PT-2020-12049 · Python Imaging Library+2 · Pillow+2

Hugovk · Published 2020-06-25 · Updated 2024-03-06 · CVE-2020-10379

Positive Technologies (AI Summary)

CVSS v4.0

8.7

High

Base vector

AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Pillow versions prior to 7.1.0 Pillow versions 7.x prior to 7.0.1 Pillow version 6.2.3 and earlier

Description The issue involves two Buffer Overflows in libImaging/TiffDecode.c. This affects Pillow, where the buffer overflows can occur due to improper handling in the TiffDecode.c file within the libImaging module.

Recommendations For Pillow versions prior to 7.1.0, update to version 7.1.0 or later. For Pillow versions 7.x prior to 7.0.1, update to version 7.0.1 or later. For Pillow version 6.2.3 and earlier, update to a version later than 6.2.3. As a temporary workaround, consider restricting access to the libImaging/TiffDecode.c module until a patch is available.

Fix

Buffer Overflow

Weakness Enumeration

CWE-120

Related Identifiers

BIT-PILLOW-2020-10379

CVE-2020-10379

GHSA-8843-M7MW-MXQM

PYSEC-2020-78

USN-4430-2

Affected Products

Linuxmint

Pillow

Ubuntu

References · 35

• https://github.com/python-pillow/Pillow/pull/4538 · Patch
• https://github.com/python-pillow/Pillow/commit/46f4a349b88915787fea3fb91348bb1665831bbb#diff-9478f2787e3ae9668a15123b165c23ac · Patch
• https://lists.fedoraproject.org/archives/list/[e-mail]/message/HOKHNWV2VS5GESY7IBD237E7C6T3I427 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-10379 · Security Note
• https://osv.dev/vulnerability/PYSEC-2020-78 · Vendor Advisory
• https://osv.dev/vulnerability/USN-4430-2 · Vendor Advisory
• https://usn.ubuntu.com/4430-2 · Vendor Advisory
• https://osv.dev/vulnerability/BIT-pillow-2020-10379 · Vendor Advisory
• https://ubuntu.com/security/CVE-2020-11538 · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/BEBCPE4F2VHTIT6EZA2YZQZLPVDEBJGD · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-8843-m7mw-mxqm · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HOKHNWV2VS5GESY7IBD237E7C6T3I427 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2020-10379 · Security Note
• https://ubuntu.com/security/CVE-2020-10177 · Vendor Advisory
• https://ubuntu.com/security/CVE-2020-10994 · Vendor Advisory