PT-2020-5161 · Pillow+1 · Pillow+1

Radarhere · Published 2020-01-02 · Updated 2024-03-06 · CVE-2020-5310

Positive Technologies (AI Summary)

CVSS v4.0

9.3

Critical

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Pillow versions prior to 6.2.2

Description The issue is related to a TIFF decoding integer overflow in the libImaging/TiffDecode.c file of the Pillow library. This overflow is connected to the realloc function. The exploitation of this issue could allow a remote attacker to cause a denial of service.

Recommendations For versions prior to 6.2.2, update to version 6.2.2 or later to resolve the issue. As a temporary workaround, consider avoiding the use of the libImaging/TiffDecode.c function for TIFF decoding until a patch is applied.

Fix

Integer Overflow

Heap Based Buffer Overflow

Weakness Enumeration

CWE-190

CWE-122

Related Identifiers

BDU:2020-05772

BIT-PILLOW-2020-5310

CVE-2020-5310

GHSA-VCQG-3P29-XW73

MGASA-2020-0088

PYSEC-2020-81

USN-4272-1

Affected Products

Pillow

Ubuntu

References · 33

• https://github.com/python-pillow/Pillow/commit/4e2def2539ec13e53a82e06c4b3daf00454100c4 · Patch
• https://lists.fedoraproject.org/archives/list/[e-mail]/message/2MMU3WT2X64GS5WHDPKKC2WZA7UIIQ3A · Vendor Advisory
• https://ubuntu.com/security/CVE-2020-5312 · Vendor Advisory
• https://ubuntu.com/security/CVE-2020-5310 · Vendor Advisory
• https://ubuntu.com/security/CVE-2020-5313 · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/2MMU3WT2X64GS5WHDPKKC2WZA7UIIQ3A · Vendor Advisory
• https://bdu.fstec.ru/vul/2020-05772 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2020-5310 · Security Note
• https://advisories.mageia.org/MGASA-2020-0088.html · Security Note
• https://osv.dev/vulnerability/ALPINE-CVE-2020-5310 · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/[e-mail]/message/3DUMIBUYGJRAVJCTFUWBRLVQKOUTVX5P · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-vcqg-3p29-xw73 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2020-5310 · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/3DUMIBUYGJRAVJCTFUWBRLVQKOUTVX5P · Vendor Advisory
• https://usn.ubuntu.com/4272-1 · Vendor Advisory