CVE-2019-16865

HIGH

Pillow < 6.2.0 - Denial of Service via Crafted Invalid Image Files

Title source: llm

Description

An issue was discovered in Pillow before 6.2.0. When reading specially crafted invalid image files, the library can either allocate very large amounts of memory or take an extremely long period of time to process the image.

References (11)

Core 11

Core References

Release Notes, Vendor Advisory x_refsource_misc

https://pillow.readthedocs.io/en/latest/releasenotes/6.2.0.html

Mailing List, Third Party Advisory vendor-advisory x_refsource_fedora

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LYDXD7EE4YAEVSTNIFZKNVPRVJX5ZOG3/

Mailing List, Third Party Advisory vendor-advisory x_refsource_fedora

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/EMJBUZQGQ2Q7HXYCQVRLU7OXNC7CAWWU/

Vendor Advisory vendor-advisory x_refsource_ubuntu

https://usn.ubuntu.com/4272-1/