python-pillow/Pillow: 9.1.1

Van Kemenade, Hugo, Murray, Andrew, Wiredfool, Jeffrey A. Clark, "Alex", Karpinsky, Alexander, Baranovič, Ondrej, Gohlke, Christoph, Dufresne, Jon, DWesl, Schmidt, David, Kopachev, Konstantin, Houghton, Alastair, Mani, Sandro, Landey, Steve, Vashek, Ware, Josh, Douglas, Jason, Stanislau, T., Caro, David, Martinez, Uriel, Kossouho, Steve, Lahd, Riley, Lee, Antony, Brown, Eric W., Tonnhofer, Oliver, Piolie, Bonfill, Mickael, Base, Max, Peter Rowlands (변기호)
2022 · doi:10.5281/zenodo.6557874 · W6950282637
other OA: green CC0
🔓 Open OA copy View on OpenAlex View at publisher

Abstract

This release addresses several security problems. CVE-2022-30595: When reading a TGA file with RLE packets that cross scan lines, Pillow reads the information past the end of the first line without deducting that from the length of the remaining file data. This vulnerability was introduced in Pillow 9.1.0, and can cause a heap buffer overflow. Opening an image with a zero or negative height has been found to bypass a decompression bomb check. This will now raise a SyntaxError instead, in turn raising a PIL.UnidentifiedImageError.

My notes (saved in your browser only)

Citation neighborhood (no data yet)

We don't have any in-corpus citations linked to this paper yet. The paper's references may be in our DB but unresolved to ``paper_id`` (resolution happens at ingest when the cited DOI matches a row we already have). Run the cross-source citation reconcile pass to retry.

Source provenance

openalex
last seen: 2026-05-10T11:09:34.760799+00:00
License: CC0 · commercial use OK