An issue was discovered in Pillow before 10.0.0. It is a Denial of Service that uncontrollably allocates memory to process a given task, potentially causing a service to crash by having it run out of memory. This occurs for truetype in ImageFont when textlength in an ImageDraw instance operates on a long text argument.
CVSS Details
- CVSS 3.1 Base Score: 7.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | alma-upgrade-python3-pillowalma-upgrade-python3-pillow-develalma-upgrade-python3-pillow-docalma-upgrade-python3-pillow-tk | May 31, 2024 | Nov 3, 2023 | |
| Amazon Linux Ami 2 | amazon-linux-ami-2-upgrade-python-pillowamazon-linux-ami-2-upgrade-python-pillow-debuginfoamazon-linux-ami-2-upgrade-python-pillow-develamazon-linux-ami-2-upgrade-python-pillow-docamazon-linux-ami-2-upgrade-python-pillow-saneamazon-linux-ami-2-upgrade-python-pillow-tk | Apr 2, 2024 | Nov 3, 2023 | |
| Amazon_linux_2023 | amazon-linux-2023-upgrade-python3-pillowamazon-linux-2023-upgrade-python3-pillow-debuginfoamazon-linux-2023-upgrade-python3-pillow-develamazon-linux-2023-upgrade-python3-pillow-tkamazon-linux-2023-upgrade-python3-pillow-tk-debuginfoamazon-linux-2023-upgrade-python-pillow-debuginfoamazon-linux-2023-upgrade-python-pillow-debugsource | Feb 17, 2025 | Jun 30, 2023 | |
| Centos_linux | — | centos-upgrade-python-pillowcentos-upgrade-python-pillow-debuginfocentos-upgrade-python-pillow-develcentos-upgrade-python-pillow-doccentos-upgrade-python-pillow-qtcentos-upgrade-python-pillow-sanecentos-upgrade-python-pillow-tk | Jan 25, 2024 | Nov 3, 2023 |
| Debian | debian-upgrade-pillow | Mar 25, 2024 | Nov 3, 2023 | |
| Gentoo Linux | gentoo-linux-upgrade-dev-python-pillow | May 6, 2024 | Nov 3, 2023 | |
| Huawei Euleros 2_0_sp10 | huawei-euleros-2_0_sp10-upgrade-python3-pillow | Jan 10, 2024 | Nov 3, 2023 | |
| Huawei Euleros 2_0_sp11 | huawei-euleros-2_0_sp11-upgrade-python3-pillow | Jan 29, 2024 | Nov 3, 2023 | |
| Oracle_linux | — | oracle-linux-upgrade-python3-pilloworacle-linux-upgrade-python3-pillow-develoracle-linux-upgrade-python3-pillow-docoracle-linux-upgrade-python3-pillow-tkoracle-linux-upgrade-python-pilloworacle-linux-upgrade-python-pillow-develoracle-linux-upgrade-python-pillow-docoracle-linux-upgrade-python-pillow-qtoracle-linux-upgrade-python-pillow-saneoracle-linux-upgrade-python-pillow-tk | Jan 24, 2024 | Jun 30, 2023 |
| Redhat_linux | redhat-upgrade-python-pillowredhat-upgrade-python-pillow-debuginforedhat-upgrade-python-pillow-debugsourceredhat-upgrade-python-pillow-develredhat-upgrade-python-pillow-docredhat-upgrade-python-pillow-qtredhat-upgrade-python-pillow-saneredhat-upgrade-python-pillow-tkredhat-upgrade-python3-pillowredhat-upgrade-python3-pillow-debuginforedhat-upgrade-python3-pillow-develredhat-upgrade-python3-pillow-docredhat-upgrade-python3-pillow-tkredhat-upgrade-python3-pillow-tk-debuginfo | Jan 29, 2024 | Nov 3, 2023 | |
| Rocky_linux | rocky-upgrade-python-pillow-debuginforocky-upgrade-python-pillow-debugsourcerocky-upgrade-python3-pillowrocky-upgrade-python3-pillow-debuginforocky-upgrade-python3-pillow-develrocky-upgrade-python3-pillow-tkrocky-upgrade-python3-pillow-tk-debuginfo | Jun 17, 2024 | Nov 3, 2023 | |
| Suse | — | suse-upgrade-python3-pillowsuse-upgrade-python3-pillow-tksuse-upgrade-python311-pillowsuse-upgrade-python311-pillow-tk | Nov 17, 2023 | Nov 3, 2023 |
| Ubuntu | ubuntu-pro-upgrade-python-pilubuntu-pro-upgrade-python3-pilubuntu-upgrade-python3-pil | Jan 31, 2024 | Nov 3, 2023 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub