VDB

GCVE-110-MAGEIA-2022-166

GCVE-110-MAGEIA-2022-166
Advisory Published
Vulnetix · Advisory published May 12, 2022
path_getbbox in path.c in Pillow before 9.0.0 improperly initializes ImagePath.Path. (CVE-2022-22815) path_getbbox in path.c in Pillow before 9.0.0 has a buffer over-read during initialization of ImagePath.Path. (CVE-2022-22816) PIL.ImageMath.eval in Pillow before 9.0.0 allows evaluation of arbitrary expressions (CVE-2022-22817) Pillow before 9.0.1 allows attackers to delete files because spaces in temporary pathnames are mishandled. (CVE-2022-24303)
Download JSON Open in Console

Affected Products

VendorProductVersionsPlatforms
Mageiapython-pillow0 (affected), 9.1.0-1.mga8 (unaffected)—

Aliases

CVE-2022-24303

References

Updated python-pillow packages fix security vulnerability
advisory
Updated python-pillow packages fix security vulnerability
advisory
Updated python-pillow packages fix security vulnerability
advisory
Updated python-pillow packages fix security vulnerability
issue
Updated python-pillow packages fix security vulnerability
issue
Updated python-pillow packages fix security vulnerability
issue

Browse GCVE Records

73,118 records in the GCVE database · Updated July 16, 2026

No matching records found.

Explore Further

Investigate this vulnerability in the interactive console or download the raw GCVE record.

Open in Console Download JSON
$ Console Community · 100/wk Open console ›