PT-2021-4527 · Pillow+9 · Pillow+9

Published 2021-01-03 · Updated 2024-06-15 · CVE-2020-35653

Positive Technologies (AI Summary)

CVSS v4.0

8.3

High

Base vector

AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Pillow versions prior to 8.1.0

Description The issue is related to a buffer over-read in the PcxDecode function when decoding a crafted PCX file. This occurs because the user-supplied stride value is trusted for buffer calculations. Exploitation of this issue may allow a remote attacker to access confidential data and cause a denial of service.

Recommendations For versions prior to 8.1.0, update to version 8.1.0 or later to resolve the issue. As a temporary workaround, consider restricting the use of the PcxDecode function when handling untrusted PCX files until a patch is applied.

Fix

Out of bounds Read

Weakness Enumeration

CWE-125

Related Identifiers

ALSA-2021:4149

ALT-PU-2021-1389

BDU:2021-05179

BIT-PILLOW-2020-35653

CESA-2021_4149

CVE-2020-35653

DLA-2716-1

GHSA-F5G8-5QQ7-938W

OESA-2021-1070

OPENSUSE-SU-2021:1134-1

OPENSUSE-SU-2021_1134-1

OPENSUSE-SU-2024:11209-1

OPENSUSE-SU-2024:13827-1

PYSEC-2021-69

RHSA-2021:4149

RHSA-2021_4149

RLSA-2021:4149

SUSE-SU-2021:1938-1

SUSE-SU-2021:1939-1

SUSE-SU-2021:1940-1

USN-4697-1

USN-4697-2

Affected Products

Alt Linux

Almalinux

Astra Linux

Centos

Linuxmint

Pillow

Red Hat

Rocky Linux

Suse

Ubuntu

References · 124

• https://osv.dev/vulnerability/CVE-2020-35653 · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6BYVI5G44MRIPERKYDQEL3S3YQCZTVHE · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2020-35653 · Security Note
• https://osv.dev/vulnerability/USN-4697-2 · Vendor Advisory
• https://osv.dev/vulnerability/OESA-2021-1070 · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/[e-mail]/message/6BYVI5G44MRIPERKYDQEL3S3YQCZTVHE · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-f5g8-5qq7-938w · Vendor Advisory
• https://osv.dev/vulnerability/PYSEC-2021-69 · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/BF553AMNNNBW7SH4IM4MNE4M6GNZQ7YD · Vendor Advisory
• https://osv.dev/vulnerability/DLA-2716-1 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2021:1938-1 · Vendor Advisory
• https://ubuntu.com/security/notices/USN-4697-1 · Vendor Advisory
• https://bdu.fstec.ru/vul/2021-05179 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2020-35653 · Vendor Advisory
• https://osv.dev/vulnerability/RLSA-2021:4149 · Vendor Advisory