VDB
DEBIAN-CVE-2023-44271
DEBIAN-CVE-2023-44271
PUBLISHED
CVSS 7.5 HIGH
An issue was discovered in Pillow before 10.0.0. It is a Denial of Service that uncontrollably allocates memory to process a given task, potentially causing a service to crash by having it run out of memory. This occurs for truetype in ImageFont when textlength in an ImageDraw instance operates on a long text argument.
Risk Scores
CVSS v3.1
7.5
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Debian:13 | pillow | 0, 0, 0 |
| Debian:11 | pillow | 8.1.2+dfsg-0.3+deb11u1, 0, 8.1.2+dfsg-0.3+deb11u1 |
| Debian:14 | pillow | 0, 0, 0 |
| Debian:12 | pillow | 9.4.0-1.1, 0, 0 |
Timeline
- Nov 3, 2023 CVE Published
- Apr 28, 2026 CVE Updated