Description
The Jpeg2KImagePlugin plugin in Pillow before 2.5.3 allows remote attackers to cause a denial of service via a crafted image.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | pillow | 2.5.3-1 | — |
| Debian 13 | pillow | 2.5.3-1 | — |
| Debian 12 | pillow | 2.5.3-1 | — |
SUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SUSE Enterprise Storage 1.0 | calamari-clients | 1.2.2+git.1428648634.40dfe5b-3.1 | SUSE-SU-2015:1102-1 |
| SUSE Enterprise Storage 1.0 | ceph | 0.80.9-5.1 | SUSE-SU-2015:1102-1 |
| SUSE Enterprise Storage 1.0 | ceph-deploy | 1.5.19+git.1431355031.6178cf3-9.1 | SUSE-SU-2015:1102-1 |
| SUSE Enterprise Storage 1.0 | python-Pillow | 2.7.0-4.1 | SUSE-SU-2015:1102-1 |
| SUSE Enterprise Storage 1.0 | python-djangorestframework | 2.3.12-4.2 | SUSE-SU-2015:1102-1 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | python-Pillow | 3.1.1-4.1 | openSUSE-SU-2026:11261-1, openSUSE-SU-2024:13827-1, openSUSE-SU-2024:11209-1 |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| PyPI | pillow | < 2.5.3 | 2.5.3 | GHSA-j6f7-g425-4gmx |
Advisories 6
- openSUSE-SU-2026:11261-1 python313-Pillow-12.3.0-1.1 on GA media SUSE / openSUSE Security Updates · Jul 13, 2026
- openSUSE-SU-2024:13827-1 python310-Pillow-10.3.0-1.1 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
- openSUSE-SU-2024:10511-1 python3-Pillow-3.4.2-1.1 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
- openSUSE-SU-2024:11209-1 python36-Pillow-8.3.2-1.2 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
- openSUSE-SU-2024:10567-1 python-Pillow-3.1.1-4.1 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2015:1102-1 Security update for SES 1.0 SUSE / openSUSE Security Updates · May 2, 2025
References
- openSUSE-SU-2015:0798 vendor-advisory
- https://pypi.python.org/pypi/Pillow/2.5.3