CVE-2020-11538 — Out-of-bounds Read in Pillow
Severity
8.1HIGHNVD
GHSA9.8OSV9.8
EPSS
0.3%
top 49.80%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
Timeline
PublishedJun 25
Latest updateFeb 14
Description
In libImaging/SgiRleDecode.c in Pillow through 7.0.0, a number of out-of-bounds reads exist in the parsing of SGI image files, a different issue than CVE-2020-5311.
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:HExploitability: 2.2 | Impact: 5.9
Affected Packages4 packages
Also affects: Fedora 31, 32, Ubuntu Linux 16.04, 18.04, 20.04
Patches
🔴Vulnerability Details
4📋Vendor Advisories
5💬Community
3Bugzilla▶
CVE-2020-11538 python-pillow: number of out-of-bounds reads in the parsing of SGI image files [fedora-31]↗2020-07-01
Bugzilla▶
CVE-2020-11538 python-pillow: out-of-bounds reads/writes in the parsing of SGI image files in expandrow/expandrow2↗2020-07-01
Bugzilla▶
CVE-2020-11538 python-pillow: number of out-of-bounds reads in the parsing of SGI image files [fedora-32]↗2020-07-01