A vulnerability in Pillow's libtiff encoder allows crafted TIFF files to cause memory disclosure or process crashes during TIFF re-saving. The flaw arises from a mismatch between Pillow's argument passing to libtiff's TIFFSetField() and libtiff's internal tag definitions, leading to reading unintended memory or segfaults. This occurs when Pillow forwards unrecognized TIFF tags from the source file without properly consulting libtiff's field table. The issue affects applications that open and then save TIFF images, especially when metadata is preserved. No out-of-bounds writes were observed, only reads. The vulnerability was introduced in Pillow 5.4.0 and affects versions from 0.86.1_1 onward as per the provided data.
### Impact
An attacker who uses this vulnerability can craft a PDF which leads to large memory consumption. This requires accessing any stream with a large amount of filters or multiple filters which pass around large amounts of data.
### Patches
This has been fixed in [pypdf==6.20.0](https://github.com/py-pdf/pypdf/releases/tag/6.20.0).
### Workarounds
If you cannot upgrade yet, consider applying the changes from PR [#4173](https://github.com/py-pdf/pypdf/pull/4173).
### Impact
An attacker who uses this vulnerability can craft a PDF which leads to an infinite loop. This requires an incomplete file which ends inside the xref table.
### Patches
This has been fixed in [pypdf==6.20.0](https://github.com/py-pdf/pypdf/releases/tag/6.20.0).
### Workarounds
If you cannot upgrade yet, consider applying the changes from PR [#4170](https://github.com/py-pdf/pypdf/pull/4170).
### Notes
This has been reported through both the secure channel and as a public issue at [#4169](https://github.com/py-pdf/pypdf/issues/4169).
### Impact
An attacker who uses this vulnerability can craft a PDF which leads to an infinite loop. This requires removing an object from a tree, for example an outline item.
### Patches
This has been fixed in [pypdf==6.20.1](https://github.com/py-pdf/pypdf/releases/tag/6.20.1).
### Workarounds
If you cannot upgrade yet, consider applying the changes from PR [#4188](https://github.com/py-pdf/pypdf/pull/4188).
pypdf is a free and open-source pure-python PDF library. Prior to 6.20.1, calling PdfWriter.find_outline_item on a crafted PDF with a cyclic outline hierarchy can enter an infinite loop and block the current process. This issue is fixed in version 6.20.1.
### Impact
An attacker who uses this vulnerability can craft a PDF which leads to arbitrary image parsers being called. This requires loading an image which claims to use the `/DCTDecode` filter (JPEG data).
Users which do not have the optional *Pillow* dependency installed in their environment are not affected.
### Patches
This has been fixed in [pypdf==6.21.1](https://github.com/py-pdf/pypdf/releases/tag/6.21.1).
### Workarounds
If you cannot upgrade yet, consider applying the changes from PR [#4222](https://github.com/py-pdf/pypdf/pull/4222).
Multiple vulnerabilities in aiohttp versions from 5.14.0_13 up to but not including 5.14.0_18 can lead to excessive or unbounded memory and CPU usage triggered by attacker-controlled requests. This resource exhaustion can disrupt service availability. A fix is available in version 5.14.0_18.
The pure Python HTTP parser in AIOHTTP is vulnerable to an HTTP request smuggling attack when used instead of the default C parser. This affects applications using the Python parser, such as those with the AIOHTTP_NO_EXTENSIONS environment or non-standard wheel installations. A fix is available in version 5.14.0_18. Users are advised to switch to the default C parser to mitigate the issue.
A vulnerability in ScoutSuite versions >=5.14.0_13 and <5.14.0_18 allows a subdomain to remove the Host-Only flag from an existing cookie set for a parent domain. This could reduce cookie security protections for users accessing untrusted subdomains. The impact is limited because most use cases do not reflect these cookies back to browsers.
AIOHTTP versions from 5.14.0_13 up to but not including 5.14.0_18 contain a vulnerability where an attacker can send an absolute-form HTTP request to spoof the Request.scheme attribute. This can mislead applications relying on this attribute for security decisions, potentially causing them to misinterpret whether a connection is encrypted. The issue is fixed in version 5.14.0_18.
AIOHTTP versions from 5.14.0_13 up to but not including 5.14.0_18 contain a vulnerability where specially crafted multipart requests can exhaust file descriptors. This occurs if a handler uses the Request.post() method, potentially leading to resource exhaustion on the affected system. The issue has been fixed in version 5.14.0_18.
A vulnerability in AIOHTTP's Max-Age processing can cause an overflow that prevents connections from closing properly. This may allow an attacker to temporarily exhaust the connection pool until garbage collection reclaims the connections. The issue affects ScoutSuite versions from 5.14.0_13 up to but not including 5.14.0_18. A fix is available in version 5.14.0_18.
Scoutsuite versions from 5.14.0_13 up to but not including 5.14.0_18 have a vulnerability where the aiohttp server does not enforce an initial request/header timeout. This allows an attacker to keep an idle connection open indefinitely before sending any data, potentially leading to resource exhaustion. A fix is available in version 5.14.0_18. The recommended mitigation is to use a reverse proxy with sensible keepalive limits, which is advised for all production deployments.
A vulnerability in scoutsuite versions >=5.14.0_13 and <5.14.0_18 allows the Secure attribute of shared cookies to not be enforced. This means a cookie marked as Secure could be sent over unencrypted requests, potentially exposing sensitive cookie data.