libImaging/TiffDecode.c in Pillow before 6.2.2 has a TIFF decoding integer overflow, related to realloc.

According to the versions of the python-pillow package installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities :

  - libImaging/FliDecode.c in Pillow before 6.2.2 has an     FLI buffer overflow.(CVE-2020-5313)

  - An out-of-bounds write flaw was discovered in     python-pillow in the way SGI RLE images are decoded. An     application that uses python-pillow to decode untrusted     images may be vulnerable to this flaw, which can allow     an attacker to crash the application or potentially     execute code on the system.(CVE-2020-5311)

  - libImaging/PcxDecode.c in Pillow before 6.2.2 has a PCX     P mode buffer overflow.(CVE-2020-5312)

  - In libImaging/SgiRleDecode.c in Pillow through 7.0.0, a     number of out-of-bounds reads exist in the parsing of     SGI image files, a different issue than     CVE-2020-5311.(CVE-2020-11538)

  - In libImaging/Jpeg2KDecode.c in Pillow before 7.1.0,     there are multiple out-of-bounds reads via a crafted     JP2 file.(CVE-2020-10994)

  - In libImaging/PcxDecode.c in Pillow before 7.1.0, an     out-of-bounds read can occur when reading PCX files     where state->shuffle is instructed to read beyond     state->buffer.(CVE-2020-10378)

  - Pillow before 7.1.0 has multiple out-of-bounds reads in     libImaging/FliDecode.c.(CVE-2020-10177)

  - libImaging/TiffDecode.c in Pillow before 6.2.2 has a     TIFF decoding integer overflow, related to     realloc.(CVE-2020-5310)

  - In Pillow before 7.1.0, there are two Buffer Overflows     in libImaging/TiffDecode.c.(CVE-2020-10379)

  - There is a DoS vulnerability in Pillow before 6.2.2     caused by FpxImagePlugin.py calling the range function     on an unvalidated 32-bit integer if the number of bands     is large. On Windows running 32-bit Python, this     results in an OverflowError or MemoryError due to the 2     GB limit. However, on Linux running 64-bit Python this     results in the process being terminated by the OOM     killer.(CVE-2019-19911)

  - ** RESERVED ** This candidate has been reserved by an     organization or individual that will use it when     announcing a new security problem. When the candidate     has been publicized, the details for this candidate     will be provided.(CVE-2020-19911)

  - In Pillow before 8.1.0, PcxDecode has a buffer     over-read when decoding a crafted PCX file because the     user-supplied stride value is trusted for buffer     calculations.(CVE-2020-35653)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the python-pillow package installed, the EulerOS Virtualization for ARM 64 installation on the remote host is affected by the following vulnerabilities :

  - In Pillow before 8.1.0, PcxDecode has a buffer     over-read when decoding a crafted PCX file because the     user-supplied stride value is trusted for buffer     calculations.(CVE-2020-35653)

  - In Pillow before 7.1.0, there are two Buffer Overflows     in libImaging/TiffDecode.c.(CVE-2020-10379)

  - libImaging/TiffDecode.c in Pillow before 6.2.2 has a     TIFF decoding integer overflow, related to     realloc.(CVE-2020-5310)

  - In libImaging/PcxDecode.c in Pillow before 7.1.0, an     out-of-bounds read can occur when reading PCX files     where state->shuffle is instructed to read beyond     state->buffer.(CVE-2020-10378)

  - In libImaging/Jpeg2KDecode.c in Pillow before 7.1.0,     there are multiple out-of-bounds reads via a crafted     JP2 file.(CVE-2020-10994)

  - Pillow before 7.1.0 has multiple out-of-bounds reads in     libImaging/FliDecode.c.(CVE-2020-10177)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the python-pillow packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - In Pillow before 8.1.0, PcxDecode has a buffer     over-read when decoding a crafted PCX file because the     user-supplied stride value is trusted for buffer     calculations.(CVE-2020-35653)

  - libImaging/FliDecode.c in Pillow before 6.2.2 has an     FLI buffer overflow.(CVE-2020-5313)

  - In libImaging/Jpeg2KDecode.c in Pillow before 7.1.0,     there are multiple out-of-bounds reads via a crafted     JP2 file.(CVE-2020-10994)

  - In libImaging/SgiRleDecode.c in Pillow through 7.0.0, a     number of out-of-bounds reads exist in the parsing of     SGI image files, a different issue than     CVE-2020-5311.(CVE-2020-11538)

  - There is a DoS vulnerability in Pillow before 6.2.2     caused by FpxImagePlugin.py calling the range function     on an unvalidated 32-bit integer if the number of bands     is large. On Windows running 32-bit Python, this     results in an OverflowError or MemoryError due to the 2     GB limit. However, on Linux running 64-bit Python this     results in the process being terminated by the OOM     killer.(CVE-2019-19911)

  - libImaging/TiffDecode.c in Pillow before 6.2.2 has a     TIFF decoding integer overflow, related to     realloc.(CVE-2020-5310)

  - An out-of-bounds write flaw was discovered in     python-pillow in the way SGI RLE images are decoded. An     application that uses python-pillow to decode untrusted     images may be vulnerable to this flaw, which can allow     an attacker to crash the application or potentially     execute code on the system.(CVE-2020-5311)

  - libImaging/PcxDecode.c in Pillow before 6.2.2 has a PCX     P mode buffer overflow.(CVE-2020-5312)

  - In Pillow before 7.1.0, there are two Buffer Overflows     in libImaging/TiffDecode.c.(CVE-2020-10379)

  - An issue was discovered in Pillow before 6.2.0. When     reading specially crafted invalid image files, the     library can either allocate very large amounts of     memory or take an extremely long period of time to     process the image.(CVE-2019-16865)

  - In libImaging/PcxDecode.c in Pillow before 7.1.0, an     out-of-bounds read can occur when reading PCX files     where state->shuffle is instructed to read beyond     state->buffer.(CVE-2020-10378)

  - Pillow before 7.1.0 has multiple out-of-bounds reads in     libImaging/FliDecode.c.(CVE-2020-10177)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the python-pillow packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - In libImaging/PcxDecode.c in Pillow before 7.1.0, an     out-of-bounds read can occur when reading PCX files     where state->shuffle is instructed to read beyond     state->buffer.(CVE-2020-10378)

  - Pillow before 7.1.0 has multiple out-of-bounds reads in     libImaging/FliDecode.c.(CVE-2020-10177)

  - libImaging/TiffDecode.c in Pillow before 6.2.2 has a     TIFF decoding integer overflow, related to     realloc.(CVE-2020-5310)

  - In Pillow before 7.1.0, there are two Buffer Overflows     in libImaging/TiffDecode.c.(CVE-2020-10379)

  - In libImaging/Jpeg2KDecode.c in Pillow before 7.1.0,     there are multiple out-of-bounds reads via a crafted     JP2 file.(CVE-2020-10994)

  - In Pillow before 8.1.0, PcxDecode has a buffer     over-read when decoding a crafted PCX file because the     user-supplied stride value is trusted for buffer     calculations.(CVE-2020-35653)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Backport patches for CVE-2020-5313, CVE-2020-5312, CVE-2020-5311, CVE-2020-5310, CVE-2019-19911

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Ubuntu 16.04 LTS / 18.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-4272-1 advisory.

    It was discovered that Pillow incorrectly handled certain images. An attacker could possibly use this     issue to cause a denial of service. (CVE-2019-16865, CVE-2019-19911)

    It was discovered that Pillow incorrectly handled certain images. An attacker could possibly use this     issue to execute arbitrary code. (CVE-2020-5312)

    It was discovered that Pillow incorrectly handled certain TIFF images. An attacker could possibly use this     issue to cause a crash. This issue only affected Ubuntu 19.10. (CVE-2020-5310)

    It was discovered that Pillow incorrectly handled certain SGI images. An attacker could possibly use this     issue to execute arbitrary code or cause a crash. This issue only affected Ubuntu 18.04 and Ubuntu 19.10.
    (CVE-2020-5311)

    It was discovered that Pillow incorrectly handled certain PCX images. An attackter could possibly use this     issue to execute arbitrary code or cause a crash. (CVE-2020-5312)

    It was discovered that Pillow incorrectly handled certain Flip images. An attacker could possibly use this     issue to execute arbitrary code or cause a crash. (CVE-2020-5313)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Update to 6.2.2, fixes CVE-2020-5313, CVE-2020-5312, CVE-2020-5311, CVE-2020-5310.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Pillow developers report :

This release addresses several security problems, as well as addressing CVE-2019-19911.

CVE-2019-19911 is regarding FPX images. If an image reports that it has a large number of bands, a large amount of resources will be used when trying to process the image. This is fixed by limiting the number of bands to those usable by Pillow.

Buffer overruns were found when processing an SGI, PCX or FLI image.
Checks have been added to prevent this.

Overflow checks have been added when calculating the size of a memory block to be reallocated in the processing of a TIFF image.

ID	Name	Product	Family	Severity
148586	EulerOS Virtualization 2.9.0 : python-pillow (EulerOS-SA-2021-1743)	Nessus	Huawei Local Security Checks	critical
148585	EulerOS Virtualization 2.9.1 : python-pillow (EulerOS-SA-2021-1729)	Nessus	Huawei Local Security Checks	critical
147058	EulerOS Virtualization for ARM 64 3.0.6.0 : python-pillow (EulerOS-SA-2021-1570)	Nessus	Huawei Local Security Checks	high
146238	EulerOS 2.0 SP9 : python-pillow (EulerOS-SA-2021-1273)	Nessus	Huawei Local Security Checks	critical
146225	EulerOS 2.0 SP9 : python-pillow (EulerOS-SA-2021-1254)	Nessus	Huawei Local Security Checks	critical
145750	EulerOS 2.0 SP8 : python-pillow (EulerOS-SA-2021-1167)	Nessus	Huawei Local Security Checks	high
133887	Fedora 30 : python-pillow (2020-5cdbb19cca)	Nessus	Fedora Local Security Checks	critical
133550	Ubuntu 16.04 LTS / 18.04 LTS : Pillow vulnerabilities (USN-4272-1)	Nessus	Ubuntu Local Security Checks	critical
133376	Fedora 31 : python-pillow (2020-df444e464e)	Nessus	Fedora Local Security Checks	critical
133243	FreeBSD : Pillow -- Multiple vulnerabilities (0700e76c-3eb0-11ea-8478-3085a9a95629)	Nessus	FreeBSD Local Security Checks	critical

Detections

Analytics

CVE-2020-5310

high

Tenable Plugins

critical

critical

high

critical

critical

high

critical

critical

critical

critical