In libImaging/SgiRleDecode.c in Pillow through 7.0.0, a number of out-of-bounds reads exist in the parsing of SGI image files, a different issue than CVE-2020-5311.

The remote Rocky Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2020:3185 advisory.

  - In libImaging/SgiRleDecode.c in Pillow through 7.0.0, a number of out-of-bounds reads exist in the parsing     of SGI image files, a different issue than CVE-2020-5311. (CVE-2020-11538)

  - libImaging/FliDecode.c in Pillow before 6.2.2 has an FLI buffer overflow. (CVE-2020-5313)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

According to the versions of the python-pillow package installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities :

  - libImaging/FliDecode.c in Pillow before 6.2.2 has an     FLI buffer overflow.(CVE-2020-5313)

  - An out-of-bounds write flaw was discovered in     python-pillow in the way SGI RLE images are decoded. An     application that uses python-pillow to decode untrusted     images may be vulnerable to this flaw, which can allow     an attacker to crash the application or potentially     execute code on the system.(CVE-2020-5311)

  - libImaging/PcxDecode.c in Pillow before 6.2.2 has a PCX     P mode buffer overflow.(CVE-2020-5312)

  - In libImaging/SgiRleDecode.c in Pillow through 7.0.0, a     number of out-of-bounds reads exist in the parsing of     SGI image files, a different issue than     CVE-2020-5311.(CVE-2020-11538)

  - In libImaging/Jpeg2KDecode.c in Pillow before 7.1.0,     there are multiple out-of-bounds reads via a crafted     JP2 file.(CVE-2020-10994)

  - In libImaging/PcxDecode.c in Pillow before 7.1.0, an     out-of-bounds read can occur when reading PCX files     where state->shuffle is instructed to read beyond     state->buffer.(CVE-2020-10378)

  - Pillow before 7.1.0 has multiple out-of-bounds reads in     libImaging/FliDecode.c.(CVE-2020-10177)

  - libImaging/TiffDecode.c in Pillow before 6.2.2 has a     TIFF decoding integer overflow, related to     realloc.(CVE-2020-5310)

  - In Pillow before 7.1.0, there are two Buffer Overflows     in libImaging/TiffDecode.c.(CVE-2020-10379)

  - There is a DoS vulnerability in Pillow before 6.2.2     caused by FpxImagePlugin.py calling the range function     on an unvalidated 32-bit integer if the number of bands     is large. On Windows running 32-bit Python, this     results in an OverflowError or MemoryError due to the 2     GB limit. However, on Linux running 64-bit Python this     results in the process being terminated by the OOM     killer.(CVE-2019-19911)

  - ** RESERVED ** This candidate has been reserved by an     organization or individual that will use it when     announcing a new security problem. When the candidate     has been publicized, the details for this candidate     will be provided.(CVE-2020-19911)

  - In Pillow before 8.1.0, PcxDecode has a buffer     over-read when decoding a crafted PCX file because the     user-supplied stride value is trusted for buffer     calculations.(CVE-2020-35653)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the python-pillow packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - In Pillow before 8.1.0, PcxDecode has a buffer     over-read when decoding a crafted PCX file because the     user-supplied stride value is trusted for buffer     calculations.(CVE-2020-35653)

  - libImaging/FliDecode.c in Pillow before 6.2.2 has an     FLI buffer overflow.(CVE-2020-5313)

  - In libImaging/Jpeg2KDecode.c in Pillow before 7.1.0,     there are multiple out-of-bounds reads via a crafted     JP2 file.(CVE-2020-10994)

  - In libImaging/SgiRleDecode.c in Pillow through 7.0.0, a     number of out-of-bounds reads exist in the parsing of     SGI image files, a different issue than     CVE-2020-5311.(CVE-2020-11538)

  - There is a DoS vulnerability in Pillow before 6.2.2     caused by FpxImagePlugin.py calling the range function     on an unvalidated 32-bit integer if the number of bands     is large. On Windows running 32-bit Python, this     results in an OverflowError or MemoryError due to the 2     GB limit. However, on Linux running 64-bit Python this     results in the process being terminated by the OOM     killer.(CVE-2019-19911)

  - libImaging/TiffDecode.c in Pillow before 6.2.2 has a     TIFF decoding integer overflow, related to     realloc.(CVE-2020-5310)

  - An out-of-bounds write flaw was discovered in     python-pillow in the way SGI RLE images are decoded. An     application that uses python-pillow to decode untrusted     images may be vulnerable to this flaw, which can allow     an attacker to crash the application or potentially     execute code on the system.(CVE-2020-5311)

  - libImaging/PcxDecode.c in Pillow before 6.2.2 has a PCX     P mode buffer overflow.(CVE-2020-5312)

  - In Pillow before 7.1.0, there are two Buffer Overflows     in libImaging/TiffDecode.c.(CVE-2020-10379)

  - An issue was discovered in Pillow before 6.2.0. When     reading specially crafted invalid image files, the     library can either allocate very large amounts of     memory or take an extremely long period of time to     process the image.(CVE-2019-16865)

  - In libImaging/PcxDecode.c in Pillow before 7.1.0, an     out-of-bounds read can occur when reading PCX files     where state->shuffle is instructed to read beyond     state->buffer.(CVE-2020-10378)

  - Pillow before 7.1.0 has multiple out-of-bounds reads in     libImaging/FliDecode.c.(CVE-2020-10177)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote CentOS Linux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the CESA-2020:3185 advisory.

  - python-pillow: out-of-bounds reads/writes in the parsing of SGI image files in expandrow/expandrow2     (CVE-2020-11538)

  - python-pillow: out-of-bounds read in ImagingFliDecode when loading FLI images (CVE-2020-5313)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

According to the versions of the python-pillow package installed, the EulerOS Virtualization for ARM 64 installation on the remote host is affected by the following vulnerabilities :

  - libImaging/SgiRleDecode.c in Pillow before 6.2.2 has an     SGI buffer overflow.(CVE-2020-5311)

  - In libImaging/SgiRleDecode.c in Pillow through 7.0.0, a     number of out-of-bounds reads exist in the parsing of     SGI image files, a different issue than     CVE-2020-5311.(CVE-2020-11538)

  - There is a DoS vulnerability in Pillow before 6.2.2     caused by FpxImagePlugin.py calling the range function     on an unvalidated 32-bit integer if the number of bands     is large. On Windows running 32-bit Python, this     results in an OverflowError or MemoryError due to the 2     GB limit. However, on Linux running 64-bit Python this     results in the process being terminated by the OOM     killer.(CVE-2019-19911)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the python-pillow packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - There is a DoS vulnerability in Pillow before 6.2.2     caused by FpxImagePlugin.py calling the range function     on an unvalidated 32-bit integer if the number of bands     is large. On Windows running 32-bit Python, this     results in an OverflowError or MemoryError due to the 2     GB limit. However, on Linux running 64-bit Python this     results in the process being terminated by the OOM     killer.(CVE-2019-19911)

  - In libImaging/SgiRleDecode.c in Pillow through 7.0.0, a     number of out-of-bounds reads exist in the parsing of     SGI image files, a different issue than     CVE-2020-5311.(CVE-2020-11538)

  - libImaging/SgiRleDecode.c in Pillow before 6.2.2 has an     SGI buffer overflow.(CVE-2020-5311)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Redhat Enterprise Linux 8 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2020:3302 advisory.

  - python-pillow: out-of-bounds reads/writes in the parsing of SGI image files in expandrow/expandrow2     (CVE-2020-11538)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2020:3299 advisory.

  - python-pillow: out-of-bounds reads/writes in the parsing of SGI image files in expandrow/expandrow2     (CVE-2020-11538)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

From Red Hat Security Advisory 2020:3185 :

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2020:3185 advisory.

  - python-pillow: out-of-bounds reads/writes in the parsing     of SGI image files in expandrow/expandrow2     (CVE-2020-11538)

  - python-pillow: out-of-bounds read in ImagingFliDecode     when loading FLI images (CVE-2020-5313)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2020:3185 advisory.

  - python-pillow: out-of-bounds reads/writes in the parsing of SGI image files in expandrow/expandrow2     (CVE-2020-11538)

  - python-pillow: out-of-bounds read in ImagingFliDecode when loading FLI images (CVE-2020-5313)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

USN-4430-1 fixed vulnerabilities in Pillow. This update provides the corresponding updates for Ubuntu 20.04 LTS.

It was discovered that Pillow incorrectly handled certain image files.
If a user or automated system were tricked into opening a specially crafted image file, a remote attacker could possibly cause Pillow to crash, resulting in a denial of service.

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

It was discovered that Pillow incorrectly handled certain image files.
If a user or automated system were tricked into opening a specially crafted image file, a remote attacker could possibly cause Pillow to crash, resulting in a denial of service.

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update fixes CVE-2020-10177, CVE-2020-10994, CVE-2020-10379, CVE-2020-11538 and CVE-2020-10378.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Severity
184729	Rocky Linux 8 : python-pillow (RLSA-2020:3185)	Nessus	Rocky Linux Local Security Checks	high
148586	EulerOS Virtualization 2.9.0 : python-pillow (EulerOS-SA-2021-1743)	Nessus	Huawei Local Security Checks	critical
148585	EulerOS Virtualization 2.9.1 : python-pillow (EulerOS-SA-2021-1729)	Nessus	Huawei Local Security Checks	critical
146238	EulerOS 2.0 SP9 : python-pillow (EulerOS-SA-2021-1273)	Nessus	Huawei Local Security Checks	critical
146225	EulerOS 2.0 SP9 : python-pillow (EulerOS-SA-2021-1254)	Nessus	Huawei Local Security Checks	critical
145996	CentOS 8 : python-pillow (CESA-2020:3185)	Nessus	CentOS Local Security Checks	high
140972	EulerOS Virtualization for ARM 64 3.0.6.0 : python-pillow (EulerOS-SA-2020-2024)	Nessus	Huawei Local Security Checks	critical
139980	EulerOS 2.0 SP8 : python-pillow (EulerOS-SA-2020-1877)	Nessus	Huawei Local Security Checks	critical
139321	RHEL 8 : python-pillow (RHSA-2020:3302)	Nessus	Red Hat Local Security Checks	high
139319	RHEL 8 : python-pillow (RHSA-2020:3299)	Nessus	Red Hat Local Security Checks	high
139163	Oracle Linux 8 : python-pillow (ELSA-2020-3185)	Nessus	Oracle Linux Local Security Checks	high
139042	RHEL 8 : python-pillow (RHSA-2020:3185)	Nessus	Red Hat Local Security Checks	high
138997	Ubuntu 20.04 LTS : Pillow vulnerabilities (USN-4430-2)	Nessus	Ubuntu Local Security Checks	high
138874	Ubuntu 16.04 LTS / 18.04 LTS : Pillow vulnerabilities (USN-4430-1)	Nessus	Ubuntu Local Security Checks	high
138367	Fedora 31 : python-pillow (2020-d0737711b6)	Nessus	Fedora Local Security Checks	high
138116	Fedora 32 : python-pillow (2020-c52106e48a)	Nessus	Fedora Local Security Checks	high

Detections

Analytics

CVE-2020-11538

high

Tenable Plugins

high

critical

critical

critical

critical

high

critical

critical

high

high

high

high

high

high

high

high