Description
Pillow before 2.7.0 allows remote attackers to cause a denial of service via a compressed text chunk in a PNG image that has a large size when it is decompressed.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | pillow | 2.6.1-2 | — |
| Debian 13 | pillow | 2.6.1-2 | — |
| Debian 12 | pillow | 2.6.1-2 | — |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 16.04 LTS | pillow | 3.1.2-0ubuntu1.1 | USN-3230-1 |
| Ubuntu 14.04 LTS | pillow | 2.3.0-1ubuntu3.4 | USN-3230-1, USN-3090-2, USN-3090-1 |
Amazon Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Amazon Linux 2 | python-pillow +4 | 2.0.0-23.gitd1c6db8.amzn2.0.4 | ALAS2-2023-2083 |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| PyPI | pillow | < 2.7.0 | 2.7.0 | GHSA-h5rf-vgqx-wjv2 |
Advisories 4
- USN-3230-1 pillow vulnerabilities Ubuntu Security Notices (USN) · Feb 10, 2026
- USN-3090-1 Pillow vulnerabilities Ubuntu Security Notices (USN) · Feb 10, 2026
- USN-3090-2 Pillow regression Ubuntu Security Notices (USN) · Feb 10, 2026
- ALAS2-2023-2083 Important: python-pillow security update (Amazon Linux 2) Amazon Linux Security Center (ALAS) · Jun 7, 2023
References
- openSUSE-SU-2015:0798 vendor-advisory
- https://www.djangoproject.com/weblog/2015/jan/02/pillow-security-release/
- FEDORA-2015-0667 vendor-advisory
- http://www.oracle.com/technetwork/topics/security/bulletinjul2015-2511963.html
- http://pillow.readthedocs.org/releasenotes/2.7.0.html
- 77758 vdb-entry
- https://github.com/python-pillow/Pillow/pull/1060