CVE-2020-10177 — Out-of-bounds Read in Pillow

CWE-125 — Out-of-bounds Read16 documents9 sources
Severity
5.5MEDIUMNVD
EPSS
0.3%
top 44.99%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
4
Python PillowCanonical Ubuntu LinuxDebian Linux+1 more
Timeline
PublishedJun 25
Latest updateFeb 20

Description

Pillow before 7.1.0 has multiple out-of-bounds reads in libImaging/FliDecode.c.

CVSS vector

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:NExploitability: 1.8 | Impact: 3.6

Affected Packages4 packages

▶NVDpython/pillow< 7.1.0
▶PyPIpython/pillow< 7.1.0
▶Debianpython/pillow< 7.2.0-1+3
▶Ubuntupython/pillow< 2.3.0-1ubuntu3.4+esm2

Also affects: Debian Linux 9.0, Fedora 31, 32, Ubuntu Linux 16.04, 18.04, 20.04

Patches

Patch: github.com ↗Patch: github.com ↗Patch: github.com ↗

🔴Vulnerability Details

5
OSV
pillow vulnerabilities↗2021-01-20
▶
GHSA
Out-of-bounds reads in Pillow↗2020-07-27
▶
OSV
Out-of-bounds reads in Pillow↗2020-07-27
▶
CVEList
CVE-2020-10177: Pillow before 7↗2020-06-25
▶
OSV
CVE-2020-10177: Pillow before 7↗2020-06-25
▶

📋Vendor Advisories

5
Ubuntu
Pillow vulnerabilities↗2021-01-20
▶
Ubuntu
Pillow vulnerabilities↗2020-07-23
▶
Ubuntu
Pillow vulnerabilities↗2020-07-22
▶
Red Hat
python-pillow: multiple out-of-bounds reads in libImaging/FliDecode.c↗2020-06-25
▶
Debian
CVE-2020-10177: pillow - Pillow before 7.1.0 has multiple out-of-bounds reads in libImaging/FliDecode.c.↗2020
▶

📄Research Papers

1
arXiv
Detecting PowerShell-based Fileless Cryptojacking Attacks Using Machine Learning↗2026-02-20
▶

💬Community

4
Bugzilla
CVE-2020-10177 python-pillow: multiple out-of-bounds reads in libImaging/FliDecode.c [fedora-31]↗2020-07-01
▶
Bugzilla
CVE-2020-10177 python-pillow: multiple out-of-bounds reads in libImaging/FliDecode.c↗2020-07-01
▶
Bugzilla
CVE-2020-10177 python-pillow: multiple out-of-bounds reads in libImaging/FliDecode.c [fedora-32]↗2020-07-01
▶
Bugzilla
CVE-2018-10177 ImageMagick: Infinite loop in coders/png.c:ReadOneMNGImage() allows attackers to cause a denial of service via crafted MNG file↗2018-04-26
▶
CVE-2020-10177 — Out-of-bounds Read in Python Pillow | cvebase