High ELSA-2020-3185 2 CVEs

Important: python-pillow security update (Oracle Linux 8)

Published Jul 29, 2020 · Updated Jul 29, 2020

Ecosystem: Oracle Linux

Summary

[5.1.1-12]
- Fix for CVE-2020-5313
Resolves: rhbz#1789532

[5.1.1-11]
- Fix for CVE-2020-11538
Resolves: rhbz#1852814

Fixed packages 1

Release	Package	Fixed in
Oracle Linux · 8	python3-pillow	0:5.1.1-12.el8_2

Vulnerabilities 2

High 8.1

CVE-2020-11538

Out-of-bounds read in Pillow

In libImaging/SgiRleDecode.c in Pillow through 7.0.0, a number of out-of-bounds reads exist in the parsing of SGI image files, a different issue than CVE-2020-5311.

pillow pillow pillow pillow-python2 Debian Ubuntu PyPI

Jun 25, 2020
High 7.1

CVE-2020-5313

Out-of-bounds Read in Pillow

libImaging/FliDecode.c in Pillow before 6.2.2 has an FLI buffer overflow.

pillow pillow pillow py3-pillow Debian Ubuntu Alpine PyPI

Jan 3, 2020