CVE-2023-44271

An issue was discovered in Pillow before 10.0.0. It is a Denial of Service that uncontrollably allocates memory to process a given task, potentially causing a service to crash by having it run out of memory. This occurs for truetype in ImageFont when textlength in an ImageDraw instance operates on a long text argument.

Database specific

{
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/44xxx/CVE-2023-44271.json",
    "cna_assigner": "mitre"
}

References

Affected packages

Git / github.com/python-pillow/pillow

Affected ranges

Type: GIT
Repo: https://github.com/python-pillow/pillow
Events: Introduced

0 Unknown introduced commit / All previous commits are affected

Fixed

6e28ed1f36d0eb74053af54e1eddc9c29db698cd

Affected versions

1.*

1.0

1.2

1.7.7

1.7.8

2.*

2.0.0

2.1.0

2.2.0

2.2.1

2.3.0

2.5.0

2.7.0

2.8.0

2.8.1

2.9.0

2.9.0.dev0

2.9.0.dev1

2.9.0.dev2

3.*

3.1.0

3.1.0-rc1

3.2.0

3.3.0

3.4.0

4.*

4.0.0

4.0.0a

4.1.0

4.2.0

4.3.0

5.*

5.0.0

5.1.0

5.2.0

5.3.0

5.4.0

6.*

6.0.0

6.1.0

6.2.0

7.*

7.0.0

7.1.0

7.2.0

8.*

8.0.0

8.1.0

8.2.0

8.3.0

8.4.0

9.*

9.0.0

9.1.0

9.2.0

9.3.0

9.4.0

9.5.0

Database specific

source

"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2023-44271.json"