~ / search / GHSA-5gm3-px64-rw72

GHSA-5gm3-px64-rw72

Uncontrolled Resource Consumption in Pillow

Source: GitHub Advisory Database (reviewed) High CVE-2019-19911

Packages

EcosystemPackageAffectedFixed in
PyPI pillow < 6.2.2 6.2.2

Details

As written in the advisory (Markdown source, shown as plain text).

There is a DoS vulnerability in Pillow before 6.2.2 caused by FpxImagePlugin.py calling the range function on an unvalidated 32-bit integer if the number of bands is large. On Windows running 32-bit Python, this results in an OverflowError or MemoryError due to the 2 GB limit. However, on Linux running 64-bit Python this results in the process being terminated by the OOM killer.

References

External links from the advisory. They lead to third-party sites.