{"id":"MGASA-2024-0244","aliases":[],"status":"published","title":"Updated python-imageio packages fix security vulnerability","description":"imageio can attempt to download shared freeimage libraries from\nhttps://github.com/imageio/imageio-binaries/tree/master/freeimage. The\ncode fetches straight from master and provides no way of verifying\nwhether the correct file was fetched. As a result, if the repository is\nattacked in the future, all prior versions of imageio would be silently\ndownloading arbitrary shared libraries and running them on user systems.\nThis is a serious problem.","facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"published":"2024-07-01T17:53:27Z","modified":"2026-04-16T04:21:00Z","fixes":[{"ecosystem":"Mageia:9","package":"python-imageio","fixed_in":["2.22.4-1.1.mga9"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Mageia:9","package":"python-imageio","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.22.4-1.1.mga9"}]}]}],"references":[{"url":"https://advisories.mageia.org/MGASA-2024-0244.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=31016","tags":["report"]}],"sources":{"osv":[{"id":"MGASA-2024-0244","title":"Updated python-imageio packages fix security vulnerability","description":"imageio can attempt to download shared freeimage libraries from\nhttps://github.com/imageio/imageio-binaries/tree/master/freeimage. The\ncode fetches straight from master and provides no way of verifying\nwhether the correct file was fetched. As a result, if the repository is\nattacked in the future, all prior versions of imageio would be silently\ndownloading arbitrary shared libraries and running them on user systems.\nThis is a serious problem.\n","status":"published","published":"2024-07-01T17:53:27Z","modified":"2026-04-16T04:21:00.537473Z","updated_at":"2026-11-02T15:49:42.684501Z"}]}}