Out-of-Bounds Read Vulnerability in Pillow Package
Summary
CVE-2020-10378: In libImaging/PcxDecode.c in Pillow before 7.1.0, an out-of-bounds read can occur when reading PCX files where state->shuffle is instructed to read beyond state->buffer. Affects pillow across 2 version ranges.
< 6a83e4324738bb0452fbe8074a995b1c73f08de7
< 7.2.0-1
Fixed in 7.2.0-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
Pillow is a widely-used Python Imaging Library that adds image processing capabilities to your Python interpreter. It supports opening, manipulating, and saving many different image file formats. However, prior to version 7.1.0, Pillow was susceptible to an out-of-bounds read vulnerability when processing PCX files, which could lead to potential information leakage.
Vulnerability Detail
The vulnerability identified as CVE-2020-10378 occurs in the libImaging/PcxDecode.c file of the Pillow library. It allows an out-of-bounds read when reading PCX files, specifically when the state->shuffle variable is instructed to read beyond the allocated state->buffer. This can lead to unintended memory access, potentially exposing sensitive information or causing application crashes. The vulnerability has a CVSS score of 5.5, indicating a moderate level of risk.
How To Fix
Minimum fixed version
7.2.0-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade pillowTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If upgrading is not immediately possible, consider implementing input validation to ensure that PCX files are properly formatted before processing them with Pillow. This can help mitigate the risk of triggering the vulnerability.
Conclusion
CVE-2020-10378 represents a significant vulnerability in the Pillow library that can lead to out-of-bounds reads when processing PCX files. Users are strongly advised to upgrade to the latest version to mitigate risks associated with this vulnerability. For those unable to upgrade immediately, implementing input validation can serve as a temporary workaround.
See every vulnerability recorded for pillow →
FAQ
CVE-2020-10378 is a vulnerability in the Pillow library that allows for an out-of-bounds read when processing PCX files, potentially leading to information leakage.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without requiring any signup.
Pillow versions prior to 7.1.0 are affected by this vulnerability. It is recommended to upgrade to version 7.2.0-1 or later.
If an immediate upgrade is not feasible, implement input validation to ensure that PCX files are correctly formatted before processing.
The CVSS score for CVE-2020-10378 is 5.5, indicating a moderate risk level.
Related vulnerabilities
Recent vulnerabilities recorded for pillow.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
