Search for vulnerabilities
Vulnerability details: VCID-4wjc-1tuj-aaar
Vulnerability ID VCID-4wjc-1tuj-aaar
Aliases CVE-2019-19911
GHSA-5gm3-px64-rw72
PYSEC-2020-172
PYSEC-2020-191
Summary There is a DoS vulnerability in Pillow before 6.2.2 caused by FpxImagePlugin.py calling the range function on an unvalidated 32-bit integer if the number of bands is large. On Windows running 32-bit Python, this results in an OverflowError or MemoryError due to the 2 GB limit. However, on Linux running 64-bit Python this results in the process being terminated by the OOM killer.
Status Published
Exploitability 0.5
Weighted Severity 8.0
Risk 4.0
Affected and Fixed Packages Package Details
Weaknesses (4)
CWE-190 Integer Overflow or Wraparound
CWE-1035 OWASP Top Ten 2017 Category A9 - Using Components with Known Vulnerabilities
CWE-937 OWASP Top Ten 2013 Category A9 - Using Components with Known Vulnerabilities
CWE-400 Uncontrolled Resource Consumption
System Score Found at
generic_textual Low http://people.canonical.com/~ubuntu-security/cve/2019/CVE-2019-19911.html
rhas Moderate https://access.redhat.com/errata/RHSA-2021:0420
cvssv3 7.5 https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2019-19911.json
epss 0.00233 https://api.first.org/data/v1/epss?cve=CVE-2019-19911
epss 0.00233 https://api.first.org/data/v1/epss?cve=CVE-2019-19911
epss 0.00233 https://api.first.org/data/v1/epss?cve=CVE-2019-19911
epss 0.00233 https://api.first.org/data/v1/epss?cve=CVE-2019-19911
epss 0.00233 https://api.first.org/data/v1/epss?cve=CVE-2019-19911
epss 0.00233 https://api.first.org/data/v1/epss?cve=CVE-2019-19911
epss 0.00233 https://api.first.org/data/v1/epss?cve=CVE-2019-19911
epss 0.00233 https://api.first.org/data/v1/epss?cve=CVE-2019-19911
epss 0.00233 https://api.first.org/data/v1/epss?cve=CVE-2019-19911
epss 0.00233 https://api.first.org/data/v1/epss?cve=CVE-2019-19911
epss 0.00233 https://api.first.org/data/v1/epss?cve=CVE-2019-19911
epss 0.00233 https://api.first.org/data/v1/epss?cve=CVE-2019-19911
epss 0.00311 https://api.first.org/data/v1/epss?cve=CVE-2019-19911
epss 0.00311 https://api.first.org/data/v1/epss?cve=CVE-2019-19911
epss 0.00311 https://api.first.org/data/v1/epss?cve=CVE-2019-19911
epss 0.00459 https://api.first.org/data/v1/epss?cve=CVE-2019-19911
epss 0.00752 https://api.first.org/data/v1/epss?cve=CVE-2019-19911
epss 0.00752 https://api.first.org/data/v1/epss?cve=CVE-2019-19911
epss 0.00752 https://api.first.org/data/v1/epss?cve=CVE-2019-19911
epss 0.00752 https://api.first.org/data/v1/epss?cve=CVE-2019-19911
epss 0.00752 https://api.first.org/data/v1/epss?cve=CVE-2019-19911
epss 0.00752 https://api.first.org/data/v1/epss?cve=CVE-2019-19911
epss 0.00752 https://api.first.org/data/v1/epss?cve=CVE-2019-19911
epss 0.00752 https://api.first.org/data/v1/epss?cve=CVE-2019-19911
epss 0.00752 https://api.first.org/data/v1/epss?cve=CVE-2019-19911
epss 0.00752 https://api.first.org/data/v1/epss?cve=CVE-2019-19911
epss 0.00752 https://api.first.org/data/v1/epss?cve=CVE-2019-19911
epss 0.00752 https://api.first.org/data/v1/epss?cve=CVE-2019-19911
epss 0.00752 https://api.first.org/data/v1/epss?cve=CVE-2019-19911
epss 0.00752 https://api.first.org/data/v1/epss?cve=CVE-2019-19911
epss 0.00752 https://api.first.org/data/v1/epss?cve=CVE-2019-19911
epss 0.00752 https://api.first.org/data/v1/epss?cve=CVE-2019-19911
epss 0.00752 https://api.first.org/data/v1/epss?cve=CVE-2019-19911
epss 0.00752 https://api.first.org/data/v1/epss?cve=CVE-2019-19911
epss 0.00752 https://api.first.org/data/v1/epss?cve=CVE-2019-19911
epss 0.00752 https://api.first.org/data/v1/epss?cve=CVE-2019-19911
epss 0.00752 https://api.first.org/data/v1/epss?cve=CVE-2019-19911
epss 0.00752 https://api.first.org/data/v1/epss?cve=CVE-2019-19911
epss 0.00752 https://api.first.org/data/v1/epss?cve=CVE-2019-19911
epss 0.00752 https://api.first.org/data/v1/epss?cve=CVE-2019-19911
epss 0.00752 https://api.first.org/data/v1/epss?cve=CVE-2019-19911
epss 0.00757 https://api.first.org/data/v1/epss?cve=CVE-2019-19911
epss 0.00757 https://api.first.org/data/v1/epss?cve=CVE-2019-19911
epss 0.00757 https://api.first.org/data/v1/epss?cve=CVE-2019-19911
epss 0.00757 https://api.first.org/data/v1/epss?cve=CVE-2019-19911
epss 0.00757 https://api.first.org/data/v1/epss?cve=CVE-2019-19911
epss 0.00757 https://api.first.org/data/v1/epss?cve=CVE-2019-19911
epss 0.00757 https://api.first.org/data/v1/epss?cve=CVE-2019-19911
epss 0.00757 https://api.first.org/data/v1/epss?cve=CVE-2019-19911
epss 0.00757 https://api.first.org/data/v1/epss?cve=CVE-2019-19911
epss 0.00757 https://api.first.org/data/v1/epss?cve=CVE-2019-19911
epss 0.00757 https://api.first.org/data/v1/epss?cve=CVE-2019-19911
epss 0.00757 https://api.first.org/data/v1/epss?cve=CVE-2019-19911
epss 0.00757 https://api.first.org/data/v1/epss?cve=CVE-2019-19911
epss 0.00757 https://api.first.org/data/v1/epss?cve=CVE-2019-19911
epss 0.00757 https://api.first.org/data/v1/epss?cve=CVE-2019-19911
epss 0.00757 https://api.first.org/data/v1/epss?cve=CVE-2019-19911
epss 0.00757 https://api.first.org/data/v1/epss?cve=CVE-2019-19911
epss 0.00757 https://api.first.org/data/v1/epss?cve=CVE-2019-19911
epss 0.00757 https://api.first.org/data/v1/epss?cve=CVE-2019-19911
epss 0.00757 https://api.first.org/data/v1/epss?cve=CVE-2019-19911
epss 0.00757 https://api.first.org/data/v1/epss?cve=CVE-2019-19911
epss 0.00757 https://api.first.org/data/v1/epss?cve=CVE-2019-19911
epss 0.00757 https://api.first.org/data/v1/epss?cve=CVE-2019-19911
epss 0.00757 https://api.first.org/data/v1/epss?cve=CVE-2019-19911
epss 0.00757 https://api.first.org/data/v1/epss?cve=CVE-2019-19911
epss 0.00757 https://api.first.org/data/v1/epss?cve=CVE-2019-19911
epss 0.00757 https://api.first.org/data/v1/epss?cve=CVE-2019-19911
epss 0.00757 https://api.first.org/data/v1/epss?cve=CVE-2019-19911
epss 0.00757 https://api.first.org/data/v1/epss?cve=CVE-2019-19911
epss 0.00757 https://api.first.org/data/v1/epss?cve=CVE-2019-19911
epss 0.00757 https://api.first.org/data/v1/epss?cve=CVE-2019-19911
epss 0.00757 https://api.first.org/data/v1/epss?cve=CVE-2019-19911
epss 0.00757 https://api.first.org/data/v1/epss?cve=CVE-2019-19911
epss 0.00757 https://api.first.org/data/v1/epss?cve=CVE-2019-19911
epss 0.00757 https://api.first.org/data/v1/epss?cve=CVE-2019-19911
epss 0.00757 https://api.first.org/data/v1/epss?cve=CVE-2019-19911
epss 0.00757 https://api.first.org/data/v1/epss?cve=CVE-2019-19911
epss 0.00757 https://api.first.org/data/v1/epss?cve=CVE-2019-19911
epss 0.00757 https://api.first.org/data/v1/epss?cve=CVE-2019-19911
epss 0.00757 https://api.first.org/data/v1/epss?cve=CVE-2019-19911
epss 0.00757 https://api.first.org/data/v1/epss?cve=CVE-2019-19911
epss 0.00757 https://api.first.org/data/v1/epss?cve=CVE-2019-19911
epss 0.00757 https://api.first.org/data/v1/epss?cve=CVE-2019-19911
epss 0.00757 https://api.first.org/data/v1/epss?cve=CVE-2019-19911
epss 0.01561 https://api.first.org/data/v1/epss?cve=CVE-2019-19911
rhbs medium https://bugzilla.redhat.com/show_bug.cgi?id=1789540
generic_textual Low https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-19911
generic_textual Medium https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-5312
generic_textual Medium https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-5313
cvssv3.1 7.5 https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml
cvssv3.1_qr HIGH https://github.com/advisories/GHSA-5gm3-px64-rw72
cvssv3.1 7.5 https://github.com/pypa/advisory-database/tree/main/vulns/pillow/PYSEC-2020-172.yaml
generic_textual HIGH https://github.com/pypa/advisory-database/tree/main/vulns/pillow/PYSEC-2020-172.yaml
cvssv3.1 7.1 https://github.com/python-pillow/Pillow/blob/master/CHANGES.rst#622-2020-01-02
generic_textual HIGH https://github.com/python-pillow/Pillow/blob/master/CHANGES.rst#622-2020-01-02
cvssv3.1 7.5 https://github.com/python-pillow/Pillow/commit/774e53bb132461d8d5ebefec1162e29ec0ebc63d
generic_textual HIGH https://github.com/python-pillow/Pillow/commit/774e53bb132461d8d5ebefec1162e29ec0ebc63d
cvssv3.1 7.1 https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/3DUMIBUYGJRAVJCTFUWBRLVQKOUTVX5P
generic_textual HIGH https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/3DUMIBUYGJRAVJCTFUWBRLVQKOUTVX5P
cvssv2 5.0 https://nvd.nist.gov/vuln/detail/CVE-2019-19911
cvssv3 7.5 https://nvd.nist.gov/vuln/detail/CVE-2019-19911
cvssv3.1 7.5 https://nvd.nist.gov/vuln/detail/CVE-2019-19911
cvssv3.1 7.1 https://pillow.readthedocs.io/en/stable/releasenotes/6.2.2.html
generic_textual HIGH https://pillow.readthedocs.io/en/stable/releasenotes/6.2.2.html
cvssv3.1 7.5 https://ubuntu.com/security/notices/USN-4272-1
generic_textual HIGH https://ubuntu.com/security/notices/USN-4272-1
cvssv3.1 7.1 https://usn.ubuntu.com/4272-1
generic_textual HIGH https://usn.ubuntu.com/4272-1
generic_textual Medium https://usn.ubuntu.com/usn/usn-4272-1
cvssv3.1 7.1 https://www.debian.org/security/2020/dsa-4631
generic_textual HIGH https://www.debian.org/security/2020/dsa-4631
Reference id Reference type URL
http://people.canonical.com/~ubuntu-security/cve/2019/CVE-2019-19911.html
https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2019-19911.json
https://api.first.org/data/v1/epss?cve=CVE-2019-19911
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-19911
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-5312
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-5313
https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml
https://github.com/pypa/advisory-database/tree/main/vulns/pillow/PYSEC-2020-172.yaml
https://github.com/python-pillow/Pillow/blob/master/CHANGES.rst#622-2020-01-02
https://github.com/python-pillow/Pillow/commit/774e53bb132461d8d5ebefec1162e29ec0ebc63d
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/3DUMIBUYGJRAVJCTFUWBRLVQKOUTVX5P/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/3DUMIBUYGJRAVJCTFUWBRLVQKOUTVX5P
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/3DUMIBUYGJRAVJCTFUWBRLVQKOUTVX5P/
https://pillow.readthedocs.io/en/stable/releasenotes/6.2.2.html
https://ubuntu.com/security/notices/USN-4272-1
https://usn.ubuntu.com/4272-1
https://usn.ubuntu.com/4272-1/
https://usn.ubuntu.com/usn/usn-4272-1
https://www.debian.org/security/2020/dsa-4631
1789540 https://bugzilla.redhat.com/show_bug.cgi?id=1789540
948224 https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=948224
cpe:2.3:a:python:pillow:*:*:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:python:pillow:*:*:*:*:*:*:*:*
cpe:2.3:o:canonical:ubuntu_linux:14.04:*:*:*:esm:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:o:canonical:ubuntu_linux:14.04:*:*:*:esm:*:*:*
cpe:2.3:o:canonical:ubuntu_linux:16.04:*:*:*:esm:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:o:canonical:ubuntu_linux:16.04:*:*:*:esm:*:*:*
cpe:2.3:o:canonical:ubuntu_linux:18.04:*:*:*:lts:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:o:canonical:ubuntu_linux:18.04:*:*:*:lts:*:*:*
cpe:2.3:o:canonical:ubuntu_linux:19.10:*:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:o:canonical:ubuntu_linux:19.10:*:*:*:*:*:*:*
cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*
cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*
cpe:2.3:o:fedoraproject:fedora:30:*:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:o:fedoraproject:fedora:30:*:*:*:*:*:*:*
CVE-2019-19911 https://nvd.nist.gov/vuln/detail/CVE-2019-19911
GHSA-5gm3-px64-rw72 https://github.com/advisories/GHSA-5gm3-px64-rw72
RHSA-2021:0420 https://access.redhat.com/errata/RHSA-2021:0420
No exploits are available.
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H Found at https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2019-19911.json
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H Found at https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H Found at https://github.com/pypa/advisory-database/tree/main/vulns/pillow/PYSEC-2020-172.yaml
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H Found at https://github.com/python-pillow/Pillow/blob/master/CHANGES.rst#622-2020-01-02
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H Found at https://github.com/python-pillow/Pillow/commit/774e53bb132461d8d5ebefec1162e29ec0ebc63d
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H Found at https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/3DUMIBUYGJRAVJCTFUWBRLVQKOUTVX5P
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: AV:N/AC:L/Au:N/C:N/I:N/A:P Found at https://nvd.nist.gov/vuln/detail/CVE-2019-19911
Exploitability (E) Access Vector (AV) Access Complexity (AC) Authentication (Au) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

high

functional

unproven

proof_of_concept

not_defined

local

adjacent_network

network

high

medium

low

multiple

single

none

none

partial

complete

none

partial

complete

none

partial

complete
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H Found at https://nvd.nist.gov/vuln/detail/CVE-2019-19911
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H Found at https://nvd.nist.gov/vuln/detail/CVE-2019-19911
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H Found at https://pillow.readthedocs.io/en/stable/releasenotes/6.2.2.html
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H Found at https://ubuntu.com/security/notices/USN-4272-1
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H Found at https://usn.ubuntu.com/4272-1
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H Found at https://www.debian.org/security/2020/dsa-4631
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Exploit Prediction Scoring System (EPSS)
Percentile 0.61792
EPSS Score 0.00233
Published At Nov. 1, 2024, midnight
Date Actor Action Source VulnerableCode Version
There are no relevant records.