PT-2020-6248 · Python Imaging Library+2 · Pillow+2

Hugovk · Published 2020-06-25 · Updated 2024-03-06 · CVE-2020-10177

Positive Technologies (AI Summary)

CVSS v4.0

7.1

High

Base vector

AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Pillow versions prior to 7.1.0 Pillow versions 7.x prior to 7.0.1 Pillow version 6.2.2 and earlier

Description The issue is related to multiple out-of-bounds reads in the libImaging/FliDecode.c library. This could allow a remote attacker to access confidential data.

Recommendations For Pillow versions prior to 7.1.0, update to version 7.1.0 or later. For Pillow versions 7.x prior to 7.0.1, update to version 7.0.1 or later. For Pillow version 6.2.2 and earlier, update to version 6.2.3 or later.

Fix

Out of bounds Read

Weakness Enumeration

CWE-125

Related Identifiers

BDU:2021-03717

BIT-PILLOW-2020-10177

CVE-2020-10177

DLA-2317-1

GHSA-CQHG-XJHH-P8HF

MGASA-2020-0434

PYSEC-2020-76

SUSE-RU-2020:2161-1

SUSE-SU-2020:2057-1

SUSE-SU-2020:2911-1

SUSE-SU-2020:3309-1

USN-4430-1

USN-4430-2

USN-4697-2

Affected Products

Linuxmint

Pillow

Ubuntu

References · 231

• https://github.com/python-pillow/Pillow/pull/4538 · Patch
• https://github.com/python-pillow/Pillow/pull/4503 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2020-10177 · Security Note
• https://osv.dev/vulnerability/USN-4430-2 · Vendor Advisory
• https://ubuntu.com/security/CVE-2020-35653 · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/[e-mail]/message/BEBCPE4F2VHTIT6EZA2YZQZLPVDEBJGD · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HOKHNWV2VS5GESY7IBD237E7C6T3I427 · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/[e-mail]/message/HOKHNWV2VS5GESY7IBD237E7C6T3I427 · Vendor Advisory
• https://wiki.astralinux.ru/astra-linux-se16-bulletin-20210611SE16 · Vendor Advisory
• https://usn.ubuntu.com/4430-2 · Vendor Advisory
• https://bdu.fstec.ru/vul/2021-03717 · Security Note
• https://ubuntu.com/security/CVE-2020-11538 · Vendor Advisory
• https://osv.dev/vulnerability/MGASA-2020-0434 · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/BEBCPE4F2VHTIT6EZA2YZQZLPVDEBJGD · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2020-10177 · Vendor Advisory