Out-of-bounds read In pillow
Description
Uncontrolled Resource Consumption in Pillow There is a DoS vulnerability in Pillow before 6.2.2 caused by FpxImagePlugin.py calling the range function on an unvalidated 32-bit integer if the number of bands is large. On Windows running 32-bit Python, this results in an OverflowError or MemoryError due to the 2 GB limit. However, on Linux running 64-bit Python this results in the process being terminated by the OOM killer.
Mitigation
Update Impact
Minimal update. May introduce new vulnerabilities or breaking changes.
Ecosystem | Package | Affected version | Patched versions |
|---|---|---|---|
 debian 13 | 7.0.0-1 | ||
 alpine v3.13 | 6.2.2-r0 | ||
alpine v3.14 | 6.2.2-r0 | ||
alpine v3.15 | 6.2.2-r0 | ||
debian 11 | 7.0.0-1 | ||
debian 12 | 7.0.0-1 | ||
debian 14 | 7.0.0-1 | ||
 pypi | 6.2.2 | ||
alpine v3.12 | 6.2.2-r0 | ||
 rpm rhel5 | - | - |
1-10 of 11
10
Aliases
1. 2. 3. 4. 5. 6. 7. 8. 9.
References
1. 2. 3. 4. 5. 6. 7.