Mend.io Vulnerability Database

What is a CVE vulnerability ID? icon What is a WS vulnerability ID? icon What is an MSC vulnerability ID? icon
New vulnerability? Tell us about it!
icon

We found results for “”

CVE-2019-16865

Good to know:

icon
icon

Date: October 4, 2019

An issue was discovered in Pillow before 6.2.0. When reading specially crafted invalid image files, the library can either allocate very large amounts of memory or take an extremely long period of time to process the image.

Language: Python

Severity Score

Related Resources (23)

https://access.redhat.com/errata/RHSA-2020:0683
https://access.redhat.com/errata/RHSA-2020:0694
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/EMJBUZQGQ2Q7HXYCQVRLU7OXNC7CAWWU/
https://pillow.readthedocs.io/en/latest/releasenotes/6.2.0.html
https://access.redhat.com/errata/RHSA-2020:0580
https://access.redhat.com/security/cve/CVE-2019-16865
https://nvd.nist.gov/vuln/detail/CVE-2019-16865
https://access.redhat.com/errata/RHSA-2020:0681
https://github.com/python-pillow/Pillow
https://www.debian.org/security/2020/dsa-4631
https://access.redhat.com/errata/RHSA-2020:0566
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/LYDXD7EE4YAEVSTNIFZKNVPRVJX5ZOG3
https://access.redhat.com/errata/RHSA-2020:0578
https://usn.ubuntu.com/4272-1/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/EMJBUZQGQ2Q7HXYCQVRLU7OXNC7CAWWU
https://github.com/python-pillow/Pillow/commit/ab52630d0644e42a75eb88b78b9a9d7438a6fbeb
https://usn.ubuntu.com/4272-1
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LYDXD7EE4YAEVSTNIFZKNVPRVJX5ZOG3/
https://ubuntu.com/security/notices/USN-4272-1
https://github.com/pypa/advisory-database/tree/main/vulns/pillow/PYSEC-2019-110.yaml
https://github.com/advisories/GHSA-j7mj-748x-7p78
https://github.com/python-pillow/Pillow/issues/4123
https://www.mend.io/vulnerability-database/CVE-2019-16865

Severity Score

Weakness Type (CWE)

Allocation of Resources Without Limits or Throttling

CWE-770

Top Fix

icon

Upgrade Version

Upgrade to version 6.2.0

Learn More

CVSS v3.1

Base Score:
Attack Vector (AV): NETWORK
Attack Complexity (AC): LOW
Privileges Required (PR): NONE
User Interaction (UI): NONE
Scope (S): UNCHANGED
Confidentiality (C): NONE
Integrity (I): NONE
Availability (A): HIGH

CVSS v2

Base Score:
Access Vector (AV): NETWORK
Access Complexity (AC): LOW
Authentication (AU): NONE
Confidentiality (C): NONE
Integrity (I): NONE
Availability (A): PARTIAL
Additional information:

Do you need more information?

Contact Us