The remote Redhat Enterprise Linux 8 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2024:1059 advisory.

    The python-pillow packages contain a Python image processing library that provides extensive file format     support, an efficient internal representation, and powerful image-processing capabilities.

    Security Fix(es):

    * pillow:Arbitrary Code Execution via the environment parameter (CVE-2023-50447)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Debian 11 / 12 host has packages installed that are affected by multiple vulnerabilities as referenced in the dsa-5704 advisory.

    - -------------------------------------------------------------------------     Debian Security Advisory DSA-5704-1                   security@debian.org     https://www.debian.org/security/                       Moritz Muehlenhoff     June 05, 2024                         https://www.debian.org/security/faq
    - -------------------------------------------------------------------------

    Package        : pillow     CVE ID         : CVE-2023-44271 CVE-2023-50447 CVE-2024-28219

    Multiple security issues were discovered in Pillow, a Python imaging     library, which could result in denial of service or the execution of     arbitrary code if malformed images are processed.

    For the oldstable distribution (bullseye), these problems have been fixed     in version 8.1.2+dfsg-0.3+deb11u2.

    For the stable distribution (bookworm), these problems have been fixed in     version 9.4.0-1.1+deb12u1.

    We recommend that you upgrade your pillow packages.

    For the detailed security status of pillow please refer to     its security tracker page at:
    https://security-tracker.debian.org/tracker/pillow

    Further information about Debian Security Advisories, how to apply     these updates to your system and frequently asked questions can be     found at: https://www.debian.org/security/

    Mailing list: debian-security-announce@lists.debian.org

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Ubuntu 14.04 LTS / 16.04 LTS / 18.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-8135-1 advisory.

    It was discovered that Pillow did not correctly handle reading J2K files, which could lead to an out-of-     bounds read vulnerability. If a user or automated system were tricked into opening a specially crafted     file, an attacker could possibly use this issue to cause a denial of service. This issue only affected     Ubuntu 16.04 LTS. (CVE-2021-25287, CVE-2021-25288)

    It was discovered that Pillow did not correctly handle certain integer arithmetic, which could lead to a     buffer overflow. An attacker could possibly use this issue to cause a denial of service or execute     arbitrary code. This issue only affected Ubuntu 14.04 LTS. (CVE-2021-25290)

    It was discovered that Pillow did not correctly perform bounds checking for certain operations. An     attacker could possibly use this issue to cause a denial of service. This issue only affected Ubuntu 14.04     LTS and Ubuntu 16.04 LTS. (CVE-2021-28675, CVE-2021-28676, CVE-2021-28677)

    It was discovered that Pillow did not correctly handle certain memory operations. An attacker could     possibly use this issue to cause a denial of service. (CVE-2023-44271)

    It was discovered that Pillow did not correctly sanitize certain inputs. An attacker could possibly use     this issue to execute arbitrary code. (CVE-2023-50447)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Ubuntu 20.04 LTS / 22.04 LTS / 23.10 host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-6618-1 advisory.

    It was discovered that Pillow incorrectly handled certain long text arguments. An attacker could possibly     use this issue to cause Pillow to consume resources, leading to a denial of service. This issue only     affected Ubuntu 20.04 LTS, and Ubuntu 22.04 LTS. (CVE-2023-44271)

    Duarte Santos discovered that Pillow incorrectly handled the environment parameter to PIL.ImageMath.eval.
    An attacker could possibly use this issue to execute arbitrary code. (CVE-2023-50447)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 8 host has packages installed that are affected by a vulnerability as referenced in the CESA-2024:0893 advisory.

  - Pillow through 10.1.0 allows PIL.ImageMath.eval Arbitrary Code Execution via the environment parameter, a     different vulnerability than CVE-2022-22817 (which was about the expression parameter). (CVE-2023-50447)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

According to the versions of the python-pillow package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - Pillow through 10.1.0 allows PIL.ImageMath.eval Arbitrary Code Execution via the environment parameter, a     different vulnerability than CVE-2022-22817 (which was about the expression parameter). (CVE-2023-50447)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote host is affected by the vulnerability described in GLSA-202405-12 (Pillow: Multiple Vulnerabilities)

  - An issue was discovered in Pillow before 10.0.0. It is a Denial of Service that uncontrollably allocates     memory to process a given task, potentially causing a service to crash by having it run out of memory.
    This occurs for truetype in ImageFont when textlength in an ImageDraw instance operates on a long text     argument. (CVE-2023-44271)

  - Pillow through 10.1.0 allows PIL.ImageMath.eval Arbitrary Code Execution via the environment parameter, a     different vulnerability than CVE-2022-22817 (which was about the expression parameter). (CVE-2023-50447)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote openSUSE 15 host has packages installed that are affected by a vulnerability as referenced in the openSUSE- SU-2024:0125-1 advisory.

  - Pillow through 10.1.0 allows PIL.ImageMath.eval Arbitrary Code Execution via the environment parameter, a     different vulnerability than CVE-2022-22817 (which was about the expression parameter). (CVE-2023-50447)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

According to the versions of the python-pillow package installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities :

  - Pillow through 10.1.0 allows PIL.ImageMath.eval Arbitrary Code Execution via the environment parameter, a     different vulnerability than CVE-2022-22817 (which was about the expression parameter). (CVE-2023-50447)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the python-pillow packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

    Pillow through 10.1.0 allows PIL.ImageMath.eval Arbitrary Code Execution via the environment parameter, a     different vulnerability than CVE-2022-22817 (which was about the expression parameter).(CVE-2023-50447)

    In _imagingcms.c in Pillow before 10.3.0, a buffer overflow exists because strcpy is used instead of     strncpy.(CVE-2024-28219)

Tenable has extracted the preceding description block directly from the EulerOS python-pillow security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Alibaba Cloud Linux 3 host has packages installed that are affected by a vulnerability as referenced in the ALINUX3-SA-2024:0087 advisory.

    Package updates are available for Alibaba Cloud Linux 3 that fix the following vulnerabilities:

    CVE-2023-50447:
    Pillow through 10.1.0 allows PIL.ImageMath.eval Arbitrary Code Execution via the environment parameter, a     different vulnerability than CVE-2022-22817 (which was about the expression parameter).

Tenable has extracted the preceding description block directly from the Alibaba Cloud Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
191439	RHEL 8 : python-pillow (RHSA-2024:1059)	Nessus	Red Hat Local Security Checks	2024/2/29	2024/11/7	high
200124	Debian dsa-5704 : python-pil-doc - security update	Nessus	Debian Local Security Checks	2024/6/5	2024/6/9	high
304431	Ubuntu 14.04 LTS / 16.04 LTS / 18.04 LTS : Pillow vulnerabilities (USN-8135-1)	Nessus	Ubuntu Local Security Checks	2026/3/31	2026/3/31	critical
189830	Ubuntu 20.04 LTS / 22.04 LTS / 23.10 : Pillow vulnerabilities (USN-6618-1)	Nessus	Ubuntu Local Security Checks	2024/1/30	2025/9/3	critical
190775	CentOS 8 : python-pillow (CESA-2024:0893)	Nessus	CentOS Local Security Checks	2024/2/20	2024/2/20	high
191804	EulerOS 2.0 SP11 : python-pillow (EulerOS-SA-2024-1225)	Nessus	Huawei Local Security Checks	2024/3/12	2024/3/12	high
194998	GLSA-202405-12 : Pillow: Multiple Vulnerabilities	Nessus	Gentoo Local Security Checks	2024/5/6	2024/5/6	high
196932	openSUSE 15 Security Update : python-Pillow (openSUSE-SU-2024:0125-1)	Nessus	SuSE Local Security Checks	2024/5/14	2024/5/14	high
197120	EulerOS Virtualization 2.11.1 : python-pillow (EulerOS-SA-2024-1617)	Nessus	Huawei Local Security Checks	2024/5/15	2024/5/15	high
202966	EulerOS 2.0 SP8 : python-pillow (EulerOS-SA-2024-2050)	Nessus	Huawei Local Security Checks	2024/7/22	2024/7/22	high
236056	Alibaba Cloud Linux 3 : 0087: python-pillow (ALINUX3-SA-2024:0087)	Nessus	Alibaba Cloud Linux Local Security Checks	2025/5/14	2025/5/14	critical

检测

插件搜索

high

high

critical

critical

high

high

high

high

high

high

critical