HIGH 7.5

PYSEC-2026-3453

빠른 조치

PYSEC-2026-3453 — pillow: 아래 명령으로 수정 버전으로 올리세요.

pip install --upgrade 'pillow>=12.3.0'

상세

Pillow is a Python imaging library. Prior to 12.3.0, Pillow's ImageCms.ImageCmsTransform.apply(im, imOut) API can trigger controlled native heap corruption when the caller supplies an output image whose mode does not match the transform's declared output mode. This issue is fixed in version 12.3.0.

이 버전이 영향받나요?

사용 중인 패키지 버전을 입력하면 즉시 평가합니다.

영향 패키지

PyPI / pillow

최초 영향 버전: 0 수정 버전: 12.3.0

수정 pip install --upgrade 'pillow>=12.3.0'

참고

https://github.com/python-pillow/Pillow/releases/tag/12.3.0 [ADVISORY]
https://github.com/python-pillow/Pillow/commit/a9ffc42bedf4fc0a7ef8d6486e7f9e81e3397721 [FIX]
https://github.com/python-pillow/Pillow/pull/9715 [FIX]
https://github.com/python-pillow/Pillow/security/advisories/GHSA-9hw9-ch79-4vh6 [EVIDENCE]