CVE-2020-5313: Pillow - FLI Buffer Overflow
Summary
CVE-2020-5313: libImaging/FliDecode.c in Pillow before 6.2.2 has an FLI buffer overflow. Affects pillow versions < 6.2.2. Fixed in 6.2.2. How to fix ↓
Also tracked for
- pillow · PyPI
- py3-pillow · Alpine:v3.12
- pillow · PyPI
The same CVE-2020-5313 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Pillow is a popular Python library for image processing and manipulation. It provides a wide range of functionality for working with images. However, versions of Pillow prior to 6.2.2 are vulnerable to a buffer overflow in the libImaging/FliDecode.c module. This vulnerability can be exploited by an attacker to execute arbitrary code or cause a denial of service.
Vulnerability Detail
The vulnerability in Pillow arises from a buffer overflow in the libImaging/FliDecode.c module. This module is responsible for decoding FLI image files. By providing a specially crafted FLI file, an attacker can trigger a buffer overflow, leading to arbitrary code execution or a crash of the application. The severity of this vulnerability is rated as high.
How To Fix
Minimum fixed version
6.2.2
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is highly recommended to upgrade to the latest version of Pillow to ensure the security of your application.
Conclusion
In conclusion, the vulnerability in Pillow (CVE-2020-5313) is a high-severity issue that can lead to arbitrary code execution or a denial of service. It is crucial to upgrade to Pillow version 6.2.2 or later to mitigate this vulnerability. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for pillow →
FAQ
Pillow is a Python library for image processing and manipulation. It provides various functions and methods for working with images.
This vulnerability allows an attacker to execute arbitrary code or cause a denial of service by exploiting a buffer overflow in the FLI decoding module of Pillow.
To fix this vulnerability, you should upgrade to Pillow version 6.2.2 or later. This version includes a fix for the buffer overflow issue.
There is no known workaround for this vulnerability. It is recommended to upgrade to the latest version of Pillow.
You can find more information about this vulnerability in the official CVE entry: CVE-2020-5313.
Related vulnerabilities
Recent vulnerabilities recorded for pillow.
