OSV-2022-715: Segv on unknown address in jpeg_read_scanlines · Watchpost

← All vulnerabilities

Segv on unknown address in jpeg_read_scanlines

OSV-2022-715 · Published 15/08/2022 · updated 30/10/2022

In short

OSV-2022-715 is a not yet rated vulnerability affecting pillow.
No patched version is listed yet: follow the vendor's advisory in References.

Package	Affected versions	Patched versions
pillow PyPI	`= 9.1.0= 9.1.1= 9.2.0`	No fix yet

Description

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=50217 https://pillow.readthedocs.io/en/stable/releasenotes/9.3.0.html#decode-jpeg-compressed-blp1-data-in-original-mode

Crash type: Segv on unknown address
Crash state:
jpeg_read_scanlines
ImagingJpegDecode
_decode

References

bugs.chromium.org/p/oss-fuzz/issues/detail · REPORT

More vulnerabilities in pillow

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free