Gentoo Websites Logo
Go to: Gentoo Home Documentation Forums Lists Bugs Planet Store Wiki Get Gentoo!

Bug 916907 (CVE-2023-44271)

Summary: <dev-python/pillow-10.0.0: denial of service via OOM
Product: Gentoo Security Reporter: John Helmert III <ajak>
Component: VulnerabilitiesAssignee: Gentoo Security <security>
Severity: normal CC: python
Priority: Normal    
Version: unspecified   
Hardware: All   
OS: Linux   
Whiteboard: A3 [glsa+]
Package list:
Runtime testing required: ---

Description John Helmert III archtester Gentoo Infrastructure gentoo-dev Security 2023-11-05 18:14:45 UTC
CVE-2023-44271 (

An issue was discovered in Pillow before 10.0.0. It is a Denial of Service that uncontrollably allocates memory to process a given task, potentially causing a service to crash by having it run out of memory. This occurs for truetype in ImageFont when textlength in an ImageDraw instance operates on a long text argument.

Comment 1 Larry the Git Cow gentoo-dev 2024-05-05 07:37:34 UTC
The bug has been referenced in the following commit(s):

commit 816096872d7a07e6233fbe06019e8382ea181358
Author:     GLSAMaker <>
AuthorDate: 2024-05-05 07:36:46 +0000
Commit:     Hans de Graaff <>
CommitDate: 2024-05-05 07:37:30 +0000

    [ GLSA 202405-12 ] Pillow: Multiple Vulnerabilities
    Signed-off-by: GLSAMaker <>
    Signed-off-by: Hans de Graaff <>

 glsa-202405-12.xml | 46 ++++++++++++++++++++++++++++++++++++++++++++++
 1 file changed, 46 insertions(+)