Description
PIL/IcnsImagePlugin.py in Python Imaging Library (PIL) and Pillow before 2.3.2 and 2.5.x before 2.5.2 allows remote attackers to cause a denial of service via a crafted block size.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | pillow | 2.5.3-1 | — |
| Debian 13 | pillow | 2.5.3-1 | — |
| Debian 12 | pillow | 2.5.3-1 | — |
| Debian 7 | python-imaging | 1.1.7-4+deb7u1 | DSA-3009-1 |
| Debian 6.0 | python-imaging | 1.1.7-2+deb6u1 | DLA-41-1 |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 14.04 LTS | pillow | 2.3.0-1ubuntu3.2 | USN-3090-1 |
SUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SUSE Enterprise Storage 1.0 | calamari-clients | 1.2.2+git.1428648634.40dfe5b-3.1 | SUSE-SU-2015:1102-1 |
| SUSE Enterprise Storage 1.0 | ceph | 0.80.9-5.1 | SUSE-SU-2015:1102-1 |
| SUSE Enterprise Storage 1.0 | ceph-deploy | 1.5.19+git.1431355031.6178cf3-9.1 | SUSE-SU-2015:1102-1 |
| SUSE Enterprise Storage 1.0 | python-Pillow | 2.7.0-4.1 | SUSE-SU-2015:1102-1 |
| SUSE Enterprise Storage 1.0 | python-djangorestframework | 2.3.12-4.2 | SUSE-SU-2015:1102-1 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | python-Pillow | 3.1.1-4.1 | openSUSE-SU-2026:11261-1, openSUSE-SU-2024:13827-1, openSUSE-SU-2024:11209-1 |
Amazon Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Amazon Linux 2 | python-pillow +4 | 2.0.0-23.gitd1c6db8.amzn2.0.14 | ALAS2-2025-2768 |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| PyPI | pillow | < 2.3.2 | 2.3.2 | GHSA-cfmr-38g9-f2h7 |
| PyPI | pillow | >= 2.5, < 2.5.2 | 2.5.2 | GHSA-cfmr-38g9-f2h7 |
| PyPI | pillow | < 2.3.2 · >= 2.5, < 2.5.2 | 2.3.2, 2.5.2 | PYSEC-2014-10 |
Advisories 11
- WID-SEC-2024-0426 Python: Mehrere Schwachstellen ermöglichen Denial of Service BSI CERT-Bund (WID) · Jul 14, 2026
- openSUSE-SU-2026:11261-1 python313-Pillow-12.3.0-1.1 on GA media SUSE / openSUSE Security Updates · Jul 13, 2026
- DLA-41-1 python-imaging - security update Debian Security (DSA / DLA) · Mar 9, 2026
- DSA-3009-1 python-imaging - security update Debian Security (DSA / DLA) · Mar 9, 2026
- USN-3090-1 Pillow vulnerabilities Ubuntu Security Notices (USN) · Feb 10, 2026
- openSUSE-SU-2024:13827-1 python310-Pillow-10.3.0-1.1 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
- openSUSE-SU-2024:10511-1 python3-Pillow-3.4.2-1.1 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
- openSUSE-SU-2024:11209-1 python36-Pillow-8.3.2-1.2 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
- openSUSE-SU-2024:10567-1 python-Pillow-3.1.1-4.1 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2015:1102-1 Security update for SES 1.0 SUSE / openSUSE Security Updates · May 2, 2025
- ALAS2-2025-2768 Moderate: python-pillow security update (Amazon Linux 2) Amazon Linux Security Center (ALAS) · Feb 25, 2025
References
- https://pypi.python.org/pypi/Pillow/2.5.2
- openSUSE-SU-2015:0798 vendor-advisory
- https://pypi.python.org/pypi/Pillow/2.3.2
- https://github.com/python-pillow/Pillow/commit/205e056f8f9b06ed7b925cf8aa0874bc4aaf8a7d
- DSA-3009 vendor-advisory
- 59825 third-party-advisory