There is a DoS vulnerability in Pillow before 6.2.2 caused by FpxImagePlugin.py calling the range function on an unvalidated 32-bit integer if the number of bands is large. On Windows running 32-bit Python, this results in an OverflowError or MemoryError due to the 2 GB limit. However, on Linux running 64-bit Python this results in the process being terminated by the OOM killer.
CVSS Details
- CVSS 3.1 Base Score: 7.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | — | Upgrade py3-pillow | Aug 22, 2024 | Jan 5, 2020 |
| Debian | — | Upgrade pillow | Jan 8, 2020 | Jan 5, 2020 |
| Freebsd | — | Upgrade py38-pillowUpgrade py27-pillowUpgrade py35-pillowUpgrade py36-pillowUpgrade py37-pillow | Jan 25, 2020 | Jan 24, 2020 |
| Huawei Euleros 2_0_sp8 | — | Upgrade python2-pillowUpgrade python3-pillow | Aug 31, 2020 | Jan 5, 2020 |
| Huawei Euleros 2_0_sp9 | — | Upgrade python3-pillowUpgrade python-pillow | Feb 8, 2021 | Jan 5, 2020 |
| Oracle Solaris | — | Upgrade library/python/pillow to version 7.0.0-11.4.19.0.1.2.0 on Solaris 11.4Upgrade library/python/pillow-37 to version 7.0.0-11.4.19.0.1.2.0 on Solaris 11.4Upgrade library/python/pillow-27 to version 5.1.0-11.4.19.0.1.2.0 on Solaris 11.4Upgrade library/python/pillow-34 to version 5.1.0-11.4.19.0.1.2.0 on Solaris 11.4Upgrade library/python/pillow-35 to version 7.0.0-11.4.19.0.1.2.0 on Solaris 11.4 | Jan 19, 2021 | Jan 5, 2020 |
| Redhat_linux | — | No solution exists | Jul 9, 2025 | Jan 5, 2020 |
| Ubuntu | — | Upgrade python3-pilUpgrade python-imagingUpgrade python3-pil (Ubuntu Pro)Upgrade python-pilUpgrade python-imaging (Ubuntu Pro)Upgrade python3-imaging (Ubuntu Pro)Upgrade python-pil (Ubuntu Pro) | Feb 7, 2020 | Jan 5, 2020 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub