onyx --cves cve-2022-22816
CVE-2022-22816
- score
- <0.1
- cvss
- 6.5
- epss
- 1.9%
- published
- 2022-01-10
- kev added
- —
- first seen
Pillow before 9.0.0 contains a buffer over-read in path_getbbox function in path.c during initialization of ImagePath.Path, letting attackers cause information disclosure or crash, exploit requires crafted image path data.
Timeline
How this CVE moved toward exploitation. Chart: last 30 days — trend score, EPSS, community mentions per day; hover the event lane.
- Published
- Tracked by Onyx
Weaknesses
References 5
- https://security.gentoo.org/glsa/202211-10
- https://www.debian.org/security/2022/dsa-5053
- https://pillow.readthedocs.io/en/stable/releasenotes/9.0.0.html#fixed-imagepath-path-array-handling
- https://github.com/python-pillow/Pillow/blob/c5d9223a8b5e9295d15b5a9b1ef1dae44c8499f3/src/path.c#L331
- https://lists.debian.org/debian-lts-announce/2022/01/msg00018.html