GHSA-R7RM-8J6H-R933 Buffer Copy without Checking Size of Input in Pillow

🗓️ 24 May 2022 17:05:33Reported by GoogleType

osv🔗 osv.dev👁 3 Views

Pillow before 6.2.2 has a Silicon Graphics buffer overflow in SgiRleDecode.c from copying input without checks.

Reporter	Title	Published	Views	Family All 92
FreeBSD	Pillow -- Multiple vulnerabilities	19 Dec 201900:00	–	freebsd
IBM Security Bulletins	Security Bulletin: A security vulnerability has been identified in Pillow shipped with IBM Watson Machine Learning Community Edition (WMLCE) containers	20 May 202000:04	–	ibm
Tenable Nessus	Alibaba Cloud Linux 3 : 0012: python-pillow (ALINUX3-SA-2022:0012)	14 May 202500:00	–	nessus
Tenable Nessus	CentOS 8 : python-pillow (CESA-2020:0580)	1 Feb 202100:00	–	nessus
Tenable Nessus	Debian DSA-4631-1 : pillow - security update	24 Feb 202000:00	–	nessus
Tenable Nessus	EulerOS 2.0 SP8 : python-pillow (EulerOS-SA-2020-1877)	28 Aug 202000:00	–	nessus
Tenable Nessus	EulerOS Virtualization for ARM 64 3.0.6.0 : python-pillow (EulerOS-SA-2020-2024)	29 Sep 202000:00	–	nessus
Tenable Nessus	EulerOS 2.0 SP9 : python-pillow (EulerOS-SA-2021-1254)	5 Feb 202100:00	–	nessus
Tenable Nessus	EulerOS 2.0 SP9 : python-pillow (EulerOS-SA-2021-1273)	5 Feb 202100:00	–	nessus
Tenable Nessus	EulerOS Virtualization 2.9.1 : python-pillow (EulerOS-SA-2021-1729)	15 Apr 202100:00	–	nessus

Source	Link
nvd	www.nvd.nist.gov/vuln/detail/CVE-2020-5311
github	www.github.com/python-pillow/Pillow/commit/a79b65c47c7dc6fe623aadf09aa6192fc54548f3
access	www.access.redhat.com/errata/RHSA-2020:0566
access	www.access.redhat.com/errata/RHSA-2020:0580
github	www.github.com/advisories/GHSA-r7rm-8j6h-r933
github	www.github.com/pypa/advisory-database/tree/main/vulns/pillow/PYSEC-2020-82.yaml
github	www.github.com/python-pillow/Pillow
lists	www.lists.fedoraproject.org/archives/list/[email protected]/message/2MMU3WT2X64GS5WHDPKKC2WZA7UIIQ3A
lists	www.lists.fedoraproject.org/archives/list/[email protected]/message/3DUMIBUYGJRAVJCTFUWBRLVQKOUTVX5P
pillow	www.pillow.readthedocs.io/en/stable/releasenotes/6.2.2.html

08 Oct 2024 13:23Current

7High risk

Vulners AI Score7

CVSS 49.3

CVSS 3.19.8

EPSS0.01146