CVE-2020-10379 — Classic Buffer Overflow in Pillow

CWE-120 — Classic Buffer Overflow13 documents9 sources
Severity
7.8HIGHNVD
EPSS
0.4%
top 41.76%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
4
Python PillowCanonical Ubuntu LinuxFedoraproject Fedora+1 more
Timeline
PublishedJun 25
Latest updateFeb 14

Description

In Pillow before 7.1.0, there are two Buffer Overflows in libImaging/TiffDecode.c.

CVSS vector

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:HExploitability: 1.8 | Impact: 5.9

Affected Packages4 packages

▶NVDpython/pillow< 7.1.0
▶PyPIpython/pillow< 7.1.0
▶Debianpython/pillow< 7.2.0-1+3
▶Palo Altopaloalto/pan-os

Also affects: Fedora 31, 32, Ubuntu Linux 20.04

Patches

Patch: github.com ↗Patch: github.com ↗Patch: github.com ↗

🔴Vulnerability Details

4
OSV
Buffer overflow in Pillow↗2020-07-27
▶
GHSA
Buffer overflow in Pillow↗2020-07-27
▶
OSV
CVE-2020-10379: In Pillow before 7↗2020-06-25
▶
CVEList
CVE-2020-10379: In Pillow before 7↗2020-06-25
▶

📋Vendor Advisories

4
Palo Alto
PAN-SA-2024-0001 Informational Bulletin: Impact of OSS CVEs in PAN-OS↗2024-02-14
▶
Ubuntu
Pillow vulnerabilities↗2020-07-23
▶
Red Hat
python-pillow: two buffer overflows in libImaging/TiffDecode.c due to small buffers allocated in ImagingLibTiffDecode()↗2020-06-25
▶
Debian
CVE-2020-10379: pillow - In Pillow before 7.1.0, there are two Buffer Overflows in libImaging/TiffDecode....↗2020
▶

💬Community

4
Bugzilla
CVE-2020-10379 python-pillow: two Buffer Overflows in libImaging/TiffDecode.c [fedora-32]↗2020-07-01
▶
Bugzilla
CVE-2020-11538 python-pillow: out-of-bounds reads/writes in the parsing of SGI image files in expandrow/expandrow2↗2020-07-01
▶
Bugzilla
CVE-2020-10379 python-pillow: two buffer overflows in libImaging/TiffDecode.c due to small buffers allocated in ImagingLibTiffDecode() [fedora-31]↗2020-07-01
▶
Bugzilla
CVE-2020-10379 python-pillow: two buffer overflows in libImaging/TiffDecode.c due to small buffers allocated in ImagingLibTiffDecode()↗2020-07-01
▶
CVE-2020-10379 — Classic Buffer Overflow in Python | cvebase