An issue was discovered in Pillow before 10.0.0. It is a Denial of Service that uncontrollably allocates memory to process a given task, potentially causing a service to crash by having it run out of memory. This occurs for truetype in ImageFont when textlength in an ImageDraw instance operates on a long text argument.
{ "availability": "No subscription required", "ubuntu_priority": "low", "binaries": [ { "python3-pil.imagetk-dbg": "7.0.0-4ubuntu0.8", "python3-pil-dbg": "7.0.0-4ubuntu0.8", "python-pil-doc": "7.0.0-4ubuntu0.8", "python3-pil": "7.0.0-4ubuntu0.8", "python3-pil.imagetk": "7.0.0-4ubuntu0.8" } ], "priority_reason": "Only consumes memory when very long strings are used as text input" }
{ "availability": "No subscription required", "ubuntu_priority": "low", "binaries": [ { "python3-pil.imagetk-dbgsym": "9.0.1-1ubuntu0.2", "python3-pil.imagetk": "9.0.1-1ubuntu0.2", "python-pil-doc": "9.0.1-1ubuntu0.2", "python3-pil": "9.0.1-1ubuntu0.2", "python3-pil-dbgsym": "9.0.1-1ubuntu0.2" } ], "priority_reason": "Only consumes memory when very long strings are used as text input" }
{ "availability": "No subscription required", "ubuntu_priority": "low", "binaries": [ { "python3-pil.imagetk-dbgsym": "10.0.0-1", "python3-pil.imagetk": "10.0.0-1", "python-pil-doc": "10.0.0-1", "python3-pil": "10.0.0-1", "python3-pil-dbgsym": "10.0.0-1" } ], "priority_reason": "Only consumes memory when very long strings are used as text input" }