PT-2020-12048 · Python Imaging Library+2 · Pillow+2
Wiredfool
·
Published
2020-06-25
·
Updated
2024-03-06
·
CVE-2020-10378
CVSS v4.0
8.2
High
| Vector | AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N |
Name of the Vulnerable Software and Affected Versions
Pillow versions prior to 7.1.0
Pillow versions 7.x prior to 7.0.1
Pillow version 6.2.3 and earlier
Description
An out-of-bounds read can occur when reading PCX files where
state->shuffle is instructed to read beyond state->buffer in the libImaging/PcxDecode.c file.Recommendations
For Pillow versions prior to 7.1.0, update to version 7.1.0 or later to resolve the issue.
For Pillow versions 7.x prior to 7.0.1, update to version 7.0.1 or later to resolve the issue.
For Pillow version 6.2.3 and earlier, update to a version later than 6.2.3 to resolve the issue.
As a temporary workaround, consider restricting the use of PCX files until a patch is available.
Fix
Out of bounds Read
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Linuxmint
Pillow
Ubuntu