CVE-2019-16865high
Description
An issue was discovered in Pillow before 6.2.0. When reading specially crafted invalid image files, the library can either allocate very large amounts of memory or take an extremely long period of time to process the image.
References
https://access.redhat.com/errata/RHSA-2020:0566
https://access.redhat.com/errata/RHSA-2020:0578
https://access.redhat.com/errata/RHSA-2020:0580
https://pillow.readthedocs.io/en/latest/releasenotes/6.2.0.html
Details
Source: MITRE
Published: 2019-10-04
Updated: 2020-02-18
Type: CWE-770
Risk Information
CVSS v2
Base Score: 5
Vector: AV:N/AC:L/Au:N/C:N/I:N/A:P
Impact Score: 2.9
Exploitability Score: 10
Severity: MEDIUM
CVSS v3
Base Score: 7.5
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Impact Score: 3.6
Exploitability Score: 3.9
Severity: HIGH