The vulnerability of the Pillow image processing library, related to writing data beyond the buffer boundary in memory during the conversion from SGI images to RLE format, allows a hacker to trigger a service denial.

🗓️ 22 Dec 2020 00:00:00Reported by FSTEC of Russia — Information Security Threat DatabaseType

bdu_fstec

bdu_fstec🔗 bdu.fstec.ru👁 2 Views

Pillow vulnerability allows buffer overrun converting Silicon Graphics images to run length encoding, enabling remote denial of service.

Reporter	Title	Published	Views	Family All 93
FreeBSD	Pillow -- Multiple vulnerabilities	19 Dec 201900:00	–	freebsd
IBM Security Bulletins	Security Bulletin: A security vulnerability has been identified in Pillow shipped with IBM Watson Machine Learning Community Edition (WMLCE) containers	20 May 202000:04	–	ibm
Tenable Nessus	Alibaba Cloud Linux 3 : 0012: python-pillow (ALINUX3-SA-2022:0012)	14 May 202500:00	–	nessus
Tenable Nessus	CentOS 8 : python-pillow (CESA-2020:0580)	1 Feb 202100:00	–	nessus
Tenable Nessus	Debian DSA-4631-1 : pillow - security update	24 Feb 202000:00	–	nessus
Tenable Nessus	EulerOS 2.0 SP8 : python-pillow (EulerOS-SA-2020-1877)	28 Aug 202000:00	–	nessus
Tenable Nessus	EulerOS Virtualization for ARM 64 3.0.6.0 : python-pillow (EulerOS-SA-2020-2024)	29 Sep 202000:00	–	nessus
Tenable Nessus	EulerOS 2.0 SP9 : python-pillow (EulerOS-SA-2021-1254)	5 Feb 202100:00	–	nessus
Tenable Nessus	EulerOS 2.0 SP9 : python-pillow (EulerOS-SA-2021-1273)	5 Feb 202100:00	–	nessus
Tenable Nessus	EulerOS Virtualization 2.9.1 : python-pillow (EulerOS-SA-2021-1729)	15 Apr 202100:00	–	nessus

Vulners

Node

uploadcare,_llc pillowRange<6.2.2

OR

red_hat red_hat_enterprise_linuxMatch8

OR

fedora fedoraMatch30

OR

fedora fedoraMatch31

OR

canonical ubuntuMatch19.10

Source	Link
lists	www.lists.fedoraproject.org/archives/list/[email protected]/message/2MMU3WT2X64GS5WHDPKKC2WZA7UIIQ3A/
lists	www.lists.fedoraproject.org/archives/list/[email protected]/message/3DUMIBUYGJRAVJCTFUWBRLVQKOUTVX5P/
debian	www.debian.org/security/2020/dsa-4631
access	www.access.redhat.com/security/cve/cve-2020-5311
pillow	www.pillow.readthedocs.io/en/stable/releasenotes/6.2.2.html
usn	www.usn.ubuntu.com/4272-1/
web	www.web.nvd.nist.gov/view/vuln/detail

22 Dec 2020 00:00Current

6.7Medium risk

Vulners AI Score6.7

CVSS 39.8

CVSS 210

EPSS0.04212

pillow vulnerability buffer overrun silicon graphics images run length encoding denial of service