python3-pillow: The python-pillow packages contain a Python image processing library that provides extensive file format support, an...
CVE-2019-16865 is fixed in 5 products on 1 platform, first by python-pil 5.1.0-1ubuntu0.2, released January 5, 2020. It is not reported as exploited. Patch Radar priority: High.
The python-pillow packages contain a Python image processing library that provides extensive file format support, an efficient internal representation, and powerful image-processing capabilities. Security Fix(es): * python-pillow: out-of-bounds write in expandrow in libImaging/SgiRleDecode.c (CVE-2020-5311) * python-pillow: improperly restricted operations on memory buffer in libImaging/PcxDecode.c (CVE-2020-5312) * python-pillow: reading specially crafted image files leads to allocation of large amounts of memory and denial of service (CVE-2019-16865) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Where it's fixed
| Product | Fixed in | Fix | Released |
|---|---|---|---|
| Linux | |||
| python-pil · Ubuntu 18.04.6 LTS (bionic) | 5.1.0-1ubuntu0.2 | python-pil 5.1.0-1ubuntu0.2 | Jan 5, 2020 |
| python-pil.imagetk · Ubuntu 18.04.6 LTS (bionic) | 5.1.0-1ubuntu0.2 | python-pil.imagetk 5.1.0-1ubuntu0.2 | Jan 5, 2020 |
| python3-pil · Ubuntu 18.04.6 LTS (bionic) | 5.1.0-1ubuntu0.2 | python3-pil 5.1.0-1ubuntu0.2 | Jan 5, 2020 |
| python3-pil.imagetk · Ubuntu 18.04.6 LTS (bionic) | 5.1.0-1ubuntu0.2 | python3-pil.imagetk 5.1.0-1ubuntu0.2 | Jan 5, 2020 |
| python3-pillow · RHEL 8 | 0:5.1.1-10.el8_1 | RHSA-2020:0580 | Feb 24, 2020 |
| python3-pillow · ol 8 | 0:5.1.1-10.el8_1 | ELSA-2020-0580 | Feb 25, 2020 |