REDHAT-BUG-2497464: High severity Pillow pypi/Pillow vulnerability
Pillow is a Python imaging library. Prior to 12.3.0, PIL/PcfFontFile.py loadbitmaps() read glyph dimensions from the PCF METRICS section and passed them directly to Image.frombytes() without calling Image.decompressionbombcheck(), allowing crafted PCF font data to cause excessive memory allocation. This issue is fixed in version 12.3.0.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Pillowto a version that resolves this vulnerability.Fixed in 12.3.0
Event History
Frequently Asked Questions
What is the severity of REDHAT-BUG-2497464?
The severity of REDHAT-BUG-2497464 is classified as high with a score of 7.
What is the risk associated with REDHAT-BUG-2497464?
The risk associated with REDHAT-BUG-2497464 is rated at 33.
How do I fix REDHAT-BUG-2497464?
To fix REDHAT-BUG-2497464, update Pillow to version 12.3.0 or later.
What does REDHAT-BUG-2497464 affect?
REDHAT-BUG-2497464 affects the Pillow library, specifically its handling of PCF font data.
What type of vulnerability is REDHAT-BUG-2497464?
REDHAT-BUG-2497464 is a memory allocation vulnerability allowing potentially excessive memory usage.