Uncontrolled Resource Consumption in Pillow
High severity
GitHub Reviewed
Published
Apr 1, 2020
to the GitHub Advisory Database
•
Updated Feb 2, 2023
Description
Published by the National Vulnerability Database
Jan 5, 2020
Reviewed
Apr 1, 2020
Published to the GitHub Advisory Database
Apr 1, 2020
Last updated
Feb 2, 2023
There is a DoS vulnerability in Pillow before 6.2.2 caused by FpxImagePlugin.py calling the range function on an unvalidated 32-bit integer if the number of bands is large. On Windows running 32-bit Python, this results in an OverflowError or MemoryError due to the 2 GB limit. However, on Linux running 64-bit Python this results in the process being terminated by the OOM killer.
References