MGASA-2022-0166

Advisory lineage Upstream: 4 Downstream: 0
Published: 12 May 2022, 10:24
Last modified:16 Apr 2026, 04:23

Vulnerability Summary

Overall Risk (default)
minimal
0/100
CVSS Score
No data
EPSS Score
No data
KEV
Not listed
Ransomware
No reports
Public exploits
None found
Dark Web
Not detected

Timeline

12 May 2022, 10:24
Published
Vulnerability first disclosed
16 Apr 2026, 04:23
Last Modified
Vulnerability information updated

Description

Updated python-pillow packages fix security vulnerability path_getbbox in path.c in Pillow before 9.0.0 improperly initializes ImagePath.Path. (CVE-2022-22815) path_getbbox in path.c in Pillow before 9.0.0 has a buffer over-read during initialization of ImagePath.Path. (CVE-2022-22816) PIL.ImageMath.eval in Pillow before 9.0.0 allows evaluation of arbitrary expressions (CVE-2022-22817) Pillow before 9.0.1 allows attackers to delete files because spaces in temporary pathnames are mishandled. (CVE-2022-24303)

Affected Systems

  • mageia•python-pillow

    < 9.1.0-1.mga8

References (6)