REDHAT-BUG-2497466: High severity Pillow PIL/FontFile.py vulnerability
Pillow is a Python imaging library. Prior to 12.3.0, PIL/FontFile.py FontFile.compile() assembled per-glyph images into a combined bitmap with Image.new("1", (xsize, ysize)) without calling Image.decompressionbombcheck(), allowing a font to trigger excessive allocation during conversion or saving. This issue is fixed in version 12.3.0.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Pillowto a version that resolves this vulnerability.Fixed in 12.3.0
Event History
Frequently Asked Questions
What is the severity of REDHAT-BUG-2497466?
The severity of REDHAT-BUG-2497466 is high, rated as a 7.
How do I fix REDHAT-BUG-2497466?
To fix REDHAT-BUG-2497466, upgrade to Pillow version 12.3.0 or later.
What types of vulnerabilities are associated with REDHAT-BUG-2497466?
REDHAT-BUG-2497466 is associated with excessive memory allocation vulnerabilities during font conversion or saving.
Which software is impacted by REDHAT-BUG-2497466?
The software impacted by REDHAT-BUG-2497466 is the Pillow imaging library, specifically in the PIL/FontFile.py module.
What can happen if REDHAT-BUG-2497466 is exploited?
If REDHAT-BUG-2497466 is exploited, it can lead to denial of service due to excessive resource allocation.