Summary
It was discovered that Pillow incorrectly handled certain image files. If
a user or automated system were tricked into opening a specially-crafted
image file, a remote attacker could possibly cause Pillow to crash,
resulting in a denial of service.
Fixed packages 2
| Release | Package | Fixed in |
|---|---|---|
| Ubuntu · 16.04 LTS 16.04:LTS | pillow | 3.1.2-0ubuntu1.4 |
| Ubuntu · 18.04 LTS 18.04:LTS | pillow | 5.1.0-1ubuntu0.3 |
Vulnerabilities 4
-
High 8.1
Out-of-bounds read in Pillow
In libImaging/SgiRleDecode.c in Pillow through 7.0.0, a number of out-of-bounds reads exist in the parsing of SGI image files, a different issue than CVE-2020-5311.
-
Medium 5.5
Out-of-bounds reads in Pillow
Pillow before 7.1.0 has multiple out-of-bounds reads in libImaging/FliDecode.c.
-
Medium 5.5
Out-of-bounds read in Pillow
In libImaging/PcxDecode.c in Pillow before 7.1.0, an out-of-bounds read can occur when reading PCX files where state->shuffle is instructed to read beyond state->buffer.
-
Medium 5.5
Out-of-bounds reads in Pillow
In libImaging/Jpeg2KDecode.c in Pillow before 7.1.0, there are multiple out-of-bounds reads via a crafted JP2 file.