The remote Fedora 32 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2021-880aa7bd27 advisory.

  - In Pillow before 8.1.0, PcxDecode has a buffer over-read when decoding a crafted PCX file because the     user-supplied stride value is trusted for buffer calculations. (CVE-2020-35653)

  - In Pillow before 8.1.0, TiffDecode has a heap-based buffer overflow when decoding crafted YCbCr files     because of certain interpretation conflicts with LibTIFF in RGBA mode. (CVE-2020-35654)

  - In Pillow before 8.1.0, SGIRleDecode has a 4-byte buffer over-read when decoding crafted SGI RLE image     files because offsets and length tables are mishandled. (CVE-2020-35655)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

Detections

Analytics

Fedora 32 : python-pillow (2021-880aa7bd27)

high Nessus Plugin ID 145337

No dependents found