Pillow before 2.7.0 allows remote attackers to cause a denial of service via a compressed text chunk in a PNG image that has a large size when it is decompressed.
CVSS Details
- CVSS 3.1 Base Score: 6.2
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | — | Upgrade py-pillow | Aug 30, 2017 | Jan 16, 2015 |
| Amazon Linux Ami 2 | — | Upgrade python-pillow-debuginfoUpgrade python-pillow-tkUpgrade python-pillow-develUpgrade python-pillowUpgrade python-pillow-saneUpgrade python-pillow-doc | Jun 8, 2023 | Jan 16, 2015 |
| Debian | — | Upgrade pillow | Jul 30, 2024 | Jan 16, 2015 |
| Huawei Euleros 2_0_sp2 | — | Upgrade python-pillow | Dec 4, 2019 | Jan 16, 2015 |
| Huawei Euleros 2_0_sp3 | — | Upgrade python-pillow | Dec 18, 2019 | Jan 16, 2015 |
| Huawei Euleros 2_0_sp5 | — | Upgrade python-pillow | Mar 24, 2021 | Jan 16, 2015 |
| Oracle Solaris | — | Upgrade library/python-2/python-imaging-27 to version 1.1.7-0.175.2.13.0.3.0 on Solaris 11.2Upgrade library/python-2/python-imaging-26 to version 1.1.7-0.175.2.13.0.3.0 on Solaris 11.2Upgrade library/python-2/python-imaging to version 1.1.7-0.175.2.13.0.3.0 on Solaris 11.2 | May 29, 2017 | Jan 16, 2015 |
| Redhat_linux | — | No solution exists | Jul 9, 2025 | Dec 31, 2014 |
| Suse | — | Upgrade python-Pillow-debugsourceUpgrade python-Pillow-tk-debuginfoUpgrade python-PillowUpgrade python-Pillow-debuginfoUpgrade python-Pillow-tk | Dec 18, 2015 | Jan 16, 2015 |
| Ubuntu | — | Upgrade python-pilUpgrade python-imagingUpgrade python3-pilUpgrade python3-imaging | Sep 27, 2016 | Jan 16, 2015 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub