The version of python-pillow installed on the remote host is prior to 2.0.0-23.gitd1c6db8. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2022-1786 advisory.

    A flaw was found in python-pillow. The vulnerability occurs due to improper initialization of image paths,     leading to a buffer over-read and improper initialization. This flaw allows an attacker to unauthorized     memory access that causes memory access errors, incorrect results, or crashes. (CVE-2022-22815)

    A flaw was found in python-pillow. The vulnerability occurs due to improper initialization of image paths,     leading to a buffer over-read and improper initialization. This flaw allows an attacker to unauthorized     memory access that causes memory access errors, incorrect results, or crashes. (CVE-2022-22816)

    A flaw was found in python-pillow. The vulnerability occurs due to Improper Neutralization, leading to     command injection. This flaw allows an attacker to externally-influenced input commands that modify the     intended command. (CVE-2022-22817)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Ubuntu 16.04 ESM host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-5227-2 advisory.

    USN-5227-1 fixed several vulnerabilities in Pillow. This update provides the corresponding update for     Ubuntu 14.04 ESM and Ubuntu 16.04 ESM.



Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

According to the versions of the python-pillow package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - path_getbbox in path.c in Pillow before 9.0.0 improperly initializes ImagePath.Path. (CVE-2022-22815)

  - path_getbbox in path.c in Pillow before 9.0.0 has a buffer over-read during initialization of     ImagePath.Path. (CVE-2022-22816)

  - PIL.ImageMath.eval in Pillow before 9.0.0 allows evaluation of arbitrary expressions, such as ones that     use the Python exec method. A lambda expression could also be used, (CVE-2022-22817)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the python-pillow package installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities :

  - path_getbbox in path.c in Pillow before 9.0.0 improperly initializes ImagePath.Path. (CVE-2022-22815)

  - path_getbbox in path.c in Pillow before 9.0.0 has a buffer over-read during initialization of     ImagePath.Path. (CVE-2022-22816)

  - PIL.ImageMath.eval in Pillow before 9.0.0 allows evaluation of arbitrary expressions, such as ones that     use the Python exec method. A lambda expression could also be used, (CVE-2022-22817)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote openSUSE 15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2024:1673-1 advisory.

    - Fixed ImagePath.Path array handling (bsc#1194552, CVE-2022-22815, bsc#1194551, CVE-2022-22816)
    - Use snprintf instead of sprintf (bsc#1188574, CVE-2021-34552)
    - Fix Memory DOS in Icns, Ico and Blp Image Plugins. (bsc#1183110, CVE-2021-27921, bsc#1183108,     CVE-2021-27922, bsc#1183107, CVE-2021-27923)
    - Fix OOB read in SgiRleDecode.c (bsc#1183102, CVE-2021-25293)
    - Use more specific regex chars to prevent ReDoS (bsc#1183101, CVE-2021-25292)
    - Fix negative size read in TiffDecode.c (bsc#1183105, CVE-2021-25290)
    - Raise ValueError if color specifier is too long (bsc#1190229, CVE-2021-23437)
    - Incorrect error code checking in TiffDecode.c (bsc#1183103, CVE-2021-25289)
    - OOB Write in TiffDecode.c (bsc#1180833, CVE-2020-35654)

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
160268	Amazon Linux 2 : python-pillow, --advisory ALAS2-2022-1786 (ALAS-2022-1786)	Nessus	Amazon Linux Local Security Checks	2022/4/27	2025/9/30	critical
156772	Ubuntu 16.04 ESM : Pillow vulnerabilities (USN-5227-2)	Nessus	Ubuntu Local Security Checks	2022/1/17	2024/10/29	critical
159786	EulerOS 2.0 SP9 : python-pillow (EulerOS-SA-2022-1436)	Nessus	Huawei Local Security Checks	2022/4/18	2023/11/1	critical
165871	EulerOS Virtualization 3.0.6.6 : python-pillow (EulerOS-SA-2022-2532)	Nessus	Huawei Local Security Checks	2022/10/9	2023/10/16	critical
197551	openSUSE 15 Security Update : python-Pillow (SUSE-SU-2024:1673-1)	Nessus	SuSE Local Security Checks	2024/5/21	2026/6/26	critical

检测

插件搜索

critical

critical

critical

critical

critical