PT-2020-12675 · Pillow+5 · Pillow+5

Hugovk · Published 2020-06-25 · Updated 2024-03-06 · CVE-2020-11538

Positive Technologies (AI Summary)

CVSS v4.0

9.2

Critical

Base vector

AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Pillow versions prior to 7.0.1

Description The issue exists in the parsing of SGI image files, where a number of out-of-bounds reads are present in the libImaging/SgiRleDecode.c module.

Recommendations For versions prior to 7.0.1, update to version 7.0.1 or later to resolve the issue.

Fix

Out of bounds Read

Weakness Enumeration

CWE-125

Related Identifiers

BIT-PILLOW-2020-11538

CESA-2020_3185

CVE-2020-11538

GHSA-43FQ-W8QQ-V88H

MGASA-2020-0434

PYSEC-2020-80

RHSA-2020:3185

RHSA-2020:3299

RHSA-2020:3302

RHSA-2020_3185

RLSA-2020:3185

SUSE-RU-2020:2161-1

USN-4430-1

USN-4430-2

Affected Products

Centos

Linuxmint

Pillow

Red Hat

Rocky Linux

Ubuntu

References · 104

• https://github.com/python-pillow/Pillow/pull/4538 · Patch
• https://github.com/python-pillow/Pillow/pull/4504 · Patch
• https://osv.dev/vulnerability/RLSA-2020:3185 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2020-11538 · Vendor Advisory
• https://usn.ubuntu.com/4430-1 · Vendor Advisory
• https://osv.dev/vulnerability/USN-4430-2 · Vendor Advisory
• https://errata.rockylinux.org/RLSA-2020:3185 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-11538 · Security Note
• https://ubuntu.com/security/CVE-2020-10379 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-43fq-w8qq-v88h · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/[e-mail]/message/BEBCPE4F2VHTIT6EZA2YZQZLPVDEBJGD · Vendor Advisory
• https://osv.dev/vulnerability/PYSEC-2020-80 · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/BEBCPE4F2VHTIT6EZA2YZQZLPVDEBJGD · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2020-11538 · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HOKHNWV2VS5GESY7IBD237E7C6T3I427 · Vendor Advisory