CVEvulnerability

CVE-2019-19911

7.5 HIGH Published 2020-01-05 Modified 2026-06-17 Official page ↗
Status
Modified
Published
2020-01-05
Last modified
2026-06-17
Assigner
[email protected]
CVSS 3.1 ([email protected])
7.5 HIGH — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CVSS 2.0 ([email protected])
5.0 MEDIUM — AV:N/AC:L/Au:N/C:N/I:N/A:P
Weaknesses
CWE-190

Description

There is a DoS vulnerability in Pillow before 6.2.2 caused by FpxImagePlugin.py calling the range function on an unvalidated 32-bit integer if the number of bands is large. On Windows running 32-bit Python, this results in an OverflowError or MemoryError due to the 2 GB limit. However, on Linux running 64-bit Python this results in the process being terminated by the OOM killer.

Affected configurations

• python pillow (< 6.2.2) • debian debian linux 9.0 • debian debian linux 10.0 • fedoraproject fedora 30 • canonical ubuntu linux 14.04 • canonical ubuntu linux 16.04 • canonical ubuntu linux 18.04 • canonical ubuntu linux 19.10

Related

Weakness · CWE (1)

  • CWE-190 Integer Overflow or Wraparound weakness

Referenced by CWE · observed example (7)

  • CWE-123 Write-what-where Condition weakness
  • CWE-1284 Improper Validation of Specified Quantity in Input weakness
  • CWE-190 Integer Overflow or Wraparound weakness
  • CWE-400 Uncontrolled Resource Consumption weakness
  • CWE-664 Improper Control of a Resource Through its Lifetime weakness
  • CWE-770 Allocation of Resources Without Limits or Throttling weakness
  • CWE-789 Memory Allocation with Excessive Size Value weakness

References