DEBIAN-CVE-2023-50447

DEBIAN-CVE-2023-50447 PUBLISHED CVSS 8.100000381469727 HIGH

Pillow through 10.1.0 allows PIL.ImageMath.eval Arbitrary Code Execution via the environment parameter, a different vulnerability than CVE-2022-22817 (which was about the expression parameter).

Risk Scores

CVSS 3.1

8.100000381469727

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Affected Products

Vendor	Product	Versions
Debian:13	pillow	0, 0, 0
Debian:14	pillow	0, 0, 0
Debian:11	pillow	8.1.2+dfsg-0.3+deb11u1, 8.1.2+dfsg-0.3+deb11u1, 0
Debian:12	pillow	0, 9.4.0-1.1, 9.4.0-1.1

Timeline

Jan 19, 2024 CVE Published
Apr 28, 2026 CVE Updated

References

https://security-tracker.debian.org/tracker/CVE-2023-50447 advisory

Open in Interactive Console →