PT-2019-20130 · Python Imaging Library · Pillow

Published 2019-10-04 · Updated 2019-10-04

Positive Technologies (AI Summary)

Name of the Vulnerable Software and Affected Versions Pillow versions prior to 6.2.0

Description An issue was discovered in the library when reading specially crafted invalid image files. This can cause the library to either allocate very large amounts of memory or take an extremely long period of time to process the image.

Recommendations For versions prior to 6.2.0, update to version 6.2.0 or later to resolve the issue.

Related Identifiers

PYSEC-2019-40

Affected Products

Pillow

References · 12

• https://lists.fedoraproject.org/archives/list/[e-mail]/message/LYDXD7EE4YAEVSTNIFZKNVPRVJX5ZOG3 · Vendor Advisory
• https://debian.org/security/2020/dsa-4631 · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/[e-mail]/message/EMJBUZQGQ2Q7HXYCQVRLU7OXNC7CAWWU · Vendor Advisory
• https://osv.dev/vulnerability/PYSEC-2019-40 · Vendor Advisory
• https://access.redhat.com/errata/RHSA-2020:0578 · Note
• https://usn.ubuntu.com/4272-1 · Note
• https://access.redhat.com/errata/RHSA-2020:0681 · Note
• https://access.redhat.com/errata/RHSA-2020:0683 · Note
• https://pillow.readthedocs.io/en/latest/releasenotes/6.2.0.html · Note
• https://access.redhat.com/errata/RHSA-2020:0580 · Note
• https://access.redhat.com/errata/RHSA-2020:0566 · Note
• https://access.redhat.com/errata/RHSA-2020:0694 · Note