CVE-2019-19911: Integer Overflow
A denial of service vulnerability was found in Pillow in versions before 6.2.2, where the FpxImagePlugin.py file calls the range function on an unvalidated 32-bit integer if the number of bands is large. On Windows systems running 32-bit Python, this flaw results in an OverflowError or MemoryError due to the 2 GB limit. On Linux systems running 64-bit Python, this flaw results in the termination of the process by the out-of-memory (OOM) killer. The highest threat from this vulnerability is to system availability.
Other sources
There is a DoS vulnerability in Pillow before 6.2.2 caused by FpxImagePlugin.py calling the range function on an unvalidated 32-bit integer if the number of bands is large. On Windows running 32-bit Python, this results in an OverflowError or MemoryError due to the 2 GB limit. However, on Linux running 64-bit Python this results in the process being terminated by the OOM killer.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
redhat/python-pillowto a version that resolves this vulnerability.Fixed in 6.2.2 - Upgrade
Upgrade
pip/pillowto a version that resolves this vulnerability.Fixed in 6.2.2 - Upgrade
Upgrade
debian/pillowto a version that resolves this vulnerability.Fixed in 8.1.2+dfsg-0.3+deb11u2Fixed in 8.1.2+dfsg-0.3+deb11u3Fixed in 9.4.0-1.1+deb12u1Fixed in 11.1.0-5+deb13u4Fixed in 11.1.0-5+deb13u3Fixed in 12.2.0-1Fixed in 12.3.0-1 - Upgrade
Upgrade
Pillow/FpxImagePlugin.pyto a version that resolves this vulnerability.Fixed in 6.2.2
Event History
Frequently Asked Questions
What is the vulnerability ID?
The vulnerability ID is CVE-2019-19911.
What is the severity of CVE-2019-19911?
CVE-2019-19911 has a severity value of 7.5, which is considered high.
Which software versions are affected by CVE-2019-19911?
CVE-2019-19911 affects versions of Pillow before 6.2.2.
How can I fix CVE-2019-19911?
To fix CVE-2019-19911, you should update Pillow to version 6.2.2 or later.
Where can I find more information about CVE-2019-19911?
You can find more information about CVE-2019-19911 at the following references: [CVE-2019-19911](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-19911), [Pillow Release Notes](https://pillow.readthedocs.io/en/stable/releasenotes/6.2.2.html), [Ubuntu Security Notice](https://ubuntu.com/security/notices/USN-4272-1).