PYSEC-2019-110
At a glance
- Published
- Updated
- CVE
- CVE-2019-16865
- Aliases
- GHSA-j7mj-748x-7p78
Description
An issue was discovered in Pillow before 6.2.0. When reading specially crafted invalid image files, the library can either allocate very large amounts of memory or take an extremely long period of time to process the image.
Affected packages
| Package | Versions |
|---|---|
| PyPI · pillow | introduced 0, fixed 6.2.0 |
References
- https://pillow.readthedocs.io/en/latest/releasenotes/6.2.0.html WEB
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/LYDXD7EE4YAEVSTNIFZKNVPRVJX5ZOG3/ WEB
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/EMJBUZQGQ2Q7HXYCQVRLU7OXNC7CAWWU/ WEB
- https://usn.ubuntu.com/4272-1/ WEB
- https://access.redhat.com/errata/RHSA-2020:0566 ADVISORY
- https://www.debian.org/security/2020/dsa-4631 ADVISORY
- https://access.redhat.com/errata/RHSA-2020:0580 ADVISORY
- https://access.redhat.com/errata/RHSA-2020:0578 ADVISORY
- https://access.redhat.com/errata/RHSA-2020:0683 ADVISORY
- https://access.redhat.com/errata/RHSA-2020:0681 ADVISORY
- https://access.redhat.com/errata/RHSA-2020:0694 ADVISORY
- https://github.com/advisories/GHSA-j7mj-748x-7p78 ADVISORY
Sources
| Source | Licence |
|---|---|
| OSV.dev | CC-BY 4.0 — PyPA Advisory Database |