logo

Database

Out-of-bounds read In pillow

Description

Out-of-bounds reads in Pillow In libImaging/Jpeg2KDecode.c in Pillow before 7.1.0, there are multiple out-of-bounds reads via a crafted JP2 file.

Mitigation

Update Impact

Minimal update. May introduce new vulnerabilities or breaking changes.

Ecosystem
Package
Affected version
Patched versions

Aliases

1. CVE-2020-109942. NVD-2020-109943. OSV-2020-109944. OSV-DEBIAN-2020-109945. GHSA-vj42-xq3r-hr3r6. GCVE-2020-109947. SECURITY-TRACKER-CVE-2020-10994

References

1. https://github.com/python-pillow/Pillow/pull/45052. https://github.com/python-pillow/Pillow/pull/45383. https://github.com/python-pillow/Pillow/commit/ff60894d697d1992147b791101ad53a8bf1352e44. https://github.com/pypa/advisory-database/tree/main/vulns/pillow/PYSEC-2020-79.yaml5. https://github.com/python-pillow/Pillow/blob/master/docs/releasenotes/7.1.0.rst#security6. https://github.com/python-pillow/Pillow/commits/master/src/libImaging7. https://lists.fedoraproject.org/archives/list/[email protected]/message/BEBCPE4F2VHTIT6EZA2YZQZLPVDEBJGD8. https://lists.fedoraproject.org/archives/list/[email protected]/message/HOKHNWV2VS5GESY7IBD237E7C6T3I4279. https://pillow.readthedocs.io/en/stable/releasenotes10. https://pillow.readthedocs.io/en/stable/releasenotes/7.1.0.html11. https://usn.ubuntu.com/4430-112. https://usn.ubuntu.com/4430-2

Does your application use this vulnerable software?

During the free trial, our tools assess your application, identify vulnerabilities, and provide recommendations for their remediation.