CVE-2019-16865

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

An issue was discovered in Pillow before 6.2.0. When reading specially crafted invalid image files, the library can either allocate very large amounts of memory or take an extremely long period of time to process the image.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-770

Affected software

No affected versions have been published.

Timeline

Published: Oct 4, 2019
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2019

CVE-2019-168667.5Unbound before 1.9.4 accesses uninitialized memory, which allows remote attackers to trigger a crash via a crafted NOTIFY query. The source CVE-2019-168676.5HongCMS 3.0.0 allows arbitrary file deletion via a ../ in the file parameter to admin/index.php/database/ajax?action=delete, a similar issue CVE-2019-168689.8emlog through 6.0.0beta has an arbitrary file deletion vulnerability via an admin/data.php?action=dell_all_bak request with directory traver CVE-2019-168697.5Netty before 4.1.42.Final mishandles whitespace before the colon in HTTP headers (such as a "Transfer-Encoding : chunked" line), which leads CVE-2019-16877.5A vulnerability in the TCP proxy functionality for Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD)CVE-2019-168719.8Beckhoff Embedded Windows PLCs through 3.1.4024.0, and Beckhoff Twincat on Windows Engineering stations, allow an attacker to achieve Remote CVE-2019-168729.9Portainer before 1.22.1 has Incorrect Access Control (issue 1 of 4).CVE-2019-168735.4Portainer before 1.22.1 has XSS (issue 1 of 2).CVE-2019-168746.5Portainer before 1.22.1 has Incorrect Access Control (issue 2 of 4).CVE-2019-168767.5Portainer before 1.22.1 allows Directory Traversal.CVE-2019-168778.8Portainer before 1.22.1 has Incorrect Access Control (issue 4 of 4).CVE-2019-168785.4Portainer before 1.22.1 has XSS (issue 2 of 2).