Medium ALAS2-2024-2648 1 CVE

Moderate: python-pillow security update (Amazon Linux 2)

Published Sep 25, 2024 · Updated Oct 2, 2024

Ecosystem: Amazon Linux

Summary

Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2020-10177: Pillow before 7.1.0 has multiple out-of-bounds reads in libImaging/FliDecode.c.

Fixed packages 6

Release	Package	Fixed in
Amazon Linux · 2	python-pillow	0:2.0.0-23.gitd1c6db8.amzn2.0.13
Amazon Linux · 2	python-pillow-debuginfo	0:2.0.0-23.gitd1c6db8.amzn2.0.13
Amazon Linux · 2	python-pillow-devel	0:2.0.0-23.gitd1c6db8.amzn2.0.13
Amazon Linux · 2	python-pillow-doc	0:2.0.0-23.gitd1c6db8.amzn2.0.13
Amazon Linux · 2	python-pillow-sane	0:2.0.0-23.gitd1c6db8.amzn2.0.13
Amazon Linux · 2	python-pillow-tk	0:2.0.0-23.gitd1c6db8.amzn2.0.13

Vulnerabilities 1

Medium 5.5

CVE-2020-10177

Out-of-bounds reads in Pillow

Pillow before 7.1.0 has multiple out-of-bounds reads in libImaging/FliDecode.c.

pillow pillow pillow pillow-python2 Debian Ubuntu PyPI

Jun 25, 2020

References

web
https://alas.aws.amazon.com/cve/html/CVE-2020-10177.html