PT-2020-5160 · Python Imaging Library+1 · Pillow+1

Published

2020-01-05

·

Updated

2023-02-01

·

CVE-2019-19911

CVSS v4.0

8.7

High

VectorAV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
Name of the Vulnerable Software and Affected Versions Pillow versions prior to 6.2.2
Description The issue is caused by the FpxImagePlugin.py file calling the range function on an unvalidated 32-bit integer, which can lead to a denial of service (DoS) if the number of bands is large. On Windows running 32-bit Python, this results in an OverflowError or MemoryError due to the 2 GB limit. On Linux running 64-bit Python, the process is terminated by the OOM killer. The vulnerability can be exploited by a remote attacker to cause a denial of service.
Recommendations For Pillow versions prior to 6.2.2, update to version 6.2.2 or later to resolve the issue. As a temporary workaround, consider disabling the FpxImagePlugin.py file until a patch is available. Restrict access to the FpxImagePlugin.py module to minimize the risk of exploitation. Avoid using the range function with unvalidated integers in the affected API endpoint until the issue is resolved.

Fix

DoS

Integer Overflow

Resource Exhaustion

Weakness Enumeration

Related Identifiers

BDU:2020-05771
CVE-2019-19911
DLA-2057-1
DSA-4631-1
GHSA-5GM3-PX64-RW72
MGASA-2020-0088
PYSEC-2020-172
SUSE-RU-2020:2072-1
SUSE-RU-2020:2161-1
SUSE-SU-2020:1901-1
SUSE-SU-2020:2057-1
USN-4272-1

Affected Products

Pillow
Ubuntu