and stack-canary data, from a returned PNG or GIF image. This issue does not cause memory corruption or crashes and is fixed in version 13.0.0.
A vulnerability in the Pillow Python imaging library versions 5.3.0 through 12.x allows uninitialized memory to be returned as pixel data when decoding certain TIFF images compressed with JPEG or Group 4 fax formats. This occurs because Pillow's internal buffers can be larger than the data written by libtiff, and the unwritten portions are not cleared. An attacker can craft a malicious TIFF file to cause an application using Pillow to disclose stale heap memory contents without causing crashes or memory corruption. The issue is fixed in Pillow version 13.0.0.
A heap out-of-bounds read vulnerability exists in Pillow's TIFF encoder prior to version 13.0.0. This occurs when TIFF metadata retains a ColorMap with a plane size inconsistent with BitsPerSample, allowing reading beyond the buffer. An attacker can craft a TIFF file that triggers this flaw during re-encoding, potentially disclosing heap memory or causing a crash. The issue is fixed in Pillow 13.0.0.
Pillow versions from 5.1.0 up to but not including 13.0.0 contain a vulnerability in PDF parsing that can cause unbounded recursion when processing page trees or trailer chains. This can lead to excessive CPU and memory consumption or a RecursionError, resulting in denial of service when an attacker supplies a crafted PDF to an application using Image.save with PDF append enabled. The issue is fixed in version 13.0.0.
A denial-of-service vulnerability exists in Pillow versions from 5.1.0 up to but not including 13.0.0. The issue arises when saving multi-frame images as PDFs with save_all enabled, causing quadratic-time complexity in reserving PDF object identifiers. This can lead to excessive CPU consumption and potential service denial. The flaw is fixed in version 13.0.0.
Pillow versions from 10.0.0 up to but not including 13.0.0 contain a vulnerability in FreeType glyph rendering when a stroker is active. If the glyph loading fails, the library may free an invalid glyph pointer, leading to memory corruption or a crash. This occurs when an attacker supplies a malformed font to an application that renders text with a nonzero stroke width. The issue is resolved in Pillow version 13.0.0.
Pillow, a Python imaging library, contains a vulnerability in its MSP RLE decoder from versions 4.1.0 up to but not including 13.0.0. The decoder can expand a small crafted MSP image file into an unbounded in-memory buffer, leading to memory exhaustion and denial of service. This occurs because the decoder writes run-length output to a BytesIO object without limiting expansion to the declared image size, bypassing decompression-bomb checks. The issue is fixed in version 13.0.0.
Pillow versions from 9.2.0 up to but not including 13.0.0 contain a vulnerability where saving a GIF image with a long comment causes quadratic copying of the comment data. This behavior can lead to excessive CPU consumption, potentially resulting in denial of service. The issue is fixed in version 13.0.0.
Pillow versions from 5.1.0 up to but not including 13.0.0 contain a vulnerability where the PdfParser.rewrite_pages() function can enter an infinite loop when processing a PDF with a cyclic page tree. This occurs because the function follows Parent relationships without detecting cycles. An attacker can exploit this by supplying a crafted cyclic PDF to an application that appends images to PDFs, causing high CPU usage and a denial of service. The issue is fixed in Pillow version 13.0.0.
Pillow versions from 12.0.0 up to but not including 13.0.0 contain a vulnerability in the Image.merge() function where a null pointer dereference can occur due to improper validation of the first input band. This flaw can be triggered by processing a crafted IPTC file or by direct invocation with a specially crafted first band, leading to a native process crash. The issue is resolved in version 13.0.0.
Pillow versions from 8.1.0 up to but not including 13.0.0 contain an out-of-bounds read vulnerability in the TIFF tile and RGBA decode paths. This flaw occurs when Pillow and libtiff interpret certain TIFF tags differently, leading to reading beyond the expected row data. Exploiting this can leak adjacent heap memory into pixel data or cause a crash. The issue is resolved in Pillow version 13.0.0.
A heap buffer overflow vulnerability exists in Pillow's JPEG decoder prior to version 13.0.0. The flaw occurs because ImagingJpegDecode does not verify the actual output width and component count after requesting downscaling, allowing crafted 8-bit lossless SOF3 JPEG images to bypass scaling restrictions. This can lead to heap memory corruption, process crashes, or potentially code execution. The issue is fixed in Pillow 13.0.0.
Pillow versions prior to 13.0.0 contain a double free vulnerability in the ImagingScaleAffine function triggered by a selective allocation failure during Image.transform operations. This flaw occurs when the output image allocation succeeds but an additional per-column lookup allocation fails, causing the error path to free image memory twice. Exploiting this requires driving a large Image.transform operation under memory pressure. The vulnerability can lead to process crashes and potential memory corruption. The issue is fixed in Pillow version 13.0.0.
A denial of service vulnerability exists in Pillow versions 5.4.0 through 12.x due to quadratic copying when parsing GIF comments. This occurs because the GifImageFile._seek() method repeatedly appends immutable bytes for comment sub-blocks and multiple comment extensions, causing excessive CPU consumption when processing crafted GIF files with many comment extensions. The issue is resolved in Pillow 13.0.0.
A vulnerability in the Pillow Python imaging library versions 9.2.0 through 12.x allows a crafted GIF to retain rejected frame dimensions after a decompression bomb exception. This can cause subsequent image processing operations to allocate excessive memory, leading to denial of service. The issue is fixed in Pillow version 13.0.0.
Pillow versions from 8.1.0 up to but not including 13.0.0 have a vulnerability where processing a crafted APNG image can cause the library to allocate memory for the full canvas size before performing a decompression bomb check. This can lead to excessive memory consumption and a denial of service. The issue is fixed in version 13.0.0.