An issue was discovered in Pillow before 10.0.0. It is a Denial of Service that uncontrollably allocates memory to process a given task, potentially causing a service to crash by having it run out of memory. This occurs for truetype in ImageFont when textlength in an ImageDraw instance operates on a long text argument.
CVSS Details
- CVSS 3.1 Base Score: 7.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade python3-pillow-develUpgrade python3-pillow-tkUpgrade python3-pillowUpgrade python3-pillow-doc | May 31, 2024 | Nov 3, 2023 |
| Amazon Linux Ami 2 | — | Upgrade python-pillow-docUpgrade python-pillow-tkUpgrade python-pillow-debuginfoUpgrade python-pillowUpgrade python-pillow-develUpgrade python-pillow-sane | Apr 2, 2024 | Nov 3, 2023 |
| Amazon_linux_2023 | — | Upgrade python3-pillow-tkUpgrade python3-pillowUpgrade python-pillow-debugsourceUpgrade python-pillow-debuginfoUpgrade python3-pillow-debuginfoUpgrade python3-pillow-tk-debuginfoUpgrade python3-pillow-devel | Feb 17, 2025 | Jun 30, 2023 |
| Centos_linux | — | Upgrade python-pillow-qtUpgrade python-pillow-develUpgrade python-pillowUpgrade python-pillow-saneUpgrade python-pillow-tkUpgrade python-pillow-debuginfoUpgrade python-pillow-doc | Jan 25, 2024 | Nov 3, 2023 |
| Debian | — | Upgrade pillow | Mar 25, 2024 | Nov 3, 2023 |
| Gentoo Linux | — | Upgrade dev-python/pillow. | May 6, 2024 | Nov 3, 2023 |
| Huawei Euleros 2_0_sp10 | — | Upgrade python3-pillow | Jan 10, 2024 | Nov 3, 2023 |
| Huawei Euleros 2_0_sp11 | — | Upgrade python3-pillow | Jan 29, 2024 | Nov 3, 2023 |
| Oracle_linux | — | Upgrade python3-pillow-docUpgrade python-pillow-docUpgrade python3-pillowUpgrade python3-pillow-tkUpgrade python-pillow-develUpgrade python-pillowUpgrade python-pillow-saneUpgrade python-pillow-qtUpgrade python-pillow-tkUpgrade python3-pillow-devel | Jan 24, 2024 | Jun 30, 2023 |
| Redhat_linux | — | Upgrade python3-pillow-tk-debuginfoUpgrade python3-pillow-tkUpgrade python-pillow-tkUpgrade python-pillow-develUpgrade python3-pillow-develUpgrade python-pillow-debugsourceUpgrade python-pillow-qtUpgrade python-pillow-saneUpgrade python-pillow-docUpgrade python3-pillowUpgrade python3-pillow-debuginfoUpgrade python-pillow-debuginfoUpgrade python3-pillow-docUpgrade python-pillow | Jan 29, 2024 | Nov 3, 2023 |
| Rocky_linux | — | Upgrade python3-pillow-develUpgrade python3-pillow-debuginfoUpgrade python3-pillowUpgrade python3-pillow-tk-debuginfoUpgrade python-pillow-debuginfoUpgrade python-pillow-debugsourceUpgrade python3-pillow-tk | Jun 17, 2024 | Nov 3, 2023 |
| Suse | — | Upgrade python311-PillowUpgrade python311-Pillow-tkUpgrade python3-pillowUpgrade python3-pillow-tk | Nov 17, 2023 | Nov 3, 2023 |
| Ubuntu | — | Upgrade python3-pilUpgrade python3-pil (Ubuntu Pro)Upgrade python-pil (Ubuntu Pro) | Jan 31, 2024 | Nov 3, 2023 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub