CVE-2019-19911
mediumPriorität · verfolgen · 31EPSS 0.022 · 83. PerzentilEURUUSEPSS · bewertet 2026-10-27
There is a DoS vulnerability in Pillow before 6.2.2 caused by FpxImagePlugin.py calling the range function on an unvalidated 32-bit integer if the number of bands is large. On Windows running 32-bit Python, this results in an OverflowError or MemoryError due to the 2 GB limit. However, on Linux running 64-bit Python this results in the process being terminated by the OOM killer.
cvss
Technischer Schweregrad, 0–10. Eine Zeile je Quelle.
Basiswert 0–10 · höher = schwerwiegender · Vektor überfahren zum Auflösen⚠ Quellen uneinig · medium–high · 5–7.5
schwächen
Die CWE-Schwächeklassen, zu denen dies gehört.
betroffene Produkte (23)
Betroffene Produkte und Versionsbereiche.
Advisories (2)
Hersteller- und Ökosystem-Meldungen dazu.
- GHSA-5gm3-px64-rw72Uncontrolled Resource Consumption in Pillow2020-04-01ghsa · osvUS
There is a DoS vulnerability in Pillow before 6.2.2 caused by FpxImagePlugin.py calling the range function on an unvalidated 32-bit integer if the number of bands is large. On Windows running 32-bit Python, this results in an OverflowError or MemoryError due to the 2 GB limit. However, on Linux running 64-bit Python this results in the process being terminated by the OOM killer.
- PYSEC-2020-1722020-01-05vendor · osvUS
There is a DoS vulnerability in Pillow before 6.2.2 caused by FpxImagePlugin.py calling the range function on an unvalidated 32-bit integer if the number of bands is large. On Windows running 32-bit Python, this results in an OverflowError or MemoryError due to the 2 GB limit. However, on Linux running 64-bit Python this results in the process being terminated by the OOM killer.
auch bekannt als (7)
Weitere Namen und Kennungen dieser Entität.
quellen
Welche Quellen diesen Datensatz belegen und wann.
Referenzen (21)
Externe Belege — Patches, Meldungen, Analysen.
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/3DUMIBUYGJRAVJCTFUWBRLVQKOUTVX5P/cnnvd
- https://nvd.nist.gov/vuln/detail/CVE-2019-19911cnnvd
- https://packetstormsecurity.com/files/161286/Red-Hat-Security-Advisory-2021-0420-01.htmlcnnvd
- https://pillow.readthedocs.io/en/stable/releasenotes/6.2.2.htmlcnnvd
- https://usn.ubuntu.com/4272-1/cnnvd
- https://vigilance.fr/vulnerability/Pillow-denial-of-service-via-FpxImagePlugin-py-31260cnnvd
- https://www.auscert.org.au/bulletins/ESB-2020.0051/cnnvd
- https://www.auscert.org.au/bulletins/ESB-2020.0448/cnnvd
Angreifer nutzen Schwachstellen wie diese gegen im Internet exponierte Dienste aus. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.
Kostenloser Scan