CVE-2020-10379 :: Enginsight Vulnerability Database

Provider	Type	Base Score	Atk. Vector	Atk. Complexity	Priv. Required	Vector
NIST	Primary	7.8 HIGH	LOCAL	LOW	NONE	CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Base Score

CVSS 3.x

EPSS Score

Percentile: 60%

Affected Products (NVD)

Vendor	Product	Version
python	pillow	𝑥 < 7.1.0
canonical	ubuntu_linux	20.04

𝑥

= Vulnerable software versions

Debian Releases

Debian Product

Codename

pillow

bookworm	9.4.0-1.1+deb12u1 fixed
bookworm (security)	9.4.0-1.1+deb12u1 fixed
bullseye	8.1.2+dfsg-0.3+deb11u2 fixed
bullseye (security)	8.1.2+dfsg-0.3+deb11u2 fixed
buster	not-affected
jessie	not-affected
sid	10.4.0-1 fixed
stretch	not-affected
trixie	10.4.0-1 fixed

Ubuntu Releases

Ubuntu Product

Codename

pillow

bionic	not-affected
eoan	ignored
focal	Fixed 7.0.0-4ubuntu0.1 released
groovy	not-affected
hirsute	not-affected
impish	not-affected
jammy	not-affected
kinetic	not-affected
lunar	not-affected
mantic	not-affected
noble	not-affected
trusty	not-affected
xenial	not-affected

pillow-python2

bionic	dne
focal	needs-triage
groovy	ignored
hirsute	dne
impish	dne
jammy	dne
kinetic	dne
lunar	dne
mantic	dne
noble	dne
trusty	dne
xenial	dne

python-imaging

bionic	dne
focal	dne
groovy	dne
hirsute	dne
impish	dne
jammy	dne
kinetic	dne
lunar	dne
mantic	dne
noble	dne
trusty	dne
xenial	dne

Common Weakness Enumeration

CWE-120 - Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')
The program copies an input buffer to an output buffer without verifying that the size of the input buffer is less than the size of the output buffer, leading to a buffer overflow.

References

https://github.com/python-pillow/Pillow/commit/46f4a349b88915787fea3fb91348bb1665831bbb#diff-9478f2787e3ae9668a15123b165c23ac

https://github.com/python-pillow/Pillow/commits/master/src/libImaging

https://github.com/python-pillow/Pillow/pull/4538

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/BEBCPE4F2VHTIT6EZA2YZQZLPVDEBJGD/

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HOKHNWV2VS5GESY7IBD237E7C6T3I427/

https://pillow.readthedocs.io/en/stable/releasenotes/7.1.0.html

https://usn.ubuntu.com/4430-2/

https://github.com/python-pillow/Pillow/commit/46f4a349b88915787fea3fb91348bb1665831bbb#diff-9478f2787e3ae9668a15123b165c23ac

https://github.com/python-pillow/Pillow/commits/master/src/libImaging

https://github.com/python-pillow/Pillow/pull/4538

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/BEBCPE4F2VHTIT6EZA2YZQZLPVDEBJGD/

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HOKHNWV2VS5GESY7IBD237E7C6T3I427/

https://pillow.readthedocs.io/en/stable/releasenotes/7.1.0.html

https://usn.ubuntu.com/4430-2/