libImaging/SgiRleDecode.c in Pillow before 6.2.2 has an SGI buffer overflow.

According to the versions of the python-pillow package installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities :

  - libImaging/FliDecode.c in Pillow before 6.2.2 has an     FLI buffer overflow.(CVE-2020-5313)

  - An out-of-bounds write flaw was discovered in     python-pillow in the way SGI RLE images are decoded. An     application that uses python-pillow to decode untrusted     images may be vulnerable to this flaw, which can allow     an attacker to crash the application or potentially     execute code on the system.(CVE-2020-5311)

  - libImaging/PcxDecode.c in Pillow before 6.2.2 has a PCX     P mode buffer overflow.(CVE-2020-5312)

  - In libImaging/SgiRleDecode.c in Pillow through 7.0.0, a     number of out-of-bounds reads exist in the parsing of     SGI image files, a different issue than     CVE-2020-5311.(CVE-2020-11538)

  - In libImaging/Jpeg2KDecode.c in Pillow before 7.1.0,     there are multiple out-of-bounds reads via a crafted     JP2 file.(CVE-2020-10994)

  - In libImaging/PcxDecode.c in Pillow before 7.1.0, an     out-of-bounds read can occur when reading PCX files     where state->shuffle is instructed to read beyond     state->buffer.(CVE-2020-10378)

  - Pillow before 7.1.0 has multiple out-of-bounds reads in     libImaging/FliDecode.c.(CVE-2020-10177)

  - libImaging/TiffDecode.c in Pillow before 6.2.2 has a     TIFF decoding integer overflow, related to     realloc.(CVE-2020-5310)

  - In Pillow before 7.1.0, there are two Buffer Overflows     in libImaging/TiffDecode.c.(CVE-2020-10379)

  - There is a DoS vulnerability in Pillow before 6.2.2     caused by FpxImagePlugin.py calling the range function     on an unvalidated 32-bit integer if the number of bands     is large. On Windows running 32-bit Python, this     results in an OverflowError or MemoryError due to the 2     GB limit. However, on Linux running 64-bit Python this     results in the process being terminated by the OOM     killer.(CVE-2019-19911)

  - ** RESERVED ** This candidate has been reserved by an     organization or individual that will use it when     announcing a new security problem. When the candidate     has been publicized, the details for this candidate     will be provided.(CVE-2020-19911)

  - In Pillow before 8.1.0, PcxDecode has a buffer     over-read when decoding a crafted PCX file because the     user-supplied stride value is trusted for buffer     calculations.(CVE-2020-35653)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the python-pillow packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - In Pillow before 8.1.0, PcxDecode has a buffer     over-read when decoding a crafted PCX file because the     user-supplied stride value is trusted for buffer     calculations.(CVE-2020-35653)

  - libImaging/FliDecode.c in Pillow before 6.2.2 has an     FLI buffer overflow.(CVE-2020-5313)

  - In libImaging/Jpeg2KDecode.c in Pillow before 7.1.0,     there are multiple out-of-bounds reads via a crafted     JP2 file.(CVE-2020-10994)

  - In libImaging/SgiRleDecode.c in Pillow through 7.0.0, a     number of out-of-bounds reads exist in the parsing of     SGI image files, a different issue than     CVE-2020-5311.(CVE-2020-11538)

  - There is a DoS vulnerability in Pillow before 6.2.2     caused by FpxImagePlugin.py calling the range function     on an unvalidated 32-bit integer if the number of bands     is large. On Windows running 32-bit Python, this     results in an OverflowError or MemoryError due to the 2     GB limit. However, on Linux running 64-bit Python this     results in the process being terminated by the OOM     killer.(CVE-2019-19911)

  - libImaging/TiffDecode.c in Pillow before 6.2.2 has a     TIFF decoding integer overflow, related to     realloc.(CVE-2020-5310)

  - An out-of-bounds write flaw was discovered in     python-pillow in the way SGI RLE images are decoded. An     application that uses python-pillow to decode untrusted     images may be vulnerable to this flaw, which can allow     an attacker to crash the application or potentially     execute code on the system.(CVE-2020-5311)

  - libImaging/PcxDecode.c in Pillow before 6.2.2 has a PCX     P mode buffer overflow.(CVE-2020-5312)

  - In Pillow before 7.1.0, there are two Buffer Overflows     in libImaging/TiffDecode.c.(CVE-2020-10379)

  - An issue was discovered in Pillow before 6.2.0. When     reading specially crafted invalid image files, the     library can either allocate very large amounts of     memory or take an extremely long period of time to     process the image.(CVE-2019-16865)

  - In libImaging/PcxDecode.c in Pillow before 7.1.0, an     out-of-bounds read can occur when reading PCX files     where state->shuffle is instructed to read beyond     state->buffer.(CVE-2020-10378)

  - Pillow before 7.1.0 has multiple out-of-bounds reads in     libImaging/FliDecode.c.(CVE-2020-10177)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote CentOS Linux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the CESA-2020:0580 advisory.

  - python-pillow: reading specially crafted image files leads to allocation of large amounts of memory and     denial of service (CVE-2019-16865)

  - python-pillow: out-of-bounds write in expandrow in libImaging/SgiRleDecode.c (CVE-2020-5311)

  - python-pillow: improperly restricted operations on memory buffer in libImaging/PcxDecode.c (CVE-2020-5312)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

According to the versions of the python-pillow package installed, the EulerOS Virtualization for ARM 64 installation on the remote host is affected by the following vulnerabilities :

  - libImaging/SgiRleDecode.c in Pillow before 6.2.2 has an     SGI buffer overflow.(CVE-2020-5311)

  - In libImaging/SgiRleDecode.c in Pillow through 7.0.0, a     number of out-of-bounds reads exist in the parsing of     SGI image files, a different issue than     CVE-2020-5311.(CVE-2020-11538)

  - There is a DoS vulnerability in Pillow before 6.2.2     caused by FpxImagePlugin.py calling the range function     on an unvalidated 32-bit integer if the number of bands     is large. On Windows running 32-bit Python, this     results in an OverflowError or MemoryError due to the 2     GB limit. However, on Linux running 64-bit Python this     results in the process being terminated by the OOM     killer.(CVE-2019-19911)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the python-pillow packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - There is a DoS vulnerability in Pillow before 6.2.2     caused by FpxImagePlugin.py calling the range function     on an unvalidated 32-bit integer if the number of bands     is large. On Windows running 32-bit Python, this     results in an OverflowError or MemoryError due to the 2     GB limit. However, on Linux running 64-bit Python this     results in the process being terminated by the OOM     killer.(CVE-2019-19911)

  - In libImaging/SgiRleDecode.c in Pillow through 7.0.0, a     number of out-of-bounds reads exist in the parsing of     SGI image files, a different issue than     CVE-2020-5311.(CVE-2020-11538)

  - libImaging/SgiRleDecode.c in Pillow before 6.2.2 has an     SGI buffer overflow.(CVE-2020-5311)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

From Red Hat Security Advisory 2020:0580 :

An update for python-pillow is now available for Red Hat Enterprise Linux 8.

Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

The python-pillow packages contain a Python image processing library that provides extensive file format support, an efficient internal representation, and powerful image-processing capabilities.

Security Fix(es) :

* python-pillow: out-of-bounds write in expandrow in libImaging/ SgiRleDecode.c (CVE-2020-5311)

* python-pillow: improperly restricted operations on memory buffer in libImaging/PcxDecode.c (CVE-2020-5312)

* python-pillow: reading specially crafted image files leads to allocation of large amounts of memory and denial of service (CVE-2019-16865)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

The remote Redhat Enterprise Linux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2020:0580 advisory.

    The python-pillow packages contain a Python image processing library that provides extensive file format     support, an efficient internal representation, and powerful image-processing capabilities.

    Security Fix(es):

    * python-pillow: out-of-bounds write in expandrow in libImaging/SgiRleDecode.c (CVE-2020-5311)

    * python-pillow: improperly restricted operations on memory buffer in libImaging/PcxDecode.c     (CVE-2020-5312)

    * python-pillow: reading specially crafted image files leads to allocation of large amounts of memory and     denial of service (CVE-2019-16865)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2020:0566 advisory.

  - python-pillow: reading specially crafted image files leads to allocation of large amounts of memory and     denial of service (CVE-2019-16865)

  - python-pillow: out-of-bounds write in expandrow in libImaging/SgiRleDecode.c (CVE-2020-5311)

  - python-pillow: improperly restricted operations on memory buffer in libImaging/PcxDecode.c (CVE-2020-5312)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Backport patches for CVE-2020-5313, CVE-2020-5312, CVE-2020-5311, CVE-2020-5310, CVE-2019-19911

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Multiple security issues were discovered in Pillow, a Python imaging library, which could result in denial of service and potentially the execution of arbitrary code if malformed PCX, FLI, SGI or TIFF images are processed.

The remote Ubuntu 16.04 LTS / 18.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-4272-1 advisory.

    It was discovered that Pillow incorrectly handled certain images. An attacker could possibly use this     issue to cause a denial of service. (CVE-2019-16865, CVE-2019-19911)

    It was discovered that Pillow incorrectly handled certain images. An attacker could possibly use this     issue to execute arbitrary code. (CVE-2020-5312)

    It was discovered that Pillow incorrectly handled certain TIFF images. An attacker could possibly use this     issue to cause a crash. This issue only affected Ubuntu 19.10. (CVE-2020-5310)

    It was discovered that Pillow incorrectly handled certain SGI images. An attacker could possibly use this     issue to execute arbitrary code or cause a crash. This issue only affected Ubuntu 18.04 and Ubuntu 19.10.
    (CVE-2020-5311)

    It was discovered that Pillow incorrectly handled certain PCX images. An attackter could possibly use this     issue to execute arbitrary code or cause a crash. (CVE-2020-5312)

    It was discovered that Pillow incorrectly handled certain Flip images. An attacker could possibly use this     issue to execute arbitrary code or cause a crash. (CVE-2020-5313)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Update to 6.2.2, fixes CVE-2020-5313, CVE-2020-5312, CVE-2020-5311, CVE-2020-5310.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Pillow developers report :

This release addresses several security problems, as well as addressing CVE-2019-19911.

CVE-2019-19911 is regarding FPX images. If an image reports that it has a large number of bands, a large amount of resources will be used when trying to process the image. This is fixed by limiting the number of bands to those usable by Pillow.

Buffer overruns were found when processing an SGI, PCX or FLI image.
Checks have been added to prevent this.

Overflow checks have been added when calculating the size of a memory block to be reallocated in the processing of a TIFF image.

ID	Name	Product	Family	Severity
148586	EulerOS Virtualization 2.9.0 : python-pillow (EulerOS-SA-2021-1743)	Nessus	Huawei Local Security Checks	critical
148585	EulerOS Virtualization 2.9.1 : python-pillow (EulerOS-SA-2021-1729)	Nessus	Huawei Local Security Checks	critical
146238	EulerOS 2.0 SP9 : python-pillow (EulerOS-SA-2021-1273)	Nessus	Huawei Local Security Checks	critical
146225	EulerOS 2.0 SP9 : python-pillow (EulerOS-SA-2021-1254)	Nessus	Huawei Local Security Checks	critical
146010	CentOS 8 : python-pillow (CESA-2020:0580)	Nessus	CentOS Local Security Checks	critical
140972	EulerOS Virtualization for ARM 64 3.0.6.0 : python-pillow (EulerOS-SA-2020-2024)	Nessus	Huawei Local Security Checks	critical
139980	EulerOS 2.0 SP8 : python-pillow (EulerOS-SA-2020-1877)	Nessus	Huawei Local Security Checks	critical
134059	Oracle Linux 8 : python-pillow (ELSA-2020-0580)	Nessus	Oracle Linux Local Security Checks	critical
134034	RHEL 8 : python-pillow (RHSA-2020:0580)	Nessus	Red Hat Local Security Checks	critical
133944	RHEL 8 : python-pillow (RHSA-2020:0566)	Nessus	Red Hat Local Security Checks	critical
133887	Fedora 30 : python-pillow (2020-5cdbb19cca)	Nessus	Fedora Local Security Checks	critical
133879	Debian DSA-4631-1 : pillow - security update	Nessus	Debian Local Security Checks	critical
133550	Ubuntu 16.04 LTS / 18.04 LTS : Pillow vulnerabilities (USN-4272-1)	Nessus	Ubuntu Local Security Checks	critical
133376	Fedora 31 : python-pillow (2020-df444e464e)	Nessus	Fedora Local Security Checks	critical
133243	FreeBSD : Pillow -- Multiple vulnerabilities (0700e76c-3eb0-11ea-8478-3085a9a95629)	Nessus	FreeBSD Local Security Checks	critical

Detections

Analytics

CVE-2020-5311

critical

Tenable Plugins

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical