Skip to content
OpenAdvisories
Critical RHSA-2020:0578 2 CVEs

Red Hat Security Advisory: python-pillow security update

Published Sep 14, 2024 · Updated Jun 29, 2026

Ecosystem: Red Hat

Fixed packages 28

ReleasePackageFixed in
Red Hat · RHEL 7 enterprise_linux:7::client python-pillow 0:2.0.0-20.gitd1c6db8.el7_7
Red Hat · RHEL 7 enterprise_linux:7::client python-pillow-debuginfo 0:2.0.0-20.gitd1c6db8.el7_7
Red Hat · RHEL 7 enterprise_linux:7::client python-pillow-devel 0:2.0.0-20.gitd1c6db8.el7_7
Red Hat · RHEL 7 enterprise_linux:7::client python-pillow-doc 0:2.0.0-20.gitd1c6db8.el7_7
Red Hat · RHEL 7 enterprise_linux:7::client python-pillow-qt 0:2.0.0-20.gitd1c6db8.el7_7
Red Hat · RHEL 7 enterprise_linux:7::client python-pillow-sane 0:2.0.0-20.gitd1c6db8.el7_7
Red Hat · RHEL 7 enterprise_linux:7::client python-pillow-tk 0:2.0.0-20.gitd1c6db8.el7_7
Red Hat · RHEL 7 enterprise_linux:7::computenode python-pillow 0:2.0.0-20.gitd1c6db8.el7_7
Red Hat · RHEL 7 enterprise_linux:7::computenode python-pillow-debuginfo 0:2.0.0-20.gitd1c6db8.el7_7
Red Hat · RHEL 7 enterprise_linux:7::computenode python-pillow-devel 0:2.0.0-20.gitd1c6db8.el7_7
Red Hat · RHEL 7 enterprise_linux:7::computenode python-pillow-doc 0:2.0.0-20.gitd1c6db8.el7_7
Red Hat · RHEL 7 enterprise_linux:7::computenode python-pillow-qt 0:2.0.0-20.gitd1c6db8.el7_7
Red Hat · RHEL 7 enterprise_linux:7::computenode python-pillow-sane 0:2.0.0-20.gitd1c6db8.el7_7
Red Hat · RHEL 7 enterprise_linux:7::computenode python-pillow-tk 0:2.0.0-20.gitd1c6db8.el7_7
Red Hat · RHEL 7 enterprise_linux:7::server python-pillow 0:2.0.0-20.gitd1c6db8.el7_7
Red Hat · RHEL 7 enterprise_linux:7::server python-pillow-debuginfo 0:2.0.0-20.gitd1c6db8.el7_7
Red Hat · RHEL 7 enterprise_linux:7::server python-pillow-devel 0:2.0.0-20.gitd1c6db8.el7_7
Red Hat · RHEL 7 enterprise_linux:7::server python-pillow-doc 0:2.0.0-20.gitd1c6db8.el7_7
Red Hat · RHEL 7 enterprise_linux:7::server python-pillow-qt 0:2.0.0-20.gitd1c6db8.el7_7
Red Hat · RHEL 7 enterprise_linux:7::server python-pillow-sane 0:2.0.0-20.gitd1c6db8.el7_7
Red Hat · RHEL 7 enterprise_linux:7::server python-pillow-tk 0:2.0.0-20.gitd1c6db8.el7_7
Red Hat · RHEL 7 enterprise_linux:7::workstation python-pillow 0:2.0.0-20.gitd1c6db8.el7_7
Red Hat · RHEL 7 enterprise_linux:7::workstation python-pillow-debuginfo 0:2.0.0-20.gitd1c6db8.el7_7
Red Hat · RHEL 7 enterprise_linux:7::workstation python-pillow-devel 0:2.0.0-20.gitd1c6db8.el7_7
Red Hat · RHEL 7 enterprise_linux:7::workstation python-pillow-doc 0:2.0.0-20.gitd1c6db8.el7_7
Red Hat · RHEL 7 enterprise_linux:7::workstation python-pillow-qt 0:2.0.0-20.gitd1c6db8.el7_7
Red Hat · RHEL 7 enterprise_linux:7::workstation python-pillow-sane 0:2.0.0-20.gitd1c6db8.el7_7
Red Hat · RHEL 7 enterprise_linux:7::workstation python-pillow-tk 0:2.0.0-20.gitd1c6db8.el7_7

Vulnerabilities 2

  • Critical 9.8
    CVE-2020-5312

    PCX P mode buffer overflow in Pillow

    libImaging/PcxDecode.c in Pillow before 6.2.2 has a PCX P mode buffer overflow.

    pillow pillow pillow py3-pillow Debian Ubuntu Alpine PyPI
  • High 7.5
    CVE-2019-16865

    DOS attack in Pillow when processing specially crafted image files

    An issue was discovered in Pillow before 6.2.0. When reading specially crafted invalid image files, the library can either allocate very large amounts of memory or take an extremely long period of time to process the image.

    pillow pillow pillow Debian Ubuntu PyPI

References

  • article
    https://access.redhat.com/security/updates/classification/#important
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1774066
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1789533
  • advisory
    https://security.access.redhat.com/data/csaf/v2/advisories/2020/rhsa-2020_0578.json
  • report
    https://access.redhat.com/security/cve/CVE-2019-16865
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2019-16865
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2019-16865
  • report
    https://access.redhat.com/security/cve/CVE-2020-5312
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2020-5312
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2020-5312