affected:
- package:
    ecosystem: PyPI
    name: pillow
    purl: pkg:pypi/pillow
  ranges:
  - events:
    - introduced: 9.1.0
    - fixed: 9.1.1
    type: ECOSYSTEM
  versions:
  - 9.1.0
aliases:
- CVE-2022-30595
- GHSA-hr8g-f6r6-mr22
details: libImaging/TgaRleDecode.c in Pillow 9.1.0 has a heap buffer overflow in the
  processing of invalid TGA image files.
id: PYSEC-2022-43145
modified: '2024-11-25T18:35:18.357593Z'
published: '2022-05-25T12:15:00Z'
references:
- type: WEB
  url: https://pillow.readthedocs.io/en/stable/releasenotes/9.1.1.html
- type: EVIDENCE
  url: https://github.com/python-pillow/Pillow/blob/main/src/libImaging/TgaRleDecode.c
- type: WEB
  url: https://github.com/python-pillow/Pillow/blob/main/src/libImaging/TgaRleDecode.c
severity:
- score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
  type: CVSS_V3