Summary
It was discovered that Pillow incorrectly handled certain images.
An attacker could possibly use this issue to cause a denial of service.
(CVE-2019-16865, CVE-2019-19911)
It was discovered that Pillow incorrectly handled certain images.
An attacker could possibly use this issue to execute arbitrary code.
(CVE-2020-5312)
It was discovered that Pillow incorrectly handled certain TIFF images.
An attacker could possibly use this issue to cause a crash. This issue
only affected Ubuntu 19.10. (CVE-2020-5310)
It was discovered that Pillow incorrectly handled certain SGI images.
An attacker could possibly use this issue to execute arbitrary code or
cause a crash. This issue only affected Ubuntu 18.04 and Ubuntu 19.10.
(CVE-2020-5311)
It was discovered that Pillow incorrectly handled certain PCX images.
An attackter could possibly use this issue to execute arbitrary code or
cause a crash. (CVE-2020-5312)
It was discovered that Pillow incorrectly handled certain Flip images.
An attacker could possibly use this issue to execute arbitrary code or
cause a crash. (CVE-2020-5313)
Fixed packages 3
| Release | Package | Fixed in |
|---|---|---|
| Ubuntu · 16.04 LTS 16.04:LTS | pillow | 3.1.2-0ubuntu1.3 |
| Ubuntu · 18.04 LTS 18.04:LTS | pillow | 5.1.0-1ubuntu0.2 |
| Ubuntu · Pro 14.04 LTS Pro:14.04:LTS | pillow | 2.3.0-1ubuntu3.4+esm1 |
Vulnerabilities 5
-
Critical 9.8
Buffer Copy without Checking Size of Input in Pillow
libImaging/SgiRleDecode.c in Pillow before 6.2.2 has an SGI buffer overflow.
-
Critical 9.8
PCX P mode buffer overflow in Pillow
libImaging/PcxDecode.c in Pillow before 6.2.2 has a PCX P mode buffer overflow.
-
High 7.5
DOS attack in Pillow when processing specially crafted image files
An issue was discovered in Pillow before 6.2.0. When reading specially crafted invalid image files, the library can either allocate very large amounts of memory or take an extremely long period of time to process the image.
-
High 7.5
Uncontrolled Resource Consumption in Pillow
There is a DoS vulnerability in Pillow before 6.2.2 caused by FpxImagePlugin.py calling the range function on an unvalidated 32-bit integer if the number of bands is large. On Windows running 32-bit Python, this results in an OverflowError or MemoryError due …
-
High 7.1
Out-of-bounds Read in Pillow
libImaging/FliDecode.c in Pillow before 6.2.2 has an FLI buffer overflow.