Repository navigation
[GHSA-xvh5-g6gv-559v] Pillow: Memory disclosure and segfault in libtiff encoder via crafted TIFF tags - #10902
Conversation
|
Hi there @radarhere! A community member has suggested an improvement to your security advisory. If approved, this change will affect the global advisory listed at github.com/advisories. It will not affect the version listed in your project repository. This change will be reviewed by our Security Curation Team. If you have thoughts or feedback, please share them in a comment here! If this PR has already been closed, you can start a new community contribution for this advisory |
| ], | ||
| "database_specific": { | ||
| "last_known_affected_version_range": "<= 12.3.0" | ||
| "last_known_affected_version_range": "<= 5.4.0" |
There was a problem hiding this comment.
Your comment would mean that 5.4.0 - 12.3.0 is vulnerable. >= 5.4.0, <= 12.3.0. Not < 5.4.0?
There was a problem hiding this comment.
You are right, sorry, I'll close this one and open a new PR.
There was a problem hiding this comment.
🟡 Changes recommended
The version-range edit lowers the upper bound instead of setting the introduction boundary, excluding previously recorded affected releases such as 12.3.0 while still including earlier versions.
1 open issue
What changed in this PR
This PR updates the advisory database entry for Pillow’s TIFF encoder vulnerability, aiming to refine the affected releases based on a proposed introduction in version 5.4.0.
Changes:
- Changes
last_known_affected_version_rangefrom<= 12.3.0to<= 5.4.0.
| File | Description |
|---|---|
| advisories/github-reviewed/2026/10/GHSA-xvh5-g6gv-559v/GHSA-xvh5-g6gv-559v.json | Updates the advisory’s last-known affected-version bound. |
Review effort: Max (auto)
| ], | ||
| "database_specific": { | ||
| "last_known_affected_version_range": "<= 12.3.0" | ||
| "last_known_affected_version_range": "<= 5.4.0" |
Updates
Comments
If I'm not mistaken, the handling of custom TIFF tags was added in commit python-pillow/Pillow@a3d45e9 and released in 5.4.0 so versions older than 5.4.0 should not be vulnerable.