CVE-2019-16865 DOS attack in Pillow when processing specially crafted image files
HighCVSS 7.5
EPSS 3.1%
- Published
- Updated
- Exploit status
- No public exploit known
Description
An issue was discovered in Pillow before 6.2.0. When reading specially crafted invalid image files, the library can either allocate very large amounts of memory or take an extremely long period of time to process the image.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| pypi pillow(PyPI) | < 6.2.0 | 6.2.0 |
| pypi pillow(PyPI) | = 1.0 | No fix listed |
| pypi pillow(PyPI) | = 1.1 | No fix listed |
| pypi pillow(PyPI) | = 1.2 | No fix listed |
| pypi pillow(PyPI) | = 1.3 | No fix listed |
| pypi pillow(PyPI) | = 1.4 | No fix listed |
| pypi pillow(PyPI) | = 1.5 | No fix listed |
| pypi pillow(PyPI) | = 1.6 | No fix listed |
| pypi pillow(PyPI) | = 1.7.0 | No fix listed |
| pypi pillow(PyPI) | = 1.7.1 | No fix listed |
| pypi pillow(PyPI) | = 1.7.2 | No fix listed |
| pypi pillow(PyPI) | = 1.7.3 | No fix listed |
| pypi pillow(PyPI) | = 1.7.4 | No fix listed |
| pypi pillow(PyPI) | = 1.7.5 | No fix listed |
| pypi pillow(PyPI) | = 1.7.6 | No fix listed |
| pypi pillow(PyPI) | = 1.7.7 | No fix listed |
| pypi pillow(PyPI) | = 1.7.8 | No fix listed |
| pypi pillow(PyPI) | = 2.0.0 | No fix listed |
| pypi pillow(PyPI) | = 2.1.0 | No fix listed |
| pypi pillow(PyPI) | = 2.2.0 | No fix listed |
| pypi pillow(PyPI) | = 2.2.1 | No fix listed |
| pypi pillow(PyPI) | = 2.2.2 | No fix listed |
| pypi pillow(PyPI) | = 2.3.0 | No fix listed |
| pypi pillow(PyPI) | = 2.3.1 | No fix listed |
| pypi pillow(PyPI) | = 2.3.2 | No fix listed |
Show 48 more
| Product | Affected versions | Fixed in |
|---|---|---|
| pypi pillow(PyPI) | = 2.4.0 | No fix listed |
| pypi pillow(PyPI) | = 2.5.0 | No fix listed |
| pypi pillow(PyPI) | = 2.5.1 | No fix listed |
| pypi pillow(PyPI) | = 2.5.2 | No fix listed |
| pypi pillow(PyPI) | = 2.5.3 | No fix listed |
| pypi pillow(PyPI) | = 2.6.0 | No fix listed |
| pypi pillow(PyPI) | = 2.6.1 | No fix listed |
| pypi pillow(PyPI) | = 2.6.2 | No fix listed |
| pypi pillow(PyPI) | = 2.7.0 | No fix listed |
| pypi pillow(PyPI) | = 2.8.0 | No fix listed |
| pypi pillow(PyPI) | = 2.8.1 | No fix listed |
| pypi pillow(PyPI) | = 2.8.2 | No fix listed |
| pypi pillow(PyPI) | = 2.9.0 | No fix listed |
| pypi pillow(PyPI) | = 3.0.0 | No fix listed |
| pypi pillow(PyPI) | = 3.1.0 | No fix listed |
| pypi pillow(PyPI) | = 3.1.0.rc1 | No fix listed |
| pypi pillow(PyPI) | = 3.1.0rc1 | No fix listed |
| pypi pillow(PyPI) | = 3.1.1 | No fix listed |
| pypi pillow(PyPI) | = 3.1.2 | No fix listed |
| pypi pillow(PyPI) | = 3.2.0 | No fix listed |
| pypi pillow(PyPI) | = 3.3.0 | No fix listed |
| pypi pillow(PyPI) | = 3.3.1 | No fix listed |
| pypi pillow(PyPI) | = 3.3.2 | No fix listed |
| pypi pillow(PyPI) | = 3.3.3 | No fix listed |
| pypi pillow(PyPI) | = 3.4.0 | No fix listed |
| pypi pillow(PyPI) | = 3.4.1 | No fix listed |
| pypi pillow(PyPI) | = 3.4.2 | No fix listed |
| pypi pillow(PyPI) | = 4.0.0 | No fix listed |
| pypi pillow(PyPI) | = 4.1.0 | No fix listed |
| pypi pillow(PyPI) | = 4.1.1 | No fix listed |
| pypi pillow(PyPI) | = 4.2.0 | No fix listed |
| pypi pillow(PyPI) | = 4.2.1 | No fix listed |
| pypi pillow(PyPI) | = 4.3.0 | No fix listed |
| pypi pillow(PyPI) | = 5.0.0 | No fix listed |
| pypi pillow(PyPI) | = 5.1.0 | No fix listed |
| pypi pillow(PyPI) | = 5.2.0 | No fix listed |
| pypi pillow(PyPI) | = 5.3.0 | No fix listed |
| pypi pillow(PyPI) | = 5.4.0 | No fix listed |
| pypi pillow(PyPI) | = 5.4.0.dev0 | No fix listed |
| pypi pillow(PyPI) | = 5.4.1 | No fix listed |
| pypi pillow(PyPI) | = 6.0.0 | No fix listed |
| pypi pillow(PyPI) | = 6.1.0 | No fix listed |
| debian/pillow(Debian:12) | < 6.2.0-1 | 6.2.0-1 |
| debian/pillow(Debian:13) | < 6.2.0-1 | 6.2.0-1 |
| debian/pillow(Debian:14) | < 6.2.0-1 | 6.2.0-1 |
| python pillow | < 6.2.0 | 6.2.0 |
| fedoraproject fedora | = 30 | No fix listed |
| fedoraproject fedora | = 31 | No fix listed |
References
- nvd.nist.gov third-party-advisory vendor-advisory
- github.com
- github.com patch
- DSA-4631 vendor-advisory
- USN-4272-1 vendor-advisory
- ubuntu.com
- pillow.readthedocs.io release-notes vendor-advisory
- lists.fedoraproject.org
- lists.fedoraproject.org
- github.com product
- github.com
- github.com vendor-advisory
- RHSA-2020:0694 vendor-advisory
- RHSA-2020:0683 vendor-advisory
- RHSA-2020:0681 vendor-advisory
- RHSA-2020:0580 vendor-advisory
- RHSA-2020:0578 vendor-advisory
- RHSA-2020:0566 vendor-advisory
- Debian Security Tracker CVE-2019-16865 vendor-advisory
- FEDORA-2019-19a161d540 vendor-advisory
- FEDORA-2019-e7c83bdf19 vendor-advisory