Buffer Overflow Vulnerability in Pillow Package: CVE-2020-10379
Summary
CVE-2020-10379: In Pillow before 7.1.0, there are two Buffer Overflows in libImaging/TiffDecode.c. Affects pillow across 2 version ranges.
< 7.2.0-1
< 46f4a349b88915787fea3fb91348bb1665831bbb
Fixed in 7.2.0-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Pillow is a widely used Python Imaging Library that provides extensive capabilities for opening, manipulating, and saving various image file formats. It is an essential tool for developers working with images in Python applications. However, prior to version 7.1.0, Pillow contained a critical vulnerability that could lead to buffer overflows, potentially allowing attackers to execute arbitrary code or crash the application.
Vulnerability Detail
CVE-2020-10379 is a buffer overflow vulnerability found in the libImaging/TiffDecode.c file of the Pillow library. This vulnerability arises from improper handling of TIFF image files, which can be exploited by an attacker to craft a malicious TIFF file. When processed by an affected version of Pillow, this can lead to memory corruption, allowing the attacker to execute arbitrary code or cause a denial of service. The severity of this vulnerability is underscored by its CVSS score of 7.8, indicating a high risk to applications using vulnerable versions of Pillow.
How To Fix
Minimum fixed version
7.2.0-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade pillowTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If upgrading is not immediately possible, a temporary workaround is to avoid processing untrusted TIFF files until the library is updated. Additionally, consider implementing input validation to check the integrity of image files before processing them.
Conclusion
CVE-2020-10379 represents a serious security risk for applications using vulnerable versions of the Pillow library. Users are strongly advised to upgrade to version 7.2.0 or later to mitigate this risk. Additionally, utilizing tools like Vulert can help monitor for such vulnerabilities in real-time.
See every vulnerability recorded for pillow →
FAQ
CVE-2020-10379 is a buffer overflow vulnerability in the Pillow library that can be exploited through malicious TIFF files.
You can use Vulert to monitor and alert for open-source vulnerabilities in your software. Visit Vulert Scanner to check if your application is affected without any signup.
Exploitation of this vulnerability can lead to arbitrary code execution or denial of service, posing significant risks to application security.
Versions of Pillow prior to 7.2.0 are affected by this vulnerability.
If an immediate upgrade is not feasible, avoid processing untrusted TIFF files and implement input validation as a temporary measure.
Related vulnerabilities
Recent vulnerabilities recorded for pillow.
