Buffer Overflow Vulnerability in Pillow (CVE-2020-5311)
Summary
CVE-2020-5311: libImaging/SgiRleDecode.c in Pillow before 6.2.2 has an SGI buffer overflow. Affects py3-pillow across 2 version ranges.
< 6.2.2-r0
< a79b65c47c7dc6fe623aadf09aa6192fc54548f3
Fixed in 6.2.2-r0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Pillow is an open-source Python imaging library that provides support for opening, manipulating, and saving many different image file formats. It is widely used in various applications for image processing and manipulation. However, Pillow versions before 6.2.2 are vulnerable to a buffer overflow in the SGI RLE decoding functionality.
Vulnerability Detail
The vulnerability (CVE-2020-5311) originates from a buffer overflow in the libImaging/SgiRleDecode.c file of the Pillow library. This buffer overflow can be exploited by an attacker to execute arbitrary code or cause a denial-of-service condition. The vulnerability has a CVSS v3 score of 9.8, indicating its high severity. It affects all versions of Pillow prior to 6.2.2.
How To Fix
Minimum fixed version
6.2.2-r0
This is the first release that contains the fix.
sudo apk add --upgrade py3-pillowTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is crucial to update to the fixed version of Pillow to mitigate the risk of exploitation.
Conclusion
In conclusion, the buffer overflow vulnerability (CVE-2020-5311) in Pillow can lead to arbitrary code execution or denial-of-service attacks. It is crucial to update to version 6.2.2 or later to mitigate the risk. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for py3-pillow →
FAQ
Pillow is a popular Python imaging library used for image processing and manipulation.
The vulnerability allows an attacker to execute arbitrary code or cause a denial-of-service condition.
To fix this vulnerability, update Pillow to version 6.2.2 or later.
No, there is no known workaround for this vulnerability.
The CVSS v3 score of this vulnerability is 9.8, indicating its high severity.
Related vulnerabilities
Recent vulnerabilities recorded for py3-pillow.
