CVE-2019-16865

python3-pillow: The python-pillow packages contain a Python image processing library that provides extensive file format support, an...

CVE-2019-16865 is fixed in 5 products on 1 platform, first by python-pil 5.1.0-1ubuntu0.2, released January 5, 2020. It is not reported as exploited. Patch Radar priority: High.

High
CVSS
7.5
Important
Exploitation
None reported
No vendor assessment
CISA KEV
Not listed
Not in the Known Exploited Vulnerabilities catalog
EPSS
0.0313
87th percentile

The python-pillow packages contain a Python image processing library that provides extensive file format support, an efficient internal representation, and powerful image-processing capabilities. Security Fix(es): * python-pillow: out-of-bounds write in expandrow in libImaging/SgiRleDecode.c (CVE-2020-5311) * python-pillow: improperly restricted operations on memory buffer in libImaging/PcxDecode.c (CVE-2020-5312) * python-pillow: reading specially crafted image files leads to allocation of large amounts of memory and denial of service (CVE-2019-16865) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Where it's fixed

ProductFixed inFixReleased
Linux
python-pil · Ubuntu 18.04.6 LTS (bionic) 5.1.0-1ubuntu0.2 python-pil 5.1.0-1ubuntu0.2 Jan 5, 2020
python-pil.imagetk · Ubuntu 18.04.6 LTS (bionic) 5.1.0-1ubuntu0.2 python-pil.imagetk 5.1.0-1ubuntu0.2 Jan 5, 2020
python3-pil · Ubuntu 18.04.6 LTS (bionic) 5.1.0-1ubuntu0.2 python3-pil 5.1.0-1ubuntu0.2 Jan 5, 2020
python3-pil.imagetk · Ubuntu 18.04.6 LTS (bionic) 5.1.0-1ubuntu0.2 python3-pil.imagetk 5.1.0-1ubuntu0.2 Jan 5, 2020
python3-pillow · RHEL 8 0:5.1.1-10.el8_1 RHSA-2020:0580 Feb 24, 2020
python3-pillow · ol 8 0:5.1.1-10.el8_1 ELSA-2020-0580 Feb 25, 2020