CVE-2020-10379: Buffer Overflows in Pillow libImaging/TiffDecode.c
Summary
CVE-2020-10379: In Pillow before 7.1.0, there are two Buffer Overflows in libImaging/TiffDecode.c. Affects pillow versions < 7.1.0. Fixed in 7.1.0. How to fix ↓
Also tracked for
The same CVE-2020-10379 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Pillow is an open-source Python library for image processing and manipulation. It provides a wide range of functions and supports various image file formats. However, versions prior to 7.1.0 of Pillow are vulnerable to two Buffer Overflows in the libImaging/TiffDecode.c module. These vulnerabilities can be exploited by an attacker to execute arbitrary code or cause a denial of service.
Vulnerability Detail
The Buffer Overflows in libImaging/TiffDecode.c in Pillow before 7.1.0 can occur due to improper bounds checking when processing TIFF image files. This can lead to a buffer overflow, allowing an attacker to overwrite adjacent memory and potentially execute arbitrary code. The vulnerabilities can be triggered by a specially crafted TIFF file, and successful exploitation could result in remote code execution or a crash of the application.
How To Fix
Minimum fixed version
7.1.0
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can avoid processing untrusted TIFF image files until the vulnerability is patched. Additionally, it is recommended to implement proper input validation and sanitization when handling image files to mitigate the risk of exploitation.
Conclusion
In conclusion, the Buffer Overflows in Pillow's libImaging/TiffDecode.c module pose a significant security risk. It is crucial to upgrade to Pillow version 7.1.0 or later to mitigate these vulnerabilities. Users should also exercise caution when handling image files and implement proper input validation to prevent potential exploitation. For further support and assistance in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for pillow →
FAQ
Pillow is an open-source Python library for image processing and manipulation. It provides various functions and supports multiple image file formats.
The vulnerabilities can allow an attacker to execute arbitrary code or cause a denial of service. Successful exploitation could result in remote code execution or a crash of the application.
To fix the vulnerability, it is recommended to upgrade to Pillow version 7.1.0 or later. Users can update their Pillow installation through package managers or by manually installing the latest version from the official repository.
As a temporary workaround, users can avoid processing untrusted TIFF image files until the vulnerability is patched. It is also important to implement proper input validation and sanitization when handling image files.
You can find more information about the vulnerability in the official vulnerability report provided by Bitnami.
References
Related vulnerabilities
Recent vulnerabilities recorded for pillow.
