CVE-2020-10177 Out-of-bounds reads in Pillow
MediumCVSS 5.5
EPSS 1.5%
- Published
- Updated
- Exploit status
- No public exploit known
Description
Pillow before 7.1.0 has multiple out-of-bounds reads in libImaging/FliDecode.c.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| pypi pillow(PyPI) | < 7.1.0 | 7.1.0 |
| pypi pillow(PyPI) | = 1.0 | No fix listed |
| pypi pillow(PyPI) | = 1.1 | No fix listed |
| pypi pillow(PyPI) | = 1.2 | No fix listed |
| pypi pillow(PyPI) | = 1.3 | No fix listed |
| pypi pillow(PyPI) | = 1.4 | No fix listed |
| pypi pillow(PyPI) | = 1.5 | No fix listed |
| pypi pillow(PyPI) | = 1.6 | No fix listed |
| pypi pillow(PyPI) | = 1.7.0 | No fix listed |
| pypi pillow(PyPI) | = 1.7.1 | No fix listed |
| pypi pillow(PyPI) | = 1.7.2 | No fix listed |
| pypi pillow(PyPI) | = 1.7.3 | No fix listed |
| pypi pillow(PyPI) | = 1.7.4 | No fix listed |
| pypi pillow(PyPI) | = 1.7.5 | No fix listed |
| pypi pillow(PyPI) | = 1.7.6 | No fix listed |
| pypi pillow(PyPI) | = 1.7.7 | No fix listed |
| pypi pillow(PyPI) | = 1.7.8 | No fix listed |
| pypi pillow(PyPI) | = 2.0.0 | No fix listed |
| pypi pillow(PyPI) | = 2.1.0 | No fix listed |
| pypi pillow(PyPI) | = 2.2.0 | No fix listed |
| pypi pillow(PyPI) | = 2.2.1 | No fix listed |
| pypi pillow(PyPI) | = 2.2.2 | No fix listed |
| pypi pillow(PyPI) | = 2.3.0 | No fix listed |
| pypi pillow(PyPI) | = 2.3.1 | No fix listed |
| pypi pillow(PyPI) | = 2.3.2 | No fix listed |
Show 56 more
| Product | Affected versions | Fixed in |
|---|---|---|
| pypi pillow(PyPI) | = 2.4.0 | No fix listed |
| pypi pillow(PyPI) | = 2.5.0 | No fix listed |
| pypi pillow(PyPI) | = 2.5.1 | No fix listed |
| pypi pillow(PyPI) | = 2.5.2 | No fix listed |
| pypi pillow(PyPI) | = 2.5.3 | No fix listed |
| pypi pillow(PyPI) | = 2.6.0 | No fix listed |
| pypi pillow(PyPI) | = 2.6.1 | No fix listed |
| pypi pillow(PyPI) | = 2.6.2 | No fix listed |
| pypi pillow(PyPI) | = 2.7.0 | No fix listed |
| pypi pillow(PyPI) | = 2.8.0 | No fix listed |
| pypi pillow(PyPI) | = 2.8.1 | No fix listed |
| pypi pillow(PyPI) | = 2.8.2 | No fix listed |
| pypi pillow(PyPI) | = 2.9.0 | No fix listed |
| pypi pillow(PyPI) | = 3.0.0 | No fix listed |
| pypi pillow(PyPI) | = 3.1.0 | No fix listed |
| pypi pillow(PyPI) | = 3.1.0.rc1 | No fix listed |
| pypi pillow(PyPI) | = 3.1.0rc1 | No fix listed |
| pypi pillow(PyPI) | = 3.1.1 | No fix listed |
| pypi pillow(PyPI) | = 3.1.2 | No fix listed |
| pypi pillow(PyPI) | = 3.2.0 | No fix listed |
| pypi pillow(PyPI) | = 3.3.0 | No fix listed |
| pypi pillow(PyPI) | = 3.3.1 | No fix listed |
| pypi pillow(PyPI) | = 3.3.2 | No fix listed |
| pypi pillow(PyPI) | = 3.3.3 | No fix listed |
| pypi pillow(PyPI) | = 3.4.0 | No fix listed |
| pypi pillow(PyPI) | = 3.4.1 | No fix listed |
| pypi pillow(PyPI) | = 3.4.2 | No fix listed |
| pypi pillow(PyPI) | = 4.0.0 | No fix listed |
| pypi pillow(PyPI) | = 4.1.0 | No fix listed |
| pypi pillow(PyPI) | = 4.1.1 | No fix listed |
| pypi pillow(PyPI) | = 4.2.0 | No fix listed |
| pypi pillow(PyPI) | = 4.2.1 | No fix listed |
| pypi pillow(PyPI) | = 4.3.0 | No fix listed |
| pypi pillow(PyPI) | = 5.0.0 | No fix listed |
| pypi pillow(PyPI) | = 5.1.0 | No fix listed |
| pypi pillow(PyPI) | = 5.2.0 | No fix listed |
| pypi pillow(PyPI) | = 5.3.0 | No fix listed |
| pypi pillow(PyPI) | = 5.4.0 | No fix listed |
| pypi pillow(PyPI) | = 5.4.0.dev0 | No fix listed |
| pypi pillow(PyPI) | = 5.4.1 | No fix listed |
| pypi pillow(PyPI) | = 6.0.0 | No fix listed |
| pypi pillow(PyPI) | = 6.1.0 | No fix listed |
| pypi pillow(PyPI) | = 6.2.0 | No fix listed |
| pypi pillow(PyPI) | = 6.2.1 | No fix listed |
| pypi pillow(PyPI) | = 6.2.2 | No fix listed |
| pypi pillow(PyPI) | = 7.0.0 | No fix listed |
| debian/pillow(Debian:12) | < 7.2.0-1 | 7.2.0-1 |
| debian/pillow(Debian:13) | < 7.2.0-1 | 7.2.0-1 |
| debian/pillow(Debian:14) | < 7.2.0-1 | 7.2.0-1 |
| python pillow | < 7.1.0 | 7.1.0 |
| debian linux | = 9.0 | No fix listed |
| fedoraproject fedora | = 31 | No fix listed |
| fedoraproject fedora | = 32 | No fix listed |
| Canonical Ubuntu Linux | = 16.04 | No fix listed |
| Canonical Ubuntu Linux | = 18.04 | No fix listed |
| Canonical Ubuntu Linux | = 20.04 | No fix listed |
References
- nvd.nist.gov third-party-advisory vendor-advisory
- github.com
- github.com issue-tracking patch
- github.com issue-tracking patch
- github.com patch
- github.com patch
- github.com patch
- github.com patch
- github.com patch
- github.com patch
- github.com patch
- github.com patch
- github.com patch
- github.com patch
- github.com patch
- pillow.readthedocs.io
- lists.fedoraproject.org
- pillow.readthedocs.io product
- snyk.io
- USN-4430-1 third-party-advisory vendor-advisory
- USN-4430-2 third-party-advisory vendor-advisory
- lists.fedoraproject.org
- [debian-lts-announce] 20200808 [SECURITY] [DLA 2317-1] pillow security update mailing-list third-party-advisory
- github.com broken-link
- github.com product
- github.com
- github.com vendor-advisory
- Debian Security Tracker CVE-2020-10177 vendor-advisory
- FEDORA-2020-d0737711b6 vendor-advisory
- FEDORA-2020-c52106e48a vendor-advisory