CVE-2019-19911: Canonical Ubuntu Linux

High severity, CVSS 7.5. EPSS: 2.1% chance of exploitation in the next 30 days.

There is a DoS vulnerability in Pillow before 6.2.2 caused by FpxImagePlugin.py calling the range function on an unvalidated 32-bit integer if the number of bands is large. On Windows running 32-bit Python, this results in an OverflowError or MemoryError due to the 2 GB limit. However, on Linux running 64-bit Python this results in the process being terminated by the OOM killer.

Affected products

• Canonical Ubuntu Linux: version 14.04 only; version 16.04 only; version 18.04 only; version 19.10 only
• Debian Debian Linux: version 9.0 only; version 10.0 only
• Fedoraproject Fedora: version 30 only
• Python Pillow: before 6.2.2 (fixed in 6.2.2)

Published 2020-01-05. Last modified 2026-06-17.