PYSEC-2019-40
Withdrawn ·
At a glance
- Published
- Updated
Description
An issue was discovered in Pillow before 6.2.0. When reading specially crafted invalid image files, the library can either allocate very large amounts of memory or take an extremely long period of time to process the image.
Affected packages
| Package | Versions |
|---|---|
| PyPI · pillow | introduced 0, fixed 6.2.0 |
References
- https://pillow.readthedocs.io/en/latest/releasenotes/6.2.0.html WEB
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/LYDXD7EE4YAEVSTNIFZKNVPRVJX5ZOG3/ WEB
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/EMJBUZQGQ2Q7HXYCQVRLU7OXNC7CAWWU/ WEB
- https://usn.ubuntu.com/4272-1/ WEB
- https://access.redhat.com/errata/RHSA-2020:0566 WEB
- https://www.debian.org/security/2020/dsa-4631 WEB
- https://access.redhat.com/errata/RHSA-2020:0580 WEB
- https://access.redhat.com/errata/RHSA-2020:0578 WEB
- https://access.redhat.com/errata/RHSA-2020:0683 WEB
- https://access.redhat.com/errata/RHSA-2020:0681 WEB
- https://access.redhat.com/errata/RHSA-2020:0694 WEB
Sources
| Source | Licence |
|---|---|
| OSV.dev | CC-BY 4.0 — PyPA Advisory Database |