CVE-2019-16865

Description

An issue was discovered in Pillow before 6.2.0. When reading specially crafted invalid image files, the library can either allocate very large amounts of memory or take an extremely long period of time to process the image.

References

https://www.debian.org/security/2020/dsa-4631

https://usn.ubuntu.com/4272-1/

https://pillow.readthedocs.io/en/latest/releasenotes/6.2.0.html

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LYDXD7EE4YAEVSTNIFZKNVPRVJX5ZOG3/

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/EMJBUZQGQ2Q7HXYCQVRLU7OXNC7CAWWU/

https://access.redhat.com/errata/RHSA-2020:0694

https://access.redhat.com/errata/RHSA-2020:0683

https://access.redhat.com/errata/RHSA-2020:0681

https://access.redhat.com/errata/RHSA-2020:0580

https://access.redhat.com/errata/RHSA-2020:0578

https://access.redhat.com/errata/RHSA-2020:0566

Details

Source: Mitre, NVD

Risk Information

CVSS v2

CVSS v3