Action not permitted
Modal body text goes here.
Modal Title
Modal Body
CVE-2020-11538 (GCVE-0-2020-11538)
Vulnerability from cvelistv5 – Published: 2020-06-25 18:32 – Updated: 2024-08-04 11:35- n/a
| URL | Tags |
|---|---|
| https://pillow.readthedocs.io/en/stable/releaseno… | x_refsource_MISC |
| https://github.com/python-pillow/Pillow/pull/4538 | x_refsource_MISC |
| https://pillow.readthedocs.io/en/stable/releaseno… | x_refsource_MISC |
| https://github.com/python-pillow/Pillow/pull/4504 | x_refsource_MISC |
| https://lists.fedoraproject.org/archives/list/pac… | vendor-advisoryx_refsource_FEDORA |
| https://lists.fedoraproject.org/archives/list/pac… | vendor-advisoryx_refsource_FEDORA |
| https://usn.ubuntu.com/4430-1/ | vendor-advisoryx_refsource_UBUNTU |
| https://usn.ubuntu.com/4430-2/ | vendor-advisoryx_refsource_UBUNTU |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-04T11:35:13.102Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://pillow.readthedocs.io/en/stable/releasenotes/index.html"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://github.com/python-pillow/Pillow/pull/4538"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://pillow.readthedocs.io/en/stable/releasenotes/7.1.0.html"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://github.com/python-pillow/Pillow/pull/4504"
},
{
"name": "FEDORA-2020-c52106e48a",
"tags": [
"vendor-advisory",
"x_refsource_FEDORA",
"x_transferred"
],
"url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HOKHNWV2VS5GESY7IBD237E7C6T3I427/"
},
{
"name": "FEDORA-2020-d0737711b6",
"tags": [
"vendor-advisory",
"x_refsource_FEDORA",
"x_transferred"
],
"url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/BEBCPE4F2VHTIT6EZA2YZQZLPVDEBJGD/"
},
{
"name": "USN-4430-1",
"tags": [
"vendor-advisory",
"x_refsource_UBUNTU",
"x_transferred"
],
"url": "https://usn.ubuntu.com/4430-1/"
},
{
"name": "USN-4430-2",
"tags": [
"vendor-advisory",
"x_refsource_UBUNTU",
"x_transferred"
],
"url": "https://usn.ubuntu.com/4430-2/"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In libImaging/SgiRleDecode.c in Pillow through 7.0.0, a number of out-of-bounds reads exist in the parsing of SGI image files, a different issue than CVE-2020-5311."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2020-07-27T18:06:20.000Z",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"tags": [
"x_refsource_MISC"
],
"url": "https://pillow.readthedocs.io/en/stable/releasenotes/index.html"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/python-pillow/Pillow/pull/4538"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "https://pillow.readthedocs.io/en/stable/releasenotes/7.1.0.html"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/python-pillow/Pillow/pull/4504"
},
{
"name": "FEDORA-2020-c52106e48a",
"tags": [
"vendor-advisory",
"x_refsource_FEDORA"
],
"url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HOKHNWV2VS5GESY7IBD237E7C6T3I427/"
},
{
"name": "FEDORA-2020-d0737711b6",
"tags": [
"vendor-advisory",
"x_refsource_FEDORA"
],
"url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/BEBCPE4F2VHTIT6EZA2YZQZLPVDEBJGD/"
},
{
"name": "USN-4430-1",
"tags": [
"vendor-advisory",
"x_refsource_UBUNTU"
],
"url": "https://usn.ubuntu.com/4430-1/"
},
{
"name": "USN-4430-2",
"tags": [
"vendor-advisory",
"x_refsource_UBUNTU"
],
"url": "https://usn.ubuntu.com/4430-2/"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2020-11538",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "In libImaging/SgiRleDecode.c in Pillow through 7.0.0, a number of out-of-bounds reads exist in the parsing of SGI image files, a different issue than CVE-2020-5311."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://pillow.readthedocs.io/en/stable/releasenotes/index.html",
"refsource": "MISC",
"url": "https://pillow.readthedocs.io/en/stable/releasenotes/index.html"
},
{
"name": "https://github.com/python-pillow/Pillow/pull/4538",
"refsource": "MISC",
"url": "https://github.com/python-pillow/Pillow/pull/4538"
},
{
"name": "https://pillow.readthedocs.io/en/stable/releasenotes/7.1.0.html",
"refsource": "MISC",
"url": "https://pillow.readthedocs.io/en/stable/releasenotes/7.1.0.html"
},
{
"name": "https://github.com/python-pillow/Pillow/pull/4504",
"refsource": "MISC",
"url": "https://github.com/python-pillow/Pillow/pull/4504"
},
{
"name": "FEDORA-2020-c52106e48a",
"refsource": "FEDORA",
"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/HOKHNWV2VS5GESY7IBD237E7C6T3I427/"
},
{
"name": "FEDORA-2020-d0737711b6",
"refsource": "FEDORA",
"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/BEBCPE4F2VHTIT6EZA2YZQZLPVDEBJGD/"
},
{
"name": "USN-4430-1",
"refsource": "UBUNTU",
"url": "https://usn.ubuntu.com/4430-1/"
},
{
"name": "USN-4430-2",
"refsource": "UBUNTU",
"url": "https://usn.ubuntu.com/4430-2/"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2020-11538",
"datePublished": "2020-06-25T18:32:06.000Z",
"dateReserved": "2020-04-04T00:00:00.000Z",
"dateUpdated": "2024-08-04T11:35:13.102Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1",
"vulnerability-lookup:meta": {
"epss": {
"cve": "CVE-2020-11538",
"date": "2026-05-26",
"epss": "0.00267",
"percentile": "0.50134"
},
"fkie_nvd": {
"configurations": "[{\"nodes\": [{\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:python:pillow:*:*:*:*:*:*:*:*\", \"versionEndIncluding\": \"7.0.0\", \"matchCriteriaId\": \"58AD52C9-23AE-4A61-84B5-3B199CEEDFF5\"}]}]}, {\"nodes\": [{\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:fedoraproject:fedora:31:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"80F0FA5D-8D3B-4C0E-81E2-87998286AF33\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:fedoraproject:fedora:32:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"36D96259-24BD-44E2-96D9-78CE1D41F956\"}]}]}, {\"nodes\": [{\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:canonical:ubuntu_linux:16.04:*:*:*:esm:*:*:*\", \"matchCriteriaId\": \"7A5301BF-1402-4BE0-A0F8-69FBE79BC6D6\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:canonical:ubuntu_linux:18.04:*:*:*:lts:*:*:*\", \"matchCriteriaId\": \"23A7C53F-B80F-4E6A-AFA9-58EEA84BE11D\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:canonical:ubuntu_linux:20.04:*:*:*:lts:*:*:*\", \"matchCriteriaId\": \"902B8056-9E37-443B-8905-8AA93E2447FB\"}]}]}]",
"descriptions": "[{\"lang\": \"en\", \"value\": \"In libImaging/SgiRleDecode.c in Pillow through 7.0.0, a number of out-of-bounds reads exist in the parsing of SGI image files, a different issue than CVE-2020-5311.\"}, {\"lang\": \"es\", \"value\": \"En la biblioteca libImaging/SgiRleDecode.c en Pillow versiones hasta 7.0.0, se presentan m\\u00faltiples lecturas fuera de l\\u00edmites en el an\\u00e1lisis de archivos de imagen SGI, un problema diferente de CVE-2020-5311\"}]",
"id": "CVE-2020-11538",
"lastModified": "2024-11-21T04:58:06.503",
"metrics": "{\"cvssMetricV31\": [{\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"cvssData\": {\"version\": \"3.1\", \"vectorString\": \"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H\", \"baseScore\": 8.1, \"baseSeverity\": \"HIGH\", \"attackVector\": \"NETWORK\", \"attackComplexity\": \"HIGH\", \"privilegesRequired\": \"NONE\", \"userInteraction\": \"NONE\", \"scope\": \"UNCHANGED\", \"confidentialityImpact\": \"HIGH\", \"integrityImpact\": \"HIGH\", \"availabilityImpact\": \"HIGH\"}, \"exploitabilityScore\": 2.2, \"impactScore\": 5.9}], \"cvssMetricV2\": [{\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"cvssData\": {\"version\": \"2.0\", \"vectorString\": \"AV:N/AC:M/Au:N/C:P/I:P/A:P\", \"baseScore\": 6.8, \"accessVector\": \"NETWORK\", \"accessComplexity\": \"MEDIUM\", \"authentication\": \"NONE\", \"confidentialityImpact\": \"PARTIAL\", \"integrityImpact\": \"PARTIAL\", \"availabilityImpact\": \"PARTIAL\"}, \"baseSeverity\": \"MEDIUM\", \"exploitabilityScore\": 8.6, \"impactScore\": 6.4, \"acInsufInfo\": false, \"obtainAllPrivilege\": false, \"obtainUserPrivilege\": false, \"obtainOtherPrivilege\": false, \"userInteractionRequired\": false}]}",
"published": "2020-06-25T19:15:12.537",
"references": "[{\"url\": \"https://github.com/python-pillow/Pillow/pull/4504\", \"source\": \"cve@mitre.org\", \"tags\": [\"Issue Tracking\", \"Patch\"]}, {\"url\": \"https://github.com/python-pillow/Pillow/pull/4538\", \"source\": \"cve@mitre.org\", \"tags\": [\"Issue Tracking\", \"Patch\"]}, {\"url\": \"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/BEBCPE4F2VHTIT6EZA2YZQZLPVDEBJGD/\", \"source\": \"cve@mitre.org\"}, {\"url\": \"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HOKHNWV2VS5GESY7IBD237E7C6T3I427/\", \"source\": \"cve@mitre.org\"}, {\"url\": \"https://pillow.readthedocs.io/en/stable/releasenotes/7.1.0.html\", \"source\": \"cve@mitre.org\", \"tags\": [\"Product\"]}, {\"url\": \"https://pillow.readthedocs.io/en/stable/releasenotes/index.html\", \"source\": \"cve@mitre.org\", \"tags\": [\"Release Notes\"]}, {\"url\": \"https://usn.ubuntu.com/4430-1/\", \"source\": \"cve@mitre.org\", \"tags\": [\"Third Party Advisory\"]}, {\"url\": \"https://usn.ubuntu.com/4430-2/\", \"source\": \"cve@mitre.org\", \"tags\": [\"Third Party Advisory\"]}, {\"url\": \"https://github.com/python-pillow/Pillow/pull/4504\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Issue Tracking\", \"Patch\"]}, {\"url\": \"https://github.com/python-pillow/Pillow/pull/4538\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Issue Tracking\", \"Patch\"]}, {\"url\": \"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/BEBCPE4F2VHTIT6EZA2YZQZLPVDEBJGD/\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HOKHNWV2VS5GESY7IBD237E7C6T3I427/\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"https://pillow.readthedocs.io/en/stable/releasenotes/7.1.0.html\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Product\"]}, {\"url\": \"https://pillow.readthedocs.io/en/stable/releasenotes/index.html\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Release Notes\"]}, {\"url\": \"https://usn.ubuntu.com/4430-1/\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Third Party Advisory\"]}, {\"url\": \"https://usn.ubuntu.com/4430-2/\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Third Party Advisory\"]}]",
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Modified",
"weaknesses": "[{\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"description\": [{\"lang\": \"en\", \"value\": \"CWE-125\"}]}]"
},
"nvd": "{\"cve\":{\"id\":\"CVE-2020-11538\",\"sourceIdentifier\":\"cve@mitre.org\",\"published\":\"2020-06-25T19:15:12.537\",\"lastModified\":\"2024-11-21T04:58:06.503\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In libImaging/SgiRleDecode.c in Pillow through 7.0.0, a number of out-of-bounds reads exist in the parsing of SGI image files, a different issue than CVE-2020-5311.\"},{\"lang\":\"es\",\"value\":\"En la biblioteca libImaging/SgiRleDecode.c en Pillow versiones hasta 7.0.0, se presentan m\u00faltiples lecturas fuera de l\u00edmites en el an\u00e1lisis de archivos de imagen SGI, un problema diferente de CVE-2020-5311\"}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":8.1,\"baseSeverity\":\"HIGH\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"HIGH\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":2.2,\"impactScore\":5.9}],\"cvssMetricV2\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"2.0\",\"vectorString\":\"AV:N/AC:M/Au:N/C:P/I:P/A:P\",\"baseScore\":6.8,\"accessVector\":\"NETWORK\",\"accessComplexity\":\"MEDIUM\",\"authentication\":\"NONE\",\"confidentialityImpact\":\"PARTIAL\",\"integrityImpact\":\"PARTIAL\",\"availabilityImpact\":\"PARTIAL\"},\"baseSeverity\":\"MEDIUM\",\"exploitabilityScore\":8.6,\"impactScore\":6.4,\"acInsufInfo\":false,\"obtainAllPrivilege\":false,\"obtainUserPrivilege\":false,\"obtainOtherPrivilege\":false,\"userInteractionRequired\":false}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-125\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:python:pillow:*:*:*:*:*:*:*:*\",\"versionEndIncluding\":\"7.0.0\",\"matchCriteriaId\":\"58AD52C9-23AE-4A61-84B5-3B199CEEDFF5\"}]}]},{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:fedoraproject:fedora:31:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"80F0FA5D-8D3B-4C0E-81E2-87998286AF33\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:fedoraproject:fedora:32:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"36D96259-24BD-44E2-96D9-78CE1D41F956\"}]}]},{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:canonical:ubuntu_linux:16.04:*:*:*:esm:*:*:*\",\"matchCriteriaId\":\"7A5301BF-1402-4BE0-A0F8-69FBE79BC6D6\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:canonical:ubuntu_linux:18.04:*:*:*:lts:*:*:*\",\"matchCriteriaId\":\"23A7C53F-B80F-4E6A-AFA9-58EEA84BE11D\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:canonical:ubuntu_linux:20.04:*:*:*:lts:*:*:*\",\"matchCriteriaId\":\"902B8056-9E37-443B-8905-8AA93E2447FB\"}]}]}],\"references\":[{\"url\":\"https://github.com/python-pillow/Pillow/pull/4504\",\"source\":\"cve@mitre.org\",\"tags\":[\"Issue Tracking\",\"Patch\"]},{\"url\":\"https://github.com/python-pillow/Pillow/pull/4538\",\"source\":\"cve@mitre.org\",\"tags\":[\"Issue Tracking\",\"Patch\"]},{\"url\":\"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/BEBCPE4F2VHTIT6EZA2YZQZLPVDEBJGD/\",\"source\":\"cve@mitre.org\"},{\"url\":\"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HOKHNWV2VS5GESY7IBD237E7C6T3I427/\",\"source\":\"cve@mitre.org\"},{\"url\":\"https://pillow.readthedocs.io/en/stable/releasenotes/7.1.0.html\",\"source\":\"cve@mitre.org\",\"tags\":[\"Product\"]},{\"url\":\"https://pillow.readthedocs.io/en/stable/releasenotes/index.html\",\"source\":\"cve@mitre.org\",\"tags\":[\"Release Notes\"]},{\"url\":\"https://usn.ubuntu.com/4430-1/\",\"source\":\"cve@mitre.org\",\"tags\":[\"Third Party Advisory\"]},{\"url\":\"https://usn.ubuntu.com/4430-2/\",\"source\":\"cve@mitre.org\",\"tags\":[\"Third Party Advisory\"]},{\"url\":\"https://github.com/python-pillow/Pillow/pull/4504\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Issue Tracking\",\"Patch\"]},{\"url\":\"https://github.com/python-pillow/Pillow/pull/4538\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Issue Tracking\",\"Patch\"]},{\"url\":\"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/BEBCPE4F2VHTIT6EZA2YZQZLPVDEBJGD/\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HOKHNWV2VS5GESY7IBD237E7C6T3I427/\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"https://pillow.readthedocs.io/en/stable/releasenotes/7.1.0.html\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Product\"]},{\"url\":\"https://pillow.readthedocs.io/en/stable/releasenotes/index.html\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Release Notes\"]},{\"url\":\"https://usn.ubuntu.com/4430-1/\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Third Party Advisory\"]},{\"url\":\"https://usn.ubuntu.com/4430-2/\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Third Party Advisory\"]}]}}"
}
}
bit-pillow-2020-11538
Vulnerability from bitnami_vulndb
In libImaging/SgiRleDecode.c in Pillow through 7.0.0, a number of out-of-bounds reads exist in the parsing of SGI image files, a different issue than CVE-2020-5311.
{
"affected": [
{
"package": {
"ecosystem": "Bitnami",
"name": "pillow",
"purl": "pkg:bitnami/pillow"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "7.0.1"
}
],
"type": "SEMVER"
}
],
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
],
"aliases": [
"CVE-2020-11538"
],
"database_specific": {
"cpes": [
"cpe:2.3:a:python:pillow:*:*:*:*:*:*:*:*"
],
"severity": "High"
},
"details": "In libImaging/SgiRleDecode.c in Pillow through 7.0.0, a number of out-of-bounds reads exist in the parsing of SGI image files, a different issue than CVE-2020-5311.",
"id": "BIT-pillow-2020-11538",
"modified": "2025-04-03T14:40:37.652Z",
"published": "2024-03-06T11:06:47.992Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/python-pillow/Pillow/pull/4504"
},
{
"type": "WEB",
"url": "https://github.com/python-pillow/Pillow/pull/4538"
},
{
"type": "WEB",
"url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/BEBCPE4F2VHTIT6EZA2YZQZLPVDEBJGD/"
},
{
"type": "WEB",
"url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HOKHNWV2VS5GESY7IBD237E7C6T3I427/"
},
{
"type": "WEB",
"url": "https://pillow.readthedocs.io/en/stable/releasenotes/7.1.0.html"
},
{
"type": "WEB",
"url": "https://pillow.readthedocs.io/en/stable/releasenotes/index.html"
},
{
"type": "WEB",
"url": "https://usn.ubuntu.com/4430-1/"
},
{
"type": "WEB",
"url": "https://usn.ubuntu.com/4430-2/"
},
{
"type": "WEB",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2020-11538"
}
],
"schema_version": "1.5.0"
}
CNVD-2021-21943
Vulnerability from cnvd - Published: 2021-03-24目前厂商已发布升级补丁以修复漏洞,补丁获取链接: https://github.com/python-pillow/Pillow/pull/4504
| Name | Pillow Pillow <7.1.0 |
|---|
{
"cves": {
"cve": {
"cveNumber": "CVE-2020-11538"
}
},
"description": "Pillow\u662f\u4e00\u6b3e\u57fa\u4e8ePython\u7684\u56fe\u50cf\u5904\u7406\u5e93\u3002\n\nPillow 7.0.0\u53ca\u4e4b\u524d\u7248\u672c\u4e2d\u7684libImaging/SgiRleDecode.c\u6587\u4ef6\u7684SGI\u56fe\u50cf\u6587\u4ef6\u7684\u5904\u7406\u5b58\u5728\u8d8a\u754c\u8bfb\u53d6\u6f0f\u6d1e\u3002\u76ee\u524d\u6ca1\u6709\u8be6\u7ec6\u7684\u6f0f\u6d1e\u7ec6\u8282\u63d0\u4f9b\u3002",
"formalWay": "\u76ee\u524d\u5382\u5546\u5df2\u53d1\u5e03\u5347\u7ea7\u8865\u4e01\u4ee5\u4fee\u590d\u6f0f\u6d1e\uff0c\u8865\u4e01\u83b7\u53d6\u94fe\u63a5\uff1a\r\nhttps://github.com/python-pillow/Pillow/pull/4504",
"isEvent": "\u901a\u7528\u8f6f\u786c\u4ef6\u6f0f\u6d1e",
"number": "CNVD-2021-21943",
"openTime": "2021-03-24",
"patchDescription": "Pillow\u662f\u4e00\u6b3e\u57fa\u4e8ePython\u7684\u56fe\u50cf\u5904\u7406\u5e93\u3002\r\n\r\nPillow 7.0.0\u53ca\u4e4b\u524d\u7248\u672c\u4e2d\u7684libImaging/SgiRleDecode.c\u6587\u4ef6\u7684SGI\u56fe\u50cf\u6587\u4ef6\u7684\u5904\u7406\u5b58\u5728\u8d8a\u754c\u8bfb\u53d6\u6f0f\u6d1e\u3002\u76ee\u524d\u6ca1\u6709\u8be6\u7ec6\u7684\u6f0f\u6d1e\u7ec6\u8282\u63d0\u4f9b\u3002\u76ee\u524d\uff0c\u4f9b\u5e94\u5546\u53d1\u5e03\u4e86\u5b89\u5168\u516c\u544a\u53ca\u76f8\u5173\u8865\u4e01\u4fe1\u606f\uff0c\u4fee\u590d\u4e86\u6b64\u6f0f\u6d1e\u3002",
"patchName": "Pillow\u8d8a\u754c\u8bfb\u53d6\u6f0f\u6d1e\u7684\u8865\u4e01",
"products": {
"product": "Pillow Pillow \u003c7.1.0"
},
"referenceLink": "https://nvd.nist.gov/vuln/detail/CVE-2020-11538",
"serverity": "\u4e2d",
"submitTime": "2020-06-28",
"title": "Pillow\u8d8a\u754c\u8bfb\u53d6\u6f0f\u6d1e"
}
FKIE_CVE-2020-11538
Vulnerability from fkie_nvd - Published: 2020-06-25 19:15 - Updated: 2024-11-21 04:58| Vendor | Product | Version | |
|---|---|---|---|
| python | pillow | * | |
| fedoraproject | fedora | 31 | |
| fedoraproject | fedora | 32 | |
| canonical | ubuntu_linux | 16.04 | |
| canonical | ubuntu_linux | 18.04 | |
| canonical | ubuntu_linux | 20.04 |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:python:pillow:*:*:*:*:*:*:*:*",
"matchCriteriaId": "58AD52C9-23AE-4A61-84B5-3B199CEEDFF5",
"versionEndIncluding": "7.0.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:fedoraproject:fedora:31:*:*:*:*:*:*:*",
"matchCriteriaId": "80F0FA5D-8D3B-4C0E-81E2-87998286AF33",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:fedoraproject:fedora:32:*:*:*:*:*:*:*",
"matchCriteriaId": "36D96259-24BD-44E2-96D9-78CE1D41F956",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:canonical:ubuntu_linux:16.04:*:*:*:esm:*:*:*",
"matchCriteriaId": "7A5301BF-1402-4BE0-A0F8-69FBE79BC6D6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:canonical:ubuntu_linux:18.04:*:*:*:lts:*:*:*",
"matchCriteriaId": "23A7C53F-B80F-4E6A-AFA9-58EEA84BE11D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:canonical:ubuntu_linux:20.04:*:*:*:lts:*:*:*",
"matchCriteriaId": "902B8056-9E37-443B-8905-8AA93E2447FB",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "In libImaging/SgiRleDecode.c in Pillow through 7.0.0, a number of out-of-bounds reads exist in the parsing of SGI image files, a different issue than CVE-2020-5311."
},
{
"lang": "es",
"value": "En la biblioteca libImaging/SgiRleDecode.c en Pillow versiones hasta 7.0.0, se presentan m\u00faltiples lecturas fuera de l\u00edmites en el an\u00e1lisis de archivos de imagen SGI, un problema diferente de CVE-2020-5311"
}
],
"id": "CVE-2020-11538",
"lastModified": "2024-11-21T04:58:06.503",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "MEDIUM",
"cvssData": {
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "PARTIAL",
"baseScore": 6.8,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P",
"version": "2.0"
},
"exploitabilityScore": 8.6,
"impactScore": 6.4,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": false
}
],
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.1,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"exploitabilityScore": 2.2,
"impactScore": 5.9,
"source": "nvd@nist.gov",
"type": "Primary"
}
]
},
"published": "2020-06-25T19:15:12.537",
"references": [
{
"source": "cve@mitre.org",
"tags": [
"Issue Tracking",
"Patch"
],
"url": "https://github.com/python-pillow/Pillow/pull/4504"
},
{
"source": "cve@mitre.org",
"tags": [
"Issue Tracking",
"Patch"
],
"url": "https://github.com/python-pillow/Pillow/pull/4538"
},
{
"source": "cve@mitre.org",
"url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/BEBCPE4F2VHTIT6EZA2YZQZLPVDEBJGD/"
},
{
"source": "cve@mitre.org",
"url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HOKHNWV2VS5GESY7IBD237E7C6T3I427/"
},
{
"source": "cve@mitre.org",
"tags": [
"Product"
],
"url": "https://pillow.readthedocs.io/en/stable/releasenotes/7.1.0.html"
},
{
"source": "cve@mitre.org",
"tags": [
"Release Notes"
],
"url": "https://pillow.readthedocs.io/en/stable/releasenotes/index.html"
},
{
"source": "cve@mitre.org",
"tags": [
"Third Party Advisory"
],
"url": "https://usn.ubuntu.com/4430-1/"
},
{
"source": "cve@mitre.org",
"tags": [
"Third Party Advisory"
],
"url": "https://usn.ubuntu.com/4430-2/"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Issue Tracking",
"Patch"
],
"url": "https://github.com/python-pillow/Pillow/pull/4504"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Issue Tracking",
"Patch"
],
"url": "https://github.com/python-pillow/Pillow/pull/4538"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/BEBCPE4F2VHTIT6EZA2YZQZLPVDEBJGD/"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HOKHNWV2VS5GESY7IBD237E7C6T3I427/"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Product"
],
"url": "https://pillow.readthedocs.io/en/stable/releasenotes/7.1.0.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Release Notes"
],
"url": "https://pillow.readthedocs.io/en/stable/releasenotes/index.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Third Party Advisory"
],
"url": "https://usn.ubuntu.com/4430-1/"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Third Party Advisory"
],
"url": "https://usn.ubuntu.com/4430-2/"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-125"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
GHSA-43FQ-W8QQ-V88H
Vulnerability from github – Published: 2020-07-27 21:52 – Updated: 2024-10-09 19:45In libImaging/SgiRleDecode.c in Pillow through 7.0.0, a number of out-of-bounds reads exist in the parsing of SGI image files, a different issue than CVE-2020-5311.
{
"affected": [
{
"package": {
"ecosystem": "PyPI",
"name": "pillow"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "7.1.0"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2020-11538"
],
"database_specific": {
"cwe_ids": [
"CWE-125"
],
"github_reviewed": true,
"github_reviewed_at": "2020-07-27T21:35:11Z",
"nvd_published_at": "2020-06-25T19:15:00Z",
"severity": "CRITICAL"
},
"details": "In libImaging/SgiRleDecode.c in Pillow through 7.0.0, a number of out-of-bounds reads exist in the parsing of SGI image files, a different issue than CVE-2020-5311.",
"id": "GHSA-43fq-w8qq-v88h",
"modified": "2024-10-09T19:45:40Z",
"published": "2020-07-27T21:52:36Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2020-11538"
},
{
"type": "WEB",
"url": "https://github.com/python-pillow/Pillow/pull/4504"
},
{
"type": "WEB",
"url": "https://github.com/python-pillow/Pillow/pull/4538"
},
{
"type": "WEB",
"url": "https://github.com/python-pillow/Pillow/commit/2ef59fdbaeb756bc512ab3f2ad15ac45665b303d"
},
{
"type": "ADVISORY",
"url": "https://github.com/advisories/GHSA-43fq-w8qq-v88h"
},
{
"type": "WEB",
"url": "https://github.com/pypa/advisory-database/tree/main/vulns/pillow/PYSEC-2020-80.yaml"
},
{
"type": "PACKAGE",
"url": "https://github.com/python-pillow/Pillow"
},
{
"type": "WEB",
"url": "https://github.com/python-pillow/Pillow/blob/master/docs/releasenotes/7.1.0.rst#security"
},
{
"type": "WEB",
"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/BEBCPE4F2VHTIT6EZA2YZQZLPVDEBJGD"
},
{
"type": "WEB",
"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/HOKHNWV2VS5GESY7IBD237E7C6T3I427"
},
{
"type": "WEB",
"url": "https://pillow.readthedocs.io/en/stable/releasenotes/7.1.0.html"
},
{
"type": "WEB",
"url": "https://pillow.readthedocs.io/en/stable/releasenotes/index.html"
},
{
"type": "WEB",
"url": "https://snyk.io/vuln/SNYK-PYTHON-PILLOW-574574"
},
{
"type": "WEB",
"url": "https://usn.ubuntu.com/4430-1"
},
{
"type": "WEB",
"url": "https://usn.ubuntu.com/4430-2"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
"type": "CVSS_V4"
}
],
"summary": "Out-of-bounds read in Pillow"
}
GSD-2020-11538
Vulnerability from gsd - Updated: 2023-12-13 01:22{
"GSD": {
"alias": "CVE-2020-11538",
"description": "In libImaging/SgiRleDecode.c in Pillow through 7.0.0, a number of out-of-bounds reads exist in the parsing of SGI image files, a different issue than CVE-2020-5311.",
"id": "GSD-2020-11538",
"references": [
"https://www.suse.com/security/cve/CVE-2020-11538.html",
"https://access.redhat.com/errata/RHSA-2021:0420",
"https://access.redhat.com/errata/RHSA-2020:3302",
"https://access.redhat.com/errata/RHSA-2020:3299",
"https://access.redhat.com/errata/RHSA-2020:3185",
"https://ubuntu.com/security/CVE-2020-11538",
"https://advisories.mageia.org/CVE-2020-11538.html",
"https://linux.oracle.com/cve/CVE-2020-11538.html"
]
},
"gsd": {
"metadata": {
"exploitCode": "unknown",
"remediation": "unknown",
"reportConfidence": "confirmed",
"type": "vulnerability"
},
"osvSchema": {
"aliases": [
"CVE-2020-11538"
],
"details": "In libImaging/SgiRleDecode.c in Pillow through 7.0.0, a number of out-of-bounds reads exist in the parsing of SGI image files, a different issue than CVE-2020-5311.",
"id": "GSD-2020-11538",
"modified": "2023-12-13T01:22:06.772526Z",
"schema_version": "1.4.0"
}
},
"namespaces": {
"cve.org": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2020-11538",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "In libImaging/SgiRleDecode.c in Pillow through 7.0.0, a number of out-of-bounds reads exist in the parsing of SGI image files, a different issue than CVE-2020-5311."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://pillow.readthedocs.io/en/stable/releasenotes/index.html",
"refsource": "MISC",
"url": "https://pillow.readthedocs.io/en/stable/releasenotes/index.html"
},
{
"name": "https://github.com/python-pillow/Pillow/pull/4538",
"refsource": "MISC",
"url": "https://github.com/python-pillow/Pillow/pull/4538"
},
{
"name": "https://pillow.readthedocs.io/en/stable/releasenotes/7.1.0.html",
"refsource": "MISC",
"url": "https://pillow.readthedocs.io/en/stable/releasenotes/7.1.0.html"
},
{
"name": "https://github.com/python-pillow/Pillow/pull/4504",
"refsource": "MISC",
"url": "https://github.com/python-pillow/Pillow/pull/4504"
},
{
"name": "FEDORA-2020-c52106e48a",
"refsource": "FEDORA",
"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/HOKHNWV2VS5GESY7IBD237E7C6T3I427/"
},
{
"name": "FEDORA-2020-d0737711b6",
"refsource": "FEDORA",
"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/BEBCPE4F2VHTIT6EZA2YZQZLPVDEBJGD/"
},
{
"name": "USN-4430-1",
"refsource": "UBUNTU",
"url": "https://usn.ubuntu.com/4430-1/"
},
{
"name": "USN-4430-2",
"refsource": "UBUNTU",
"url": "https://usn.ubuntu.com/4430-2/"
}
]
}
},
"gitlab.com": {
"advisories": [
{
"affected_range": "\u003c=7.0.0",
"affected_versions": "All versions up to 7.0.0",
"cvss_v2": "AV:N/AC:M/Au:N/C:P/I:P/A:P",
"cvss_v3": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe_ids": [
"CWE-1035",
"CWE-125",
"CWE-937"
],
"date": "2020-07-27",
"description": "In `libImaging/SgiRleDecode.c` in Pillow, a number of out-of-bounds reads exist in the parsing of SGI image files, a different issue than CVE-2020-5311.",
"fixed_versions": [
"7.1.0"
],
"identifier": "CVE-2020-11538",
"identifiers": [
"CVE-2020-11538"
],
"not_impacted": "All versions after 7.0.0",
"package_slug": "pypi/Pillow",
"pubdate": "2020-06-25",
"solution": "Upgrade to version 7.1.0 or above.",
"title": "Out-of-bounds Read",
"urls": [
"https://nvd.nist.gov/vuln/detail/CVE-2020-11538"
],
"uuid": "28afc1ef-24dd-49ad-9563-63bc4ea7d612"
}
]
},
"nvd.nist.gov": {
"configurations": {
"CVE_data_version": "4.0",
"nodes": [
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:a:python:pillow:*:*:*:*:*:*:*:*",
"cpe_name": [],
"versionEndIncluding": "7.0.0",
"vulnerable": true
}
],
"operator": "OR"
},
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:o:fedoraproject:fedora:31:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:o:fedoraproject:fedora:32:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
}
],
"operator": "OR"
},
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:o:canonical:ubuntu_linux:18.04:*:*:*:lts:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:o:canonical:ubuntu_linux:20.04:*:*:*:lts:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:o:canonical:ubuntu_linux:16.04:*:*:*:esm:*:*:*",
"cpe_name": [],
"vulnerable": true
}
],
"operator": "OR"
}
]
},
"cve": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2020-11538"
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "en",
"value": "In libImaging/SgiRleDecode.c in Pillow through 7.0.0, a number of out-of-bounds reads exist in the parsing of SGI image files, a different issue than CVE-2020-5311."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "en",
"value": "CWE-125"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://pillow.readthedocs.io/en/stable/releasenotes/7.1.0.html",
"refsource": "MISC",
"tags": [
"Product"
],
"url": "https://pillow.readthedocs.io/en/stable/releasenotes/7.1.0.html"
},
{
"name": "https://pillow.readthedocs.io/en/stable/releasenotes/index.html",
"refsource": "MISC",
"tags": [
"Release Notes"
],
"url": "https://pillow.readthedocs.io/en/stable/releasenotes/index.html"
},
{
"name": "https://github.com/python-pillow/Pillow/pull/4538",
"refsource": "MISC",
"tags": [
"Issue Tracking",
"Patch"
],
"url": "https://github.com/python-pillow/Pillow/pull/4538"
},
{
"name": "https://github.com/python-pillow/Pillow/pull/4504",
"refsource": "MISC",
"tags": [
"Issue Tracking",
"Patch"
],
"url": "https://github.com/python-pillow/Pillow/pull/4504"
},
{
"name": "FEDORA-2020-c52106e48a",
"refsource": "FEDORA",
"tags": [
"Mailing List",
"Third Party Advisory"
],
"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/HOKHNWV2VS5GESY7IBD237E7C6T3I427/"
},
{
"name": "FEDORA-2020-d0737711b6",
"refsource": "FEDORA",
"tags": [
"Mailing List",
"Third Party Advisory"
],
"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/BEBCPE4F2VHTIT6EZA2YZQZLPVDEBJGD/"
},
{
"name": "USN-4430-1",
"refsource": "UBUNTU",
"tags": [
"Third Party Advisory"
],
"url": "https://usn.ubuntu.com/4430-1/"
},
{
"name": "USN-4430-2",
"refsource": "UBUNTU",
"tags": [
"Third Party Advisory"
],
"url": "https://usn.ubuntu.com/4430-2/"
}
]
}
},
"impact": {
"baseMetricV2": {
"acInsufInfo": false,
"cvssV2": {
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "PARTIAL",
"baseScore": 6.8,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P",
"version": "2.0"
},
"exploitabilityScore": 8.6,
"impactScore": 6.4,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"severity": "MEDIUM",
"userInteractionRequired": false
},
"baseMetricV3": {
"cvssV3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.1,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"exploitabilityScore": 2.2,
"impactScore": 5.9
}
},
"lastModifiedDate": "2023-02-27T18:01Z",
"publishedDate": "2020-06-25T19:15Z"
}
}
}
PYSEC-2020-80
Vulnerability from pysec - Published: 2020-06-25 19:15 - Updated: 2020-07-27 19:15In libImaging/SgiRleDecode.c in Pillow through 7.0.0, a number of out-of-bounds reads exist in the parsing of SGI image files, a different issue than CVE-2020-5311.
| Name | purl | pillow | pkg:pypi/pillow |
|---|
{
"affected": [
{
"package": {
"ecosystem": "PyPI",
"name": "pillow",
"purl": "pkg:pypi/pillow"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "7.1.0"
}
],
"type": "ECOSYSTEM"
}
],
"versions": [
"1.0",
"1.1",
"1.2",
"1.3",
"1.4",
"1.5",
"1.6",
"1.7.0",
"1.7.1",
"1.7.2",
"1.7.3",
"1.7.4",
"1.7.5",
"1.7.6",
"1.7.7",
"1.7.8",
"2.0.0",
"2.1.0",
"2.2.0",
"2.2.1",
"2.2.2",
"2.3.0",
"2.3.1",
"2.3.2",
"2.4.0",
"2.5.0",
"2.5.1",
"2.5.2",
"2.5.3",
"2.6.0",
"2.6.1",
"2.6.2",
"2.7.0",
"2.8.0",
"2.8.1",
"2.8.2",
"2.9.0",
"3.0.0",
"3.1.0rc1",
"3.1.0.rc1",
"3.1.0",
"3.1.1",
"3.1.2",
"3.2.0",
"3.3.0",
"3.3.1",
"3.3.2",
"3.3.3",
"3.4.0",
"3.4.1",
"3.4.2",
"4.0.0",
"4.1.0",
"4.1.1",
"4.2.0",
"4.2.1",
"4.3.0",
"5.0.0",
"5.1.0",
"5.2.0",
"5.3.0",
"5.4.0.dev0",
"5.4.0",
"5.4.1",
"6.0.0",
"6.1.0",
"6.2.0",
"6.2.1",
"6.2.2",
"7.0.0"
]
}
],
"aliases": [
"CVE-2020-11538",
"GHSA-43fq-w8qq-v88h"
],
"details": "In libImaging/SgiRleDecode.c in Pillow through 7.0.0, a number of out-of-bounds reads exist in the parsing of SGI image files, a different issue than CVE-2020-5311.",
"id": "PYSEC-2020-80",
"modified": "2020-07-27T19:15:00Z",
"published": "2020-06-25T19:15:00Z",
"references": [
{
"type": "WEB",
"url": "https://pillow.readthedocs.io/en/stable/releasenotes/7.1.0.html"
},
{
"type": "WEB",
"url": "https://pillow.readthedocs.io/en/stable/releasenotes/index.html"
},
{
"type": "WEB",
"url": "https://github.com/python-pillow/Pillow/pull/4538"
},
{
"type": "WEB",
"url": "https://github.com/python-pillow/Pillow/pull/4504"
},
{
"type": "WEB",
"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/HOKHNWV2VS5GESY7IBD237E7C6T3I427/"
},
{
"type": "WEB",
"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/BEBCPE4F2VHTIT6EZA2YZQZLPVDEBJGD/"
},
{
"type": "WEB",
"url": "https://usn.ubuntu.com/4430-1/"
},
{
"type": "WEB",
"url": "https://usn.ubuntu.com/4430-2/"
},
{
"type": "ADVISORY",
"url": "https://github.com/advisories/GHSA-43fq-w8qq-v88h"
}
]
}
RHSA-2020:3185
Vulnerability from csaf_redhat - Published: 2020-07-28 13:41 - Updated: 2026-03-26 12:01An out-of-bounds read was discovered in python-pillow in the way it decodes FLI images. An application that uses python-pillow to load untrusted images may be vulnerable to this flaw, which can allow an attacker to read the memory of the application they should be not allowed to read.
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: AppStream-8.2.0.Z.MAIN.EUS:python-pillow-0:5.1.1-12.el8_2.src | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-8.2.0.Z.MAIN.EUS:python-pillow-debuginfo-0:5.1.1-12.el8_2.aarch64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-8.2.0.Z.MAIN.EUS:python-pillow-debuginfo-0:5.1.1-12.el8_2.ppc64le | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-8.2.0.Z.MAIN.EUS:python-pillow-debuginfo-0:5.1.1-12.el8_2.s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-8.2.0.Z.MAIN.EUS:python-pillow-debuginfo-0:5.1.1-12.el8_2.x86_64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-8.2.0.Z.MAIN.EUS:python-pillow-debugsource-0:5.1.1-12.el8_2.aarch64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-8.2.0.Z.MAIN.EUS:python-pillow-debugsource-0:5.1.1-12.el8_2.ppc64le | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-8.2.0.Z.MAIN.EUS:python-pillow-debugsource-0:5.1.1-12.el8_2.s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-8.2.0.Z.MAIN.EUS:python-pillow-debugsource-0:5.1.1-12.el8_2.x86_64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-8.2.0.Z.MAIN.EUS:python3-pillow-0:5.1.1-12.el8_2.aarch64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-8.2.0.Z.MAIN.EUS:python3-pillow-0:5.1.1-12.el8_2.ppc64le | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-8.2.0.Z.MAIN.EUS:python3-pillow-0:5.1.1-12.el8_2.s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-8.2.0.Z.MAIN.EUS:python3-pillow-0:5.1.1-12.el8_2.x86_64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-8.2.0.Z.MAIN.EUS:python3-pillow-debuginfo-0:5.1.1-12.el8_2.aarch64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-8.2.0.Z.MAIN.EUS:python3-pillow-debuginfo-0:5.1.1-12.el8_2.ppc64le | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-8.2.0.Z.MAIN.EUS:python3-pillow-debuginfo-0:5.1.1-12.el8_2.s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-8.2.0.Z.MAIN.EUS:python3-pillow-debuginfo-0:5.1.1-12.el8_2.x86_64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-8.2.0.Z.MAIN.EUS:python3-pillow-tk-debuginfo-0:5.1.1-12.el8_2.aarch64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-8.2.0.Z.MAIN.EUS:python3-pillow-tk-debuginfo-0:5.1.1-12.el8_2.ppc64le | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-8.2.0.Z.MAIN.EUS:python3-pillow-tk-debuginfo-0:5.1.1-12.el8_2.s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-8.2.0.Z.MAIN.EUS:python3-pillow-tk-debuginfo-0:5.1.1-12.el8_2.x86_64 | — |
Vendor Fix
fix
|
An out-of-bounds read/write flaw was found in python-pillow, in the way SGI RLE images are decoded. An application that uses python-pillow to decode untrusted images may be vulnerable. This flaw allows an attacker to crash the application or potentially execute code on the system. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: AppStream-8.2.0.Z.MAIN.EUS:python-pillow-0:5.1.1-12.el8_2.src | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-8.2.0.Z.MAIN.EUS:python-pillow-debuginfo-0:5.1.1-12.el8_2.aarch64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-8.2.0.Z.MAIN.EUS:python-pillow-debuginfo-0:5.1.1-12.el8_2.ppc64le | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-8.2.0.Z.MAIN.EUS:python-pillow-debuginfo-0:5.1.1-12.el8_2.s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-8.2.0.Z.MAIN.EUS:python-pillow-debuginfo-0:5.1.1-12.el8_2.x86_64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-8.2.0.Z.MAIN.EUS:python-pillow-debugsource-0:5.1.1-12.el8_2.aarch64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-8.2.0.Z.MAIN.EUS:python-pillow-debugsource-0:5.1.1-12.el8_2.ppc64le | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-8.2.0.Z.MAIN.EUS:python-pillow-debugsource-0:5.1.1-12.el8_2.s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-8.2.0.Z.MAIN.EUS:python-pillow-debugsource-0:5.1.1-12.el8_2.x86_64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-8.2.0.Z.MAIN.EUS:python3-pillow-0:5.1.1-12.el8_2.aarch64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-8.2.0.Z.MAIN.EUS:python3-pillow-0:5.1.1-12.el8_2.ppc64le | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-8.2.0.Z.MAIN.EUS:python3-pillow-0:5.1.1-12.el8_2.s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-8.2.0.Z.MAIN.EUS:python3-pillow-0:5.1.1-12.el8_2.x86_64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-8.2.0.Z.MAIN.EUS:python3-pillow-debuginfo-0:5.1.1-12.el8_2.aarch64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-8.2.0.Z.MAIN.EUS:python3-pillow-debuginfo-0:5.1.1-12.el8_2.ppc64le | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-8.2.0.Z.MAIN.EUS:python3-pillow-debuginfo-0:5.1.1-12.el8_2.s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-8.2.0.Z.MAIN.EUS:python3-pillow-debuginfo-0:5.1.1-12.el8_2.x86_64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-8.2.0.Z.MAIN.EUS:python3-pillow-tk-debuginfo-0:5.1.1-12.el8_2.aarch64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-8.2.0.Z.MAIN.EUS:python3-pillow-tk-debuginfo-0:5.1.1-12.el8_2.ppc64le | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-8.2.0.Z.MAIN.EUS:python3-pillow-tk-debuginfo-0:5.1.1-12.el8_2.s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-8.2.0.Z.MAIN.EUS:python3-pillow-tk-debuginfo-0:5.1.1-12.el8_2.x86_64 | — |
Vendor Fix
fix
|
{
"document": {
"aggregate_severity": {
"namespace": "https://access.redhat.com/security/updates/classification/",
"text": "Important"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "An update for python-pillow is now available for Red Hat Enterprise Linux 8.\n\nRed Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.",
"title": "Topic"
},
{
"category": "general",
"text": "The python-pillow packages contain a Python image processing library that provides extensive file format support, an efficient internal representation, and powerful image-processing capabilities.\n\nSecurity Fix(es):\n\n* python-pillow: out-of-bounds reads/writes in the parsing of SGI image files in expandrow/expandrow2 (CVE-2020-11538)\n\n* python-pillow: out-of-bounds read in ImagingFliDecode when loading FLI images (CVE-2020-5313)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.",
"title": "Details"
},
{
"category": "legal_disclaimer",
"text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
"title": "Terms of Use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://access.redhat.com/security/team/contact/",
"issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
"name": "Red Hat Product Security",
"namespace": "https://www.redhat.com"
},
"references": [
{
"category": "self",
"summary": "https://access.redhat.com/errata/RHSA-2020:3185",
"url": "https://access.redhat.com/errata/RHSA-2020:3185"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/updates/classification/#important",
"url": "https://access.redhat.com/security/updates/classification/#important"
},
{
"category": "external",
"summary": "1789532",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1789532"
},
{
"category": "external",
"summary": "1852814",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1852814"
},
{
"category": "self",
"summary": "Canonical URL",
"url": "https://security.access.redhat.com/data/csaf/v2/advisories/2020/rhsa-2020_3185.json"
}
],
"title": "Red Hat Security Advisory: python-pillow security update",
"tracking": {
"current_release_date": "2026-03-26T12:01:15+00:00",
"generator": {
"date": "2026-03-26T12:01:15+00:00",
"engine": {
"name": "Red Hat SDEngine",
"version": "4.7.4"
}
},
"id": "RHSA-2020:3185",
"initial_release_date": "2020-07-28T13:41:04+00:00",
"revision_history": [
{
"date": "2020-07-28T13:41:04+00:00",
"number": "1",
"summary": "Initial version"
},
{
"date": "2020-07-28T13:41:04+00:00",
"number": "2",
"summary": "Last updated version"
},
{
"date": "2026-03-26T12:01:15+00:00",
"number": "3",
"summary": "Last generated version"
}
],
"status": "final",
"version": "3"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_name",
"name": "Red Hat Enterprise Linux AppStream (v. 8)",
"product": {
"name": "Red Hat Enterprise Linux AppStream (v. 8)",
"product_id": "AppStream-8.2.0.Z.MAIN.EUS",
"product_identification_helper": {
"cpe": "cpe:/a:redhat:enterprise_linux:8::appstream"
}
}
}
],
"category": "product_family",
"name": "Red Hat Enterprise Linux"
},
{
"branches": [
{
"category": "product_version",
"name": "python-pillow-0:5.1.1-12.el8_2.src",
"product": {
"name": "python-pillow-0:5.1.1-12.el8_2.src",
"product_id": "python-pillow-0:5.1.1-12.el8_2.src",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/python-pillow@5.1.1-12.el8_2?arch=src"
}
}
}
],
"category": "architecture",
"name": "src"
},
{
"branches": [
{
"category": "product_version",
"name": "python3-pillow-0:5.1.1-12.el8_2.ppc64le",
"product": {
"name": "python3-pillow-0:5.1.1-12.el8_2.ppc64le",
"product_id": "python3-pillow-0:5.1.1-12.el8_2.ppc64le",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/python3-pillow@5.1.1-12.el8_2?arch=ppc64le"
}
}
},
{
"category": "product_version",
"name": "python-pillow-debugsource-0:5.1.1-12.el8_2.ppc64le",
"product": {
"name": "python-pillow-debugsource-0:5.1.1-12.el8_2.ppc64le",
"product_id": "python-pillow-debugsource-0:5.1.1-12.el8_2.ppc64le",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/python-pillow-debugsource@5.1.1-12.el8_2?arch=ppc64le"
}
}
},
{
"category": "product_version",
"name": "python-pillow-debuginfo-0:5.1.1-12.el8_2.ppc64le",
"product": {
"name": "python-pillow-debuginfo-0:5.1.1-12.el8_2.ppc64le",
"product_id": "python-pillow-debuginfo-0:5.1.1-12.el8_2.ppc64le",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/python-pillow-debuginfo@5.1.1-12.el8_2?arch=ppc64le"
}
}
},
{
"category": "product_version",
"name": "python3-pillow-debuginfo-0:5.1.1-12.el8_2.ppc64le",
"product": {
"name": "python3-pillow-debuginfo-0:5.1.1-12.el8_2.ppc64le",
"product_id": "python3-pillow-debuginfo-0:5.1.1-12.el8_2.ppc64le",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/python3-pillow-debuginfo@5.1.1-12.el8_2?arch=ppc64le"
}
}
},
{
"category": "product_version",
"name": "python3-pillow-tk-debuginfo-0:5.1.1-12.el8_2.ppc64le",
"product": {
"name": "python3-pillow-tk-debuginfo-0:5.1.1-12.el8_2.ppc64le",
"product_id": "python3-pillow-tk-debuginfo-0:5.1.1-12.el8_2.ppc64le",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/python3-pillow-tk-debuginfo@5.1.1-12.el8_2?arch=ppc64le"
}
}
}
],
"category": "architecture",
"name": "ppc64le"
},
{
"branches": [
{
"category": "product_version",
"name": "python3-pillow-0:5.1.1-12.el8_2.s390x",
"product": {
"name": "python3-pillow-0:5.1.1-12.el8_2.s390x",
"product_id": "python3-pillow-0:5.1.1-12.el8_2.s390x",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/python3-pillow@5.1.1-12.el8_2?arch=s390x"
}
}
},
{
"category": "product_version",
"name": "python-pillow-debugsource-0:5.1.1-12.el8_2.s390x",
"product": {
"name": "python-pillow-debugsource-0:5.1.1-12.el8_2.s390x",
"product_id": "python-pillow-debugsource-0:5.1.1-12.el8_2.s390x",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/python-pillow-debugsource@5.1.1-12.el8_2?arch=s390x"
}
}
},
{
"category": "product_version",
"name": "python-pillow-debuginfo-0:5.1.1-12.el8_2.s390x",
"product": {
"name": "python-pillow-debuginfo-0:5.1.1-12.el8_2.s390x",
"product_id": "python-pillow-debuginfo-0:5.1.1-12.el8_2.s390x",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/python-pillow-debuginfo@5.1.1-12.el8_2?arch=s390x"
}
}
},
{
"category": "product_version",
"name": "python3-pillow-debuginfo-0:5.1.1-12.el8_2.s390x",
"product": {
"name": "python3-pillow-debuginfo-0:5.1.1-12.el8_2.s390x",
"product_id": "python3-pillow-debuginfo-0:5.1.1-12.el8_2.s390x",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/python3-pillow-debuginfo@5.1.1-12.el8_2?arch=s390x"
}
}
},
{
"category": "product_version",
"name": "python3-pillow-tk-debuginfo-0:5.1.1-12.el8_2.s390x",
"product": {
"name": "python3-pillow-tk-debuginfo-0:5.1.1-12.el8_2.s390x",
"product_id": "python3-pillow-tk-debuginfo-0:5.1.1-12.el8_2.s390x",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/python3-pillow-tk-debuginfo@5.1.1-12.el8_2?arch=s390x"
}
}
}
],
"category": "architecture",
"name": "s390x"
},
{
"branches": [
{
"category": "product_version",
"name": "python3-pillow-0:5.1.1-12.el8_2.x86_64",
"product": {
"name": "python3-pillow-0:5.1.1-12.el8_2.x86_64",
"product_id": "python3-pillow-0:5.1.1-12.el8_2.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/python3-pillow@5.1.1-12.el8_2?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "python-pillow-debugsource-0:5.1.1-12.el8_2.x86_64",
"product": {
"name": "python-pillow-debugsource-0:5.1.1-12.el8_2.x86_64",
"product_id": "python-pillow-debugsource-0:5.1.1-12.el8_2.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/python-pillow-debugsource@5.1.1-12.el8_2?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "python-pillow-debuginfo-0:5.1.1-12.el8_2.x86_64",
"product": {
"name": "python-pillow-debuginfo-0:5.1.1-12.el8_2.x86_64",
"product_id": "python-pillow-debuginfo-0:5.1.1-12.el8_2.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/python-pillow-debuginfo@5.1.1-12.el8_2?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "python3-pillow-debuginfo-0:5.1.1-12.el8_2.x86_64",
"product": {
"name": "python3-pillow-debuginfo-0:5.1.1-12.el8_2.x86_64",
"product_id": "python3-pillow-debuginfo-0:5.1.1-12.el8_2.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/python3-pillow-debuginfo@5.1.1-12.el8_2?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "python3-pillow-tk-debuginfo-0:5.1.1-12.el8_2.x86_64",
"product": {
"name": "python3-pillow-tk-debuginfo-0:5.1.1-12.el8_2.x86_64",
"product_id": "python3-pillow-tk-debuginfo-0:5.1.1-12.el8_2.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/python3-pillow-tk-debuginfo@5.1.1-12.el8_2?arch=x86_64"
}
}
}
],
"category": "architecture",
"name": "x86_64"
},
{
"branches": [
{
"category": "product_version",
"name": "python3-pillow-0:5.1.1-12.el8_2.aarch64",
"product": {
"name": "python3-pillow-0:5.1.1-12.el8_2.aarch64",
"product_id": "python3-pillow-0:5.1.1-12.el8_2.aarch64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/python3-pillow@5.1.1-12.el8_2?arch=aarch64"
}
}
},
{
"category": "product_version",
"name": "python-pillow-debugsource-0:5.1.1-12.el8_2.aarch64",
"product": {
"name": "python-pillow-debugsource-0:5.1.1-12.el8_2.aarch64",
"product_id": "python-pillow-debugsource-0:5.1.1-12.el8_2.aarch64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/python-pillow-debugsource@5.1.1-12.el8_2?arch=aarch64"
}
}
},
{
"category": "product_version",
"name": "python-pillow-debuginfo-0:5.1.1-12.el8_2.aarch64",
"product": {
"name": "python-pillow-debuginfo-0:5.1.1-12.el8_2.aarch64",
"product_id": "python-pillow-debuginfo-0:5.1.1-12.el8_2.aarch64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/python-pillow-debuginfo@5.1.1-12.el8_2?arch=aarch64"
}
}
},
{
"category": "product_version",
"name": "python3-pillow-debuginfo-0:5.1.1-12.el8_2.aarch64",
"product": {
"name": "python3-pillow-debuginfo-0:5.1.1-12.el8_2.aarch64",
"product_id": "python3-pillow-debuginfo-0:5.1.1-12.el8_2.aarch64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/python3-pillow-debuginfo@5.1.1-12.el8_2?arch=aarch64"
}
}
},
{
"category": "product_version",
"name": "python3-pillow-tk-debuginfo-0:5.1.1-12.el8_2.aarch64",
"product": {
"name": "python3-pillow-tk-debuginfo-0:5.1.1-12.el8_2.aarch64",
"product_id": "python3-pillow-tk-debuginfo-0:5.1.1-12.el8_2.aarch64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/python3-pillow-tk-debuginfo@5.1.1-12.el8_2?arch=aarch64"
}
}
}
],
"category": "architecture",
"name": "aarch64"
}
],
"category": "vendor",
"name": "Red Hat"
}
],
"relationships": [
{
"category": "default_component_of",
"full_product_name": {
"name": "python-pillow-0:5.1.1-12.el8_2.src as a component of Red Hat Enterprise Linux AppStream (v. 8)",
"product_id": "AppStream-8.2.0.Z.MAIN.EUS:python-pillow-0:5.1.1-12.el8_2.src"
},
"product_reference": "python-pillow-0:5.1.1-12.el8_2.src",
"relates_to_product_reference": "AppStream-8.2.0.Z.MAIN.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "python-pillow-debuginfo-0:5.1.1-12.el8_2.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 8)",
"product_id": "AppStream-8.2.0.Z.MAIN.EUS:python-pillow-debuginfo-0:5.1.1-12.el8_2.aarch64"
},
"product_reference": "python-pillow-debuginfo-0:5.1.1-12.el8_2.aarch64",
"relates_to_product_reference": "AppStream-8.2.0.Z.MAIN.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "python-pillow-debuginfo-0:5.1.1-12.el8_2.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 8)",
"product_id": "AppStream-8.2.0.Z.MAIN.EUS:python-pillow-debuginfo-0:5.1.1-12.el8_2.ppc64le"
},
"product_reference": "python-pillow-debuginfo-0:5.1.1-12.el8_2.ppc64le",
"relates_to_product_reference": "AppStream-8.2.0.Z.MAIN.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "python-pillow-debuginfo-0:5.1.1-12.el8_2.s390x as a component of Red Hat Enterprise Linux AppStream (v. 8)",
"product_id": "AppStream-8.2.0.Z.MAIN.EUS:python-pillow-debuginfo-0:5.1.1-12.el8_2.s390x"
},
"product_reference": "python-pillow-debuginfo-0:5.1.1-12.el8_2.s390x",
"relates_to_product_reference": "AppStream-8.2.0.Z.MAIN.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "python-pillow-debuginfo-0:5.1.1-12.el8_2.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 8)",
"product_id": "AppStream-8.2.0.Z.MAIN.EUS:python-pillow-debuginfo-0:5.1.1-12.el8_2.x86_64"
},
"product_reference": "python-pillow-debuginfo-0:5.1.1-12.el8_2.x86_64",
"relates_to_product_reference": "AppStream-8.2.0.Z.MAIN.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "python-pillow-debugsource-0:5.1.1-12.el8_2.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 8)",
"product_id": "AppStream-8.2.0.Z.MAIN.EUS:python-pillow-debugsource-0:5.1.1-12.el8_2.aarch64"
},
"product_reference": "python-pillow-debugsource-0:5.1.1-12.el8_2.aarch64",
"relates_to_product_reference": "AppStream-8.2.0.Z.MAIN.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "python-pillow-debugsource-0:5.1.1-12.el8_2.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 8)",
"product_id": "AppStream-8.2.0.Z.MAIN.EUS:python-pillow-debugsource-0:5.1.1-12.el8_2.ppc64le"
},
"product_reference": "python-pillow-debugsource-0:5.1.1-12.el8_2.ppc64le",
"relates_to_product_reference": "AppStream-8.2.0.Z.MAIN.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "python-pillow-debugsource-0:5.1.1-12.el8_2.s390x as a component of Red Hat Enterprise Linux AppStream (v. 8)",
"product_id": "AppStream-8.2.0.Z.MAIN.EUS:python-pillow-debugsource-0:5.1.1-12.el8_2.s390x"
},
"product_reference": "python-pillow-debugsource-0:5.1.1-12.el8_2.s390x",
"relates_to_product_reference": "AppStream-8.2.0.Z.MAIN.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "python-pillow-debugsource-0:5.1.1-12.el8_2.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 8)",
"product_id": "AppStream-8.2.0.Z.MAIN.EUS:python-pillow-debugsource-0:5.1.1-12.el8_2.x86_64"
},
"product_reference": "python-pillow-debugsource-0:5.1.1-12.el8_2.x86_64",
"relates_to_product_reference": "AppStream-8.2.0.Z.MAIN.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "python3-pillow-0:5.1.1-12.el8_2.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 8)",
"product_id": "AppStream-8.2.0.Z.MAIN.EUS:python3-pillow-0:5.1.1-12.el8_2.aarch64"
},
"product_reference": "python3-pillow-0:5.1.1-12.el8_2.aarch64",
"relates_to_product_reference": "AppStream-8.2.0.Z.MAIN.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "python3-pillow-0:5.1.1-12.el8_2.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 8)",
"product_id": "AppStream-8.2.0.Z.MAIN.EUS:python3-pillow-0:5.1.1-12.el8_2.ppc64le"
},
"product_reference": "python3-pillow-0:5.1.1-12.el8_2.ppc64le",
"relates_to_product_reference": "AppStream-8.2.0.Z.MAIN.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "python3-pillow-0:5.1.1-12.el8_2.s390x as a component of Red Hat Enterprise Linux AppStream (v. 8)",
"product_id": "AppStream-8.2.0.Z.MAIN.EUS:python3-pillow-0:5.1.1-12.el8_2.s390x"
},
"product_reference": "python3-pillow-0:5.1.1-12.el8_2.s390x",
"relates_to_product_reference": "AppStream-8.2.0.Z.MAIN.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "python3-pillow-0:5.1.1-12.el8_2.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 8)",
"product_id": "AppStream-8.2.0.Z.MAIN.EUS:python3-pillow-0:5.1.1-12.el8_2.x86_64"
},
"product_reference": "python3-pillow-0:5.1.1-12.el8_2.x86_64",
"relates_to_product_reference": "AppStream-8.2.0.Z.MAIN.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "python3-pillow-debuginfo-0:5.1.1-12.el8_2.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 8)",
"product_id": "AppStream-8.2.0.Z.MAIN.EUS:python3-pillow-debuginfo-0:5.1.1-12.el8_2.aarch64"
},
"product_reference": "python3-pillow-debuginfo-0:5.1.1-12.el8_2.aarch64",
"relates_to_product_reference": "AppStream-8.2.0.Z.MAIN.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "python3-pillow-debuginfo-0:5.1.1-12.el8_2.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 8)",
"product_id": "AppStream-8.2.0.Z.MAIN.EUS:python3-pillow-debuginfo-0:5.1.1-12.el8_2.ppc64le"
},
"product_reference": "python3-pillow-debuginfo-0:5.1.1-12.el8_2.ppc64le",
"relates_to_product_reference": "AppStream-8.2.0.Z.MAIN.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "python3-pillow-debuginfo-0:5.1.1-12.el8_2.s390x as a component of Red Hat Enterprise Linux AppStream (v. 8)",
"product_id": "AppStream-8.2.0.Z.MAIN.EUS:python3-pillow-debuginfo-0:5.1.1-12.el8_2.s390x"
},
"product_reference": "python3-pillow-debuginfo-0:5.1.1-12.el8_2.s390x",
"relates_to_product_reference": "AppStream-8.2.0.Z.MAIN.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "python3-pillow-debuginfo-0:5.1.1-12.el8_2.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 8)",
"product_id": "AppStream-8.2.0.Z.MAIN.EUS:python3-pillow-debuginfo-0:5.1.1-12.el8_2.x86_64"
},
"product_reference": "python3-pillow-debuginfo-0:5.1.1-12.el8_2.x86_64",
"relates_to_product_reference": "AppStream-8.2.0.Z.MAIN.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "python3-pillow-tk-debuginfo-0:5.1.1-12.el8_2.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 8)",
"product_id": "AppStream-8.2.0.Z.MAIN.EUS:python3-pillow-tk-debuginfo-0:5.1.1-12.el8_2.aarch64"
},
"product_reference": "python3-pillow-tk-debuginfo-0:5.1.1-12.el8_2.aarch64",
"relates_to_product_reference": "AppStream-8.2.0.Z.MAIN.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "python3-pillow-tk-debuginfo-0:5.1.1-12.el8_2.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 8)",
"product_id": "AppStream-8.2.0.Z.MAIN.EUS:python3-pillow-tk-debuginfo-0:5.1.1-12.el8_2.ppc64le"
},
"product_reference": "python3-pillow-tk-debuginfo-0:5.1.1-12.el8_2.ppc64le",
"relates_to_product_reference": "AppStream-8.2.0.Z.MAIN.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "python3-pillow-tk-debuginfo-0:5.1.1-12.el8_2.s390x as a component of Red Hat Enterprise Linux AppStream (v. 8)",
"product_id": "AppStream-8.2.0.Z.MAIN.EUS:python3-pillow-tk-debuginfo-0:5.1.1-12.el8_2.s390x"
},
"product_reference": "python3-pillow-tk-debuginfo-0:5.1.1-12.el8_2.s390x",
"relates_to_product_reference": "AppStream-8.2.0.Z.MAIN.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "python3-pillow-tk-debuginfo-0:5.1.1-12.el8_2.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 8)",
"product_id": "AppStream-8.2.0.Z.MAIN.EUS:python3-pillow-tk-debuginfo-0:5.1.1-12.el8_2.x86_64"
},
"product_reference": "python3-pillow-tk-debuginfo-0:5.1.1-12.el8_2.x86_64",
"relates_to_product_reference": "AppStream-8.2.0.Z.MAIN.EUS"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2020-5313",
"cwe": {
"id": "CWE-125",
"name": "Out-of-bounds Read"
},
"discovery_date": "2020-01-03T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1789532"
}
],
"notes": [
{
"category": "description",
"text": "An out-of-bounds read was discovered in python-pillow in the way it decodes FLI images. An application that uses python-pillow to load untrusted images may be vulnerable to this flaw, which can allow an attacker to read the memory of the application they should be not allowed to read.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "python-pillow: out-of-bounds read in ImagingFliDecode when loading FLI images",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"AppStream-8.2.0.Z.MAIN.EUS:python-pillow-0:5.1.1-12.el8_2.src",
"AppStream-8.2.0.Z.MAIN.EUS:python-pillow-debuginfo-0:5.1.1-12.el8_2.aarch64",
"AppStream-8.2.0.Z.MAIN.EUS:python-pillow-debuginfo-0:5.1.1-12.el8_2.ppc64le",
"AppStream-8.2.0.Z.MAIN.EUS:python-pillow-debuginfo-0:5.1.1-12.el8_2.s390x",
"AppStream-8.2.0.Z.MAIN.EUS:python-pillow-debuginfo-0:5.1.1-12.el8_2.x86_64",
"AppStream-8.2.0.Z.MAIN.EUS:python-pillow-debugsource-0:5.1.1-12.el8_2.aarch64",
"AppStream-8.2.0.Z.MAIN.EUS:python-pillow-debugsource-0:5.1.1-12.el8_2.ppc64le",
"AppStream-8.2.0.Z.MAIN.EUS:python-pillow-debugsource-0:5.1.1-12.el8_2.s390x",
"AppStream-8.2.0.Z.MAIN.EUS:python-pillow-debugsource-0:5.1.1-12.el8_2.x86_64",
"AppStream-8.2.0.Z.MAIN.EUS:python3-pillow-0:5.1.1-12.el8_2.aarch64",
"AppStream-8.2.0.Z.MAIN.EUS:python3-pillow-0:5.1.1-12.el8_2.ppc64le",
"AppStream-8.2.0.Z.MAIN.EUS:python3-pillow-0:5.1.1-12.el8_2.s390x",
"AppStream-8.2.0.Z.MAIN.EUS:python3-pillow-0:5.1.1-12.el8_2.x86_64",
"AppStream-8.2.0.Z.MAIN.EUS:python3-pillow-debuginfo-0:5.1.1-12.el8_2.aarch64",
"AppStream-8.2.0.Z.MAIN.EUS:python3-pillow-debuginfo-0:5.1.1-12.el8_2.ppc64le",
"AppStream-8.2.0.Z.MAIN.EUS:python3-pillow-debuginfo-0:5.1.1-12.el8_2.s390x",
"AppStream-8.2.0.Z.MAIN.EUS:python3-pillow-debuginfo-0:5.1.1-12.el8_2.x86_64",
"AppStream-8.2.0.Z.MAIN.EUS:python3-pillow-tk-debuginfo-0:5.1.1-12.el8_2.aarch64",
"AppStream-8.2.0.Z.MAIN.EUS:python3-pillow-tk-debuginfo-0:5.1.1-12.el8_2.ppc64le",
"AppStream-8.2.0.Z.MAIN.EUS:python3-pillow-tk-debuginfo-0:5.1.1-12.el8_2.s390x",
"AppStream-8.2.0.Z.MAIN.EUS:python3-pillow-tk-debuginfo-0:5.1.1-12.el8_2.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2020-5313"
},
{
"category": "external",
"summary": "RHBZ#1789532",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1789532"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2020-5313",
"url": "https://www.cve.org/CVERecord?id=CVE-2020-5313"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2020-5313",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2020-5313"
}
],
"release_date": "2020-01-03T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2020-07-28T13:41:04+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"AppStream-8.2.0.Z.MAIN.EUS:python-pillow-0:5.1.1-12.el8_2.src",
"AppStream-8.2.0.Z.MAIN.EUS:python-pillow-debuginfo-0:5.1.1-12.el8_2.aarch64",
"AppStream-8.2.0.Z.MAIN.EUS:python-pillow-debuginfo-0:5.1.1-12.el8_2.ppc64le",
"AppStream-8.2.0.Z.MAIN.EUS:python-pillow-debuginfo-0:5.1.1-12.el8_2.s390x",
"AppStream-8.2.0.Z.MAIN.EUS:python-pillow-debuginfo-0:5.1.1-12.el8_2.x86_64",
"AppStream-8.2.0.Z.MAIN.EUS:python-pillow-debugsource-0:5.1.1-12.el8_2.aarch64",
"AppStream-8.2.0.Z.MAIN.EUS:python-pillow-debugsource-0:5.1.1-12.el8_2.ppc64le",
"AppStream-8.2.0.Z.MAIN.EUS:python-pillow-debugsource-0:5.1.1-12.el8_2.s390x",
"AppStream-8.2.0.Z.MAIN.EUS:python-pillow-debugsource-0:5.1.1-12.el8_2.x86_64",
"AppStream-8.2.0.Z.MAIN.EUS:python3-pillow-0:5.1.1-12.el8_2.aarch64",
"AppStream-8.2.0.Z.MAIN.EUS:python3-pillow-0:5.1.1-12.el8_2.ppc64le",
"AppStream-8.2.0.Z.MAIN.EUS:python3-pillow-0:5.1.1-12.el8_2.s390x",
"AppStream-8.2.0.Z.MAIN.EUS:python3-pillow-0:5.1.1-12.el8_2.x86_64",
"AppStream-8.2.0.Z.MAIN.EUS:python3-pillow-debuginfo-0:5.1.1-12.el8_2.aarch64",
"AppStream-8.2.0.Z.MAIN.EUS:python3-pillow-debuginfo-0:5.1.1-12.el8_2.ppc64le",
"AppStream-8.2.0.Z.MAIN.EUS:python3-pillow-debuginfo-0:5.1.1-12.el8_2.s390x",
"AppStream-8.2.0.Z.MAIN.EUS:python3-pillow-debuginfo-0:5.1.1-12.el8_2.x86_64",
"AppStream-8.2.0.Z.MAIN.EUS:python3-pillow-tk-debuginfo-0:5.1.1-12.el8_2.aarch64",
"AppStream-8.2.0.Z.MAIN.EUS:python3-pillow-tk-debuginfo-0:5.1.1-12.el8_2.ppc64le",
"AppStream-8.2.0.Z.MAIN.EUS:python3-pillow-tk-debuginfo-0:5.1.1-12.el8_2.s390x",
"AppStream-8.2.0.Z.MAIN.EUS:python3-pillow-tk-debuginfo-0:5.1.1-12.el8_2.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2020:3185"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.2,
"baseSeverity": "HIGH",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H",
"version": "3.1"
},
"products": [
"AppStream-8.2.0.Z.MAIN.EUS:python-pillow-0:5.1.1-12.el8_2.src",
"AppStream-8.2.0.Z.MAIN.EUS:python-pillow-debuginfo-0:5.1.1-12.el8_2.aarch64",
"AppStream-8.2.0.Z.MAIN.EUS:python-pillow-debuginfo-0:5.1.1-12.el8_2.ppc64le",
"AppStream-8.2.0.Z.MAIN.EUS:python-pillow-debuginfo-0:5.1.1-12.el8_2.s390x",
"AppStream-8.2.0.Z.MAIN.EUS:python-pillow-debuginfo-0:5.1.1-12.el8_2.x86_64",
"AppStream-8.2.0.Z.MAIN.EUS:python-pillow-debugsource-0:5.1.1-12.el8_2.aarch64",
"AppStream-8.2.0.Z.MAIN.EUS:python-pillow-debugsource-0:5.1.1-12.el8_2.ppc64le",
"AppStream-8.2.0.Z.MAIN.EUS:python-pillow-debugsource-0:5.1.1-12.el8_2.s390x",
"AppStream-8.2.0.Z.MAIN.EUS:python-pillow-debugsource-0:5.1.1-12.el8_2.x86_64",
"AppStream-8.2.0.Z.MAIN.EUS:python3-pillow-0:5.1.1-12.el8_2.aarch64",
"AppStream-8.2.0.Z.MAIN.EUS:python3-pillow-0:5.1.1-12.el8_2.ppc64le",
"AppStream-8.2.0.Z.MAIN.EUS:python3-pillow-0:5.1.1-12.el8_2.s390x",
"AppStream-8.2.0.Z.MAIN.EUS:python3-pillow-0:5.1.1-12.el8_2.x86_64",
"AppStream-8.2.0.Z.MAIN.EUS:python3-pillow-debuginfo-0:5.1.1-12.el8_2.aarch64",
"AppStream-8.2.0.Z.MAIN.EUS:python3-pillow-debuginfo-0:5.1.1-12.el8_2.ppc64le",
"AppStream-8.2.0.Z.MAIN.EUS:python3-pillow-debuginfo-0:5.1.1-12.el8_2.s390x",
"AppStream-8.2.0.Z.MAIN.EUS:python3-pillow-debuginfo-0:5.1.1-12.el8_2.x86_64",
"AppStream-8.2.0.Z.MAIN.EUS:python3-pillow-tk-debuginfo-0:5.1.1-12.el8_2.aarch64",
"AppStream-8.2.0.Z.MAIN.EUS:python3-pillow-tk-debuginfo-0:5.1.1-12.el8_2.ppc64le",
"AppStream-8.2.0.Z.MAIN.EUS:python3-pillow-tk-debuginfo-0:5.1.1-12.el8_2.s390x",
"AppStream-8.2.0.Z.MAIN.EUS:python3-pillow-tk-debuginfo-0:5.1.1-12.el8_2.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "python-pillow: out-of-bounds read in ImagingFliDecode when loading FLI images"
},
{
"cve": "CVE-2020-11538",
"cwe": {
"id": "CWE-122",
"name": "Heap-based Buffer Overflow"
},
"discovery_date": "2020-07-01T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1852814"
}
],
"notes": [
{
"category": "description",
"text": "An out-of-bounds read/write flaw was found in python-pillow, in the way SGI RLE images are decoded. An application that uses python-pillow to decode untrusted images may be vulnerable. This flaw allows an attacker to crash the application or potentially execute code on the system. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "python-pillow: out-of-bounds reads/writes in the parsing of SGI image files in expandrow/expandrow2",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This issue did not affect the versions of python-pillow and python-imaging as shipped with Red Hat Enterprise Linux 5, 6, and 7 as they did not include the SGI RLE image decoder, where the flaw lies.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"AppStream-8.2.0.Z.MAIN.EUS:python-pillow-0:5.1.1-12.el8_2.src",
"AppStream-8.2.0.Z.MAIN.EUS:python-pillow-debuginfo-0:5.1.1-12.el8_2.aarch64",
"AppStream-8.2.0.Z.MAIN.EUS:python-pillow-debuginfo-0:5.1.1-12.el8_2.ppc64le",
"AppStream-8.2.0.Z.MAIN.EUS:python-pillow-debuginfo-0:5.1.1-12.el8_2.s390x",
"AppStream-8.2.0.Z.MAIN.EUS:python-pillow-debuginfo-0:5.1.1-12.el8_2.x86_64",
"AppStream-8.2.0.Z.MAIN.EUS:python-pillow-debugsource-0:5.1.1-12.el8_2.aarch64",
"AppStream-8.2.0.Z.MAIN.EUS:python-pillow-debugsource-0:5.1.1-12.el8_2.ppc64le",
"AppStream-8.2.0.Z.MAIN.EUS:python-pillow-debugsource-0:5.1.1-12.el8_2.s390x",
"AppStream-8.2.0.Z.MAIN.EUS:python-pillow-debugsource-0:5.1.1-12.el8_2.x86_64",
"AppStream-8.2.0.Z.MAIN.EUS:python3-pillow-0:5.1.1-12.el8_2.aarch64",
"AppStream-8.2.0.Z.MAIN.EUS:python3-pillow-0:5.1.1-12.el8_2.ppc64le",
"AppStream-8.2.0.Z.MAIN.EUS:python3-pillow-0:5.1.1-12.el8_2.s390x",
"AppStream-8.2.0.Z.MAIN.EUS:python3-pillow-0:5.1.1-12.el8_2.x86_64",
"AppStream-8.2.0.Z.MAIN.EUS:python3-pillow-debuginfo-0:5.1.1-12.el8_2.aarch64",
"AppStream-8.2.0.Z.MAIN.EUS:python3-pillow-debuginfo-0:5.1.1-12.el8_2.ppc64le",
"AppStream-8.2.0.Z.MAIN.EUS:python3-pillow-debuginfo-0:5.1.1-12.el8_2.s390x",
"AppStream-8.2.0.Z.MAIN.EUS:python3-pillow-debuginfo-0:5.1.1-12.el8_2.x86_64",
"AppStream-8.2.0.Z.MAIN.EUS:python3-pillow-tk-debuginfo-0:5.1.1-12.el8_2.aarch64",
"AppStream-8.2.0.Z.MAIN.EUS:python3-pillow-tk-debuginfo-0:5.1.1-12.el8_2.ppc64le",
"AppStream-8.2.0.Z.MAIN.EUS:python3-pillow-tk-debuginfo-0:5.1.1-12.el8_2.s390x",
"AppStream-8.2.0.Z.MAIN.EUS:python3-pillow-tk-debuginfo-0:5.1.1-12.el8_2.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2020-11538"
},
{
"category": "external",
"summary": "RHBZ#1852814",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1852814"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2020-11538",
"url": "https://www.cve.org/CVERecord?id=CVE-2020-11538"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2020-11538",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2020-11538"
}
],
"release_date": "2020-07-01T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2020-07-28T13:41:04+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"AppStream-8.2.0.Z.MAIN.EUS:python-pillow-0:5.1.1-12.el8_2.src",
"AppStream-8.2.0.Z.MAIN.EUS:python-pillow-debuginfo-0:5.1.1-12.el8_2.aarch64",
"AppStream-8.2.0.Z.MAIN.EUS:python-pillow-debuginfo-0:5.1.1-12.el8_2.ppc64le",
"AppStream-8.2.0.Z.MAIN.EUS:python-pillow-debuginfo-0:5.1.1-12.el8_2.s390x",
"AppStream-8.2.0.Z.MAIN.EUS:python-pillow-debuginfo-0:5.1.1-12.el8_2.x86_64",
"AppStream-8.2.0.Z.MAIN.EUS:python-pillow-debugsource-0:5.1.1-12.el8_2.aarch64",
"AppStream-8.2.0.Z.MAIN.EUS:python-pillow-debugsource-0:5.1.1-12.el8_2.ppc64le",
"AppStream-8.2.0.Z.MAIN.EUS:python-pillow-debugsource-0:5.1.1-12.el8_2.s390x",
"AppStream-8.2.0.Z.MAIN.EUS:python-pillow-debugsource-0:5.1.1-12.el8_2.x86_64",
"AppStream-8.2.0.Z.MAIN.EUS:python3-pillow-0:5.1.1-12.el8_2.aarch64",
"AppStream-8.2.0.Z.MAIN.EUS:python3-pillow-0:5.1.1-12.el8_2.ppc64le",
"AppStream-8.2.0.Z.MAIN.EUS:python3-pillow-0:5.1.1-12.el8_2.s390x",
"AppStream-8.2.0.Z.MAIN.EUS:python3-pillow-0:5.1.1-12.el8_2.x86_64",
"AppStream-8.2.0.Z.MAIN.EUS:python3-pillow-debuginfo-0:5.1.1-12.el8_2.aarch64",
"AppStream-8.2.0.Z.MAIN.EUS:python3-pillow-debuginfo-0:5.1.1-12.el8_2.ppc64le",
"AppStream-8.2.0.Z.MAIN.EUS:python3-pillow-debuginfo-0:5.1.1-12.el8_2.s390x",
"AppStream-8.2.0.Z.MAIN.EUS:python3-pillow-debuginfo-0:5.1.1-12.el8_2.x86_64",
"AppStream-8.2.0.Z.MAIN.EUS:python3-pillow-tk-debuginfo-0:5.1.1-12.el8_2.aarch64",
"AppStream-8.2.0.Z.MAIN.EUS:python3-pillow-tk-debuginfo-0:5.1.1-12.el8_2.ppc64le",
"AppStream-8.2.0.Z.MAIN.EUS:python3-pillow-tk-debuginfo-0:5.1.1-12.el8_2.s390x",
"AppStream-8.2.0.Z.MAIN.EUS:python3-pillow-tk-debuginfo-0:5.1.1-12.el8_2.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2020:3185"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.1,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"AppStream-8.2.0.Z.MAIN.EUS:python-pillow-0:5.1.1-12.el8_2.src",
"AppStream-8.2.0.Z.MAIN.EUS:python-pillow-debuginfo-0:5.1.1-12.el8_2.aarch64",
"AppStream-8.2.0.Z.MAIN.EUS:python-pillow-debuginfo-0:5.1.1-12.el8_2.ppc64le",
"AppStream-8.2.0.Z.MAIN.EUS:python-pillow-debuginfo-0:5.1.1-12.el8_2.s390x",
"AppStream-8.2.0.Z.MAIN.EUS:python-pillow-debuginfo-0:5.1.1-12.el8_2.x86_64",
"AppStream-8.2.0.Z.MAIN.EUS:python-pillow-debugsource-0:5.1.1-12.el8_2.aarch64",
"AppStream-8.2.0.Z.MAIN.EUS:python-pillow-debugsource-0:5.1.1-12.el8_2.ppc64le",
"AppStream-8.2.0.Z.MAIN.EUS:python-pillow-debugsource-0:5.1.1-12.el8_2.s390x",
"AppStream-8.2.0.Z.MAIN.EUS:python-pillow-debugsource-0:5.1.1-12.el8_2.x86_64",
"AppStream-8.2.0.Z.MAIN.EUS:python3-pillow-0:5.1.1-12.el8_2.aarch64",
"AppStream-8.2.0.Z.MAIN.EUS:python3-pillow-0:5.1.1-12.el8_2.ppc64le",
"AppStream-8.2.0.Z.MAIN.EUS:python3-pillow-0:5.1.1-12.el8_2.s390x",
"AppStream-8.2.0.Z.MAIN.EUS:python3-pillow-0:5.1.1-12.el8_2.x86_64",
"AppStream-8.2.0.Z.MAIN.EUS:python3-pillow-debuginfo-0:5.1.1-12.el8_2.aarch64",
"AppStream-8.2.0.Z.MAIN.EUS:python3-pillow-debuginfo-0:5.1.1-12.el8_2.ppc64le",
"AppStream-8.2.0.Z.MAIN.EUS:python3-pillow-debuginfo-0:5.1.1-12.el8_2.s390x",
"AppStream-8.2.0.Z.MAIN.EUS:python3-pillow-debuginfo-0:5.1.1-12.el8_2.x86_64",
"AppStream-8.2.0.Z.MAIN.EUS:python3-pillow-tk-debuginfo-0:5.1.1-12.el8_2.aarch64",
"AppStream-8.2.0.Z.MAIN.EUS:python3-pillow-tk-debuginfo-0:5.1.1-12.el8_2.ppc64le",
"AppStream-8.2.0.Z.MAIN.EUS:python3-pillow-tk-debuginfo-0:5.1.1-12.el8_2.s390x",
"AppStream-8.2.0.Z.MAIN.EUS:python3-pillow-tk-debuginfo-0:5.1.1-12.el8_2.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "python-pillow: out-of-bounds reads/writes in the parsing of SGI image files in expandrow/expandrow2"
}
]
}
RHSA-2020:3299
Vulnerability from csaf_redhat - Published: 2020-08-04 07:40 - Updated: 2026-03-26 12:01An out-of-bounds read/write flaw was found in python-pillow, in the way SGI RLE images are decoded. An application that uses python-pillow to decode untrusted images may be vulnerable. This flaw allows an attacker to crash the application or potentially execute code on the system. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: AppStream-8.1.0.Z.EUS:python-pillow-0:5.1.1-11.el8_1.src | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-8.1.0.Z.EUS:python-pillow-debuginfo-0:5.1.1-11.el8_1.aarch64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-8.1.0.Z.EUS:python-pillow-debuginfo-0:5.1.1-11.el8_1.ppc64le | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-8.1.0.Z.EUS:python-pillow-debuginfo-0:5.1.1-11.el8_1.s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-8.1.0.Z.EUS:python-pillow-debuginfo-0:5.1.1-11.el8_1.x86_64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-8.1.0.Z.EUS:python-pillow-debugsource-0:5.1.1-11.el8_1.aarch64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-8.1.0.Z.EUS:python-pillow-debugsource-0:5.1.1-11.el8_1.ppc64le | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-8.1.0.Z.EUS:python-pillow-debugsource-0:5.1.1-11.el8_1.s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-8.1.0.Z.EUS:python-pillow-debugsource-0:5.1.1-11.el8_1.x86_64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-8.1.0.Z.EUS:python3-pillow-0:5.1.1-11.el8_1.aarch64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-8.1.0.Z.EUS:python3-pillow-0:5.1.1-11.el8_1.ppc64le | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-8.1.0.Z.EUS:python3-pillow-0:5.1.1-11.el8_1.s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-8.1.0.Z.EUS:python3-pillow-0:5.1.1-11.el8_1.x86_64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-8.1.0.Z.EUS:python3-pillow-debuginfo-0:5.1.1-11.el8_1.aarch64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-8.1.0.Z.EUS:python3-pillow-debuginfo-0:5.1.1-11.el8_1.ppc64le | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-8.1.0.Z.EUS:python3-pillow-debuginfo-0:5.1.1-11.el8_1.s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-8.1.0.Z.EUS:python3-pillow-debuginfo-0:5.1.1-11.el8_1.x86_64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-8.1.0.Z.EUS:python3-pillow-tk-debuginfo-0:5.1.1-11.el8_1.aarch64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-8.1.0.Z.EUS:python3-pillow-tk-debuginfo-0:5.1.1-11.el8_1.ppc64le | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-8.1.0.Z.EUS:python3-pillow-tk-debuginfo-0:5.1.1-11.el8_1.s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-8.1.0.Z.EUS:python3-pillow-tk-debuginfo-0:5.1.1-11.el8_1.x86_64 | — |
Vendor Fix
fix
|
{
"document": {
"aggregate_severity": {
"namespace": "https://access.redhat.com/security/updates/classification/",
"text": "Important"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "An update for python-pillow is now available for Red Hat Enterprise Linux 8.1 Extended Update Support.\n\nRed Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.",
"title": "Topic"
},
{
"category": "general",
"text": "The python-pillow packages contain a Python image processing library that provides extensive file format support, an efficient internal representation, and powerful image-processing capabilities.\n\nSecurity Fix(es):\n\n* python-pillow: out-of-bounds reads/writes in the parsing of SGI image files in expandrow/expandrow2 (CVE-2020-11538)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.",
"title": "Details"
},
{
"category": "legal_disclaimer",
"text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
"title": "Terms of Use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://access.redhat.com/security/team/contact/",
"issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
"name": "Red Hat Product Security",
"namespace": "https://www.redhat.com"
},
"references": [
{
"category": "self",
"summary": "https://access.redhat.com/errata/RHSA-2020:3299",
"url": "https://access.redhat.com/errata/RHSA-2020:3299"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/updates/classification/#important",
"url": "https://access.redhat.com/security/updates/classification/#important"
},
{
"category": "external",
"summary": "1852814",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1852814"
},
{
"category": "self",
"summary": "Canonical URL",
"url": "https://security.access.redhat.com/data/csaf/v2/advisories/2020/rhsa-2020_3299.json"
}
],
"title": "Red Hat Security Advisory: python-pillow security update",
"tracking": {
"current_release_date": "2026-03-26T12:01:13+00:00",
"generator": {
"date": "2026-03-26T12:01:13+00:00",
"engine": {
"name": "Red Hat SDEngine",
"version": "4.7.4"
}
},
"id": "RHSA-2020:3299",
"initial_release_date": "2020-08-04T07:40:10+00:00",
"revision_history": [
{
"date": "2020-08-04T07:40:10+00:00",
"number": "1",
"summary": "Initial version"
},
{
"date": "2020-08-04T07:40:10+00:00",
"number": "2",
"summary": "Last updated version"
},
{
"date": "2026-03-26T12:01:13+00:00",
"number": "3",
"summary": "Last generated version"
}
],
"status": "final",
"version": "3"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_name",
"name": "Red Hat Enterprise Linux AppStream EUS (v. 8.1)",
"product": {
"name": "Red Hat Enterprise Linux AppStream EUS (v. 8.1)",
"product_id": "AppStream-8.1.0.Z.EUS",
"product_identification_helper": {
"cpe": "cpe:/a:redhat:rhel_eus:8.1::appstream"
}
}
}
],
"category": "product_family",
"name": "Red Hat Enterprise Linux"
},
{
"branches": [
{
"category": "product_version",
"name": "python-pillow-0:5.1.1-11.el8_1.src",
"product": {
"name": "python-pillow-0:5.1.1-11.el8_1.src",
"product_id": "python-pillow-0:5.1.1-11.el8_1.src",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/python-pillow@5.1.1-11.el8_1?arch=src"
}
}
}
],
"category": "architecture",
"name": "src"
},
{
"branches": [
{
"category": "product_version",
"name": "python3-pillow-0:5.1.1-11.el8_1.ppc64le",
"product": {
"name": "python3-pillow-0:5.1.1-11.el8_1.ppc64le",
"product_id": "python3-pillow-0:5.1.1-11.el8_1.ppc64le",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/python3-pillow@5.1.1-11.el8_1?arch=ppc64le"
}
}
},
{
"category": "product_version",
"name": "python-pillow-debugsource-0:5.1.1-11.el8_1.ppc64le",
"product": {
"name": "python-pillow-debugsource-0:5.1.1-11.el8_1.ppc64le",
"product_id": "python-pillow-debugsource-0:5.1.1-11.el8_1.ppc64le",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/python-pillow-debugsource@5.1.1-11.el8_1?arch=ppc64le"
}
}
},
{
"category": "product_version",
"name": "python-pillow-debuginfo-0:5.1.1-11.el8_1.ppc64le",
"product": {
"name": "python-pillow-debuginfo-0:5.1.1-11.el8_1.ppc64le",
"product_id": "python-pillow-debuginfo-0:5.1.1-11.el8_1.ppc64le",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/python-pillow-debuginfo@5.1.1-11.el8_1?arch=ppc64le"
}
}
},
{
"category": "product_version",
"name": "python3-pillow-debuginfo-0:5.1.1-11.el8_1.ppc64le",
"product": {
"name": "python3-pillow-debuginfo-0:5.1.1-11.el8_1.ppc64le",
"product_id": "python3-pillow-debuginfo-0:5.1.1-11.el8_1.ppc64le",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/python3-pillow-debuginfo@5.1.1-11.el8_1?arch=ppc64le"
}
}
},
{
"category": "product_version",
"name": "python3-pillow-tk-debuginfo-0:5.1.1-11.el8_1.ppc64le",
"product": {
"name": "python3-pillow-tk-debuginfo-0:5.1.1-11.el8_1.ppc64le",
"product_id": "python3-pillow-tk-debuginfo-0:5.1.1-11.el8_1.ppc64le",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/python3-pillow-tk-debuginfo@5.1.1-11.el8_1?arch=ppc64le"
}
}
}
],
"category": "architecture",
"name": "ppc64le"
},
{
"branches": [
{
"category": "product_version",
"name": "python3-pillow-0:5.1.1-11.el8_1.s390x",
"product": {
"name": "python3-pillow-0:5.1.1-11.el8_1.s390x",
"product_id": "python3-pillow-0:5.1.1-11.el8_1.s390x",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/python3-pillow@5.1.1-11.el8_1?arch=s390x"
}
}
},
{
"category": "product_version",
"name": "python-pillow-debugsource-0:5.1.1-11.el8_1.s390x",
"product": {
"name": "python-pillow-debugsource-0:5.1.1-11.el8_1.s390x",
"product_id": "python-pillow-debugsource-0:5.1.1-11.el8_1.s390x",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/python-pillow-debugsource@5.1.1-11.el8_1?arch=s390x"
}
}
},
{
"category": "product_version",
"name": "python-pillow-debuginfo-0:5.1.1-11.el8_1.s390x",
"product": {
"name": "python-pillow-debuginfo-0:5.1.1-11.el8_1.s390x",
"product_id": "python-pillow-debuginfo-0:5.1.1-11.el8_1.s390x",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/python-pillow-debuginfo@5.1.1-11.el8_1?arch=s390x"
}
}
},
{
"category": "product_version",
"name": "python3-pillow-debuginfo-0:5.1.1-11.el8_1.s390x",
"product": {
"name": "python3-pillow-debuginfo-0:5.1.1-11.el8_1.s390x",
"product_id": "python3-pillow-debuginfo-0:5.1.1-11.el8_1.s390x",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/python3-pillow-debuginfo@5.1.1-11.el8_1?arch=s390x"
}
}
},
{
"category": "product_version",
"name": "python3-pillow-tk-debuginfo-0:5.1.1-11.el8_1.s390x",
"product": {
"name": "python3-pillow-tk-debuginfo-0:5.1.1-11.el8_1.s390x",
"product_id": "python3-pillow-tk-debuginfo-0:5.1.1-11.el8_1.s390x",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/python3-pillow-tk-debuginfo@5.1.1-11.el8_1?arch=s390x"
}
}
}
],
"category": "architecture",
"name": "s390x"
},
{
"branches": [
{
"category": "product_version",
"name": "python3-pillow-0:5.1.1-11.el8_1.x86_64",
"product": {
"name": "python3-pillow-0:5.1.1-11.el8_1.x86_64",
"product_id": "python3-pillow-0:5.1.1-11.el8_1.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/python3-pillow@5.1.1-11.el8_1?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "python-pillow-debugsource-0:5.1.1-11.el8_1.x86_64",
"product": {
"name": "python-pillow-debugsource-0:5.1.1-11.el8_1.x86_64",
"product_id": "python-pillow-debugsource-0:5.1.1-11.el8_1.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/python-pillow-debugsource@5.1.1-11.el8_1?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "python-pillow-debuginfo-0:5.1.1-11.el8_1.x86_64",
"product": {
"name": "python-pillow-debuginfo-0:5.1.1-11.el8_1.x86_64",
"product_id": "python-pillow-debuginfo-0:5.1.1-11.el8_1.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/python-pillow-debuginfo@5.1.1-11.el8_1?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "python3-pillow-debuginfo-0:5.1.1-11.el8_1.x86_64",
"product": {
"name": "python3-pillow-debuginfo-0:5.1.1-11.el8_1.x86_64",
"product_id": "python3-pillow-debuginfo-0:5.1.1-11.el8_1.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/python3-pillow-debuginfo@5.1.1-11.el8_1?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "python3-pillow-tk-debuginfo-0:5.1.1-11.el8_1.x86_64",
"product": {
"name": "python3-pillow-tk-debuginfo-0:5.1.1-11.el8_1.x86_64",
"product_id": "python3-pillow-tk-debuginfo-0:5.1.1-11.el8_1.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/python3-pillow-tk-debuginfo@5.1.1-11.el8_1?arch=x86_64"
}
}
}
],
"category": "architecture",
"name": "x86_64"
},
{
"branches": [
{
"category": "product_version",
"name": "python3-pillow-0:5.1.1-11.el8_1.aarch64",
"product": {
"name": "python3-pillow-0:5.1.1-11.el8_1.aarch64",
"product_id": "python3-pillow-0:5.1.1-11.el8_1.aarch64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/python3-pillow@5.1.1-11.el8_1?arch=aarch64"
}
}
},
{
"category": "product_version",
"name": "python-pillow-debugsource-0:5.1.1-11.el8_1.aarch64",
"product": {
"name": "python-pillow-debugsource-0:5.1.1-11.el8_1.aarch64",
"product_id": "python-pillow-debugsource-0:5.1.1-11.el8_1.aarch64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/python-pillow-debugsource@5.1.1-11.el8_1?arch=aarch64"
}
}
},
{
"category": "product_version",
"name": "python-pillow-debuginfo-0:5.1.1-11.el8_1.aarch64",
"product": {
"name": "python-pillow-debuginfo-0:5.1.1-11.el8_1.aarch64",
"product_id": "python-pillow-debuginfo-0:5.1.1-11.el8_1.aarch64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/python-pillow-debuginfo@5.1.1-11.el8_1?arch=aarch64"
}
}
},
{
"category": "product_version",
"name": "python3-pillow-debuginfo-0:5.1.1-11.el8_1.aarch64",
"product": {
"name": "python3-pillow-debuginfo-0:5.1.1-11.el8_1.aarch64",
"product_id": "python3-pillow-debuginfo-0:5.1.1-11.el8_1.aarch64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/python3-pillow-debuginfo@5.1.1-11.el8_1?arch=aarch64"
}
}
},
{
"category": "product_version",
"name": "python3-pillow-tk-debuginfo-0:5.1.1-11.el8_1.aarch64",
"product": {
"name": "python3-pillow-tk-debuginfo-0:5.1.1-11.el8_1.aarch64",
"product_id": "python3-pillow-tk-debuginfo-0:5.1.1-11.el8_1.aarch64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/python3-pillow-tk-debuginfo@5.1.1-11.el8_1?arch=aarch64"
}
}
}
],
"category": "architecture",
"name": "aarch64"
}
],
"category": "vendor",
"name": "Red Hat"
}
],
"relationships": [
{
"category": "default_component_of",
"full_product_name": {
"name": "python-pillow-0:5.1.1-11.el8_1.src as a component of Red Hat Enterprise Linux AppStream EUS (v. 8.1)",
"product_id": "AppStream-8.1.0.Z.EUS:python-pillow-0:5.1.1-11.el8_1.src"
},
"product_reference": "python-pillow-0:5.1.1-11.el8_1.src",
"relates_to_product_reference": "AppStream-8.1.0.Z.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "python-pillow-debuginfo-0:5.1.1-11.el8_1.aarch64 as a component of Red Hat Enterprise Linux AppStream EUS (v. 8.1)",
"product_id": "AppStream-8.1.0.Z.EUS:python-pillow-debuginfo-0:5.1.1-11.el8_1.aarch64"
},
"product_reference": "python-pillow-debuginfo-0:5.1.1-11.el8_1.aarch64",
"relates_to_product_reference": "AppStream-8.1.0.Z.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "python-pillow-debuginfo-0:5.1.1-11.el8_1.ppc64le as a component of Red Hat Enterprise Linux AppStream EUS (v. 8.1)",
"product_id": "AppStream-8.1.0.Z.EUS:python-pillow-debuginfo-0:5.1.1-11.el8_1.ppc64le"
},
"product_reference": "python-pillow-debuginfo-0:5.1.1-11.el8_1.ppc64le",
"relates_to_product_reference": "AppStream-8.1.0.Z.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "python-pillow-debuginfo-0:5.1.1-11.el8_1.s390x as a component of Red Hat Enterprise Linux AppStream EUS (v. 8.1)",
"product_id": "AppStream-8.1.0.Z.EUS:python-pillow-debuginfo-0:5.1.1-11.el8_1.s390x"
},
"product_reference": "python-pillow-debuginfo-0:5.1.1-11.el8_1.s390x",
"relates_to_product_reference": "AppStream-8.1.0.Z.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "python-pillow-debuginfo-0:5.1.1-11.el8_1.x86_64 as a component of Red Hat Enterprise Linux AppStream EUS (v. 8.1)",
"product_id": "AppStream-8.1.0.Z.EUS:python-pillow-debuginfo-0:5.1.1-11.el8_1.x86_64"
},
"product_reference": "python-pillow-debuginfo-0:5.1.1-11.el8_1.x86_64",
"relates_to_product_reference": "AppStream-8.1.0.Z.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "python-pillow-debugsource-0:5.1.1-11.el8_1.aarch64 as a component of Red Hat Enterprise Linux AppStream EUS (v. 8.1)",
"product_id": "AppStream-8.1.0.Z.EUS:python-pillow-debugsource-0:5.1.1-11.el8_1.aarch64"
},
"product_reference": "python-pillow-debugsource-0:5.1.1-11.el8_1.aarch64",
"relates_to_product_reference": "AppStream-8.1.0.Z.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "python-pillow-debugsource-0:5.1.1-11.el8_1.ppc64le as a component of Red Hat Enterprise Linux AppStream EUS (v. 8.1)",
"product_id": "AppStream-8.1.0.Z.EUS:python-pillow-debugsource-0:5.1.1-11.el8_1.ppc64le"
},
"product_reference": "python-pillow-debugsource-0:5.1.1-11.el8_1.ppc64le",
"relates_to_product_reference": "AppStream-8.1.0.Z.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "python-pillow-debugsource-0:5.1.1-11.el8_1.s390x as a component of Red Hat Enterprise Linux AppStream EUS (v. 8.1)",
"product_id": "AppStream-8.1.0.Z.EUS:python-pillow-debugsource-0:5.1.1-11.el8_1.s390x"
},
"product_reference": "python-pillow-debugsource-0:5.1.1-11.el8_1.s390x",
"relates_to_product_reference": "AppStream-8.1.0.Z.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "python-pillow-debugsource-0:5.1.1-11.el8_1.x86_64 as a component of Red Hat Enterprise Linux AppStream EUS (v. 8.1)",
"product_id": "AppStream-8.1.0.Z.EUS:python-pillow-debugsource-0:5.1.1-11.el8_1.x86_64"
},
"product_reference": "python-pillow-debugsource-0:5.1.1-11.el8_1.x86_64",
"relates_to_product_reference": "AppStream-8.1.0.Z.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "python3-pillow-0:5.1.1-11.el8_1.aarch64 as a component of Red Hat Enterprise Linux AppStream EUS (v. 8.1)",
"product_id": "AppStream-8.1.0.Z.EUS:python3-pillow-0:5.1.1-11.el8_1.aarch64"
},
"product_reference": "python3-pillow-0:5.1.1-11.el8_1.aarch64",
"relates_to_product_reference": "AppStream-8.1.0.Z.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "python3-pillow-0:5.1.1-11.el8_1.ppc64le as a component of Red Hat Enterprise Linux AppStream EUS (v. 8.1)",
"product_id": "AppStream-8.1.0.Z.EUS:python3-pillow-0:5.1.1-11.el8_1.ppc64le"
},
"product_reference": "python3-pillow-0:5.1.1-11.el8_1.ppc64le",
"relates_to_product_reference": "AppStream-8.1.0.Z.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "python3-pillow-0:5.1.1-11.el8_1.s390x as a component of Red Hat Enterprise Linux AppStream EUS (v. 8.1)",
"product_id": "AppStream-8.1.0.Z.EUS:python3-pillow-0:5.1.1-11.el8_1.s390x"
},
"product_reference": "python3-pillow-0:5.1.1-11.el8_1.s390x",
"relates_to_product_reference": "AppStream-8.1.0.Z.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "python3-pillow-0:5.1.1-11.el8_1.x86_64 as a component of Red Hat Enterprise Linux AppStream EUS (v. 8.1)",
"product_id": "AppStream-8.1.0.Z.EUS:python3-pillow-0:5.1.1-11.el8_1.x86_64"
},
"product_reference": "python3-pillow-0:5.1.1-11.el8_1.x86_64",
"relates_to_product_reference": "AppStream-8.1.0.Z.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "python3-pillow-debuginfo-0:5.1.1-11.el8_1.aarch64 as a component of Red Hat Enterprise Linux AppStream EUS (v. 8.1)",
"product_id": "AppStream-8.1.0.Z.EUS:python3-pillow-debuginfo-0:5.1.1-11.el8_1.aarch64"
},
"product_reference": "python3-pillow-debuginfo-0:5.1.1-11.el8_1.aarch64",
"relates_to_product_reference": "AppStream-8.1.0.Z.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "python3-pillow-debuginfo-0:5.1.1-11.el8_1.ppc64le as a component of Red Hat Enterprise Linux AppStream EUS (v. 8.1)",
"product_id": "AppStream-8.1.0.Z.EUS:python3-pillow-debuginfo-0:5.1.1-11.el8_1.ppc64le"
},
"product_reference": "python3-pillow-debuginfo-0:5.1.1-11.el8_1.ppc64le",
"relates_to_product_reference": "AppStream-8.1.0.Z.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "python3-pillow-debuginfo-0:5.1.1-11.el8_1.s390x as a component of Red Hat Enterprise Linux AppStream EUS (v. 8.1)",
"product_id": "AppStream-8.1.0.Z.EUS:python3-pillow-debuginfo-0:5.1.1-11.el8_1.s390x"
},
"product_reference": "python3-pillow-debuginfo-0:5.1.1-11.el8_1.s390x",
"relates_to_product_reference": "AppStream-8.1.0.Z.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "python3-pillow-debuginfo-0:5.1.1-11.el8_1.x86_64 as a component of Red Hat Enterprise Linux AppStream EUS (v. 8.1)",
"product_id": "AppStream-8.1.0.Z.EUS:python3-pillow-debuginfo-0:5.1.1-11.el8_1.x86_64"
},
"product_reference": "python3-pillow-debuginfo-0:5.1.1-11.el8_1.x86_64",
"relates_to_product_reference": "AppStream-8.1.0.Z.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "python3-pillow-tk-debuginfo-0:5.1.1-11.el8_1.aarch64 as a component of Red Hat Enterprise Linux AppStream EUS (v. 8.1)",
"product_id": "AppStream-8.1.0.Z.EUS:python3-pillow-tk-debuginfo-0:5.1.1-11.el8_1.aarch64"
},
"product_reference": "python3-pillow-tk-debuginfo-0:5.1.1-11.el8_1.aarch64",
"relates_to_product_reference": "AppStream-8.1.0.Z.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "python3-pillow-tk-debuginfo-0:5.1.1-11.el8_1.ppc64le as a component of Red Hat Enterprise Linux AppStream EUS (v. 8.1)",
"product_id": "AppStream-8.1.0.Z.EUS:python3-pillow-tk-debuginfo-0:5.1.1-11.el8_1.ppc64le"
},
"product_reference": "python3-pillow-tk-debuginfo-0:5.1.1-11.el8_1.ppc64le",
"relates_to_product_reference": "AppStream-8.1.0.Z.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "python3-pillow-tk-debuginfo-0:5.1.1-11.el8_1.s390x as a component of Red Hat Enterprise Linux AppStream EUS (v. 8.1)",
"product_id": "AppStream-8.1.0.Z.EUS:python3-pillow-tk-debuginfo-0:5.1.1-11.el8_1.s390x"
},
"product_reference": "python3-pillow-tk-debuginfo-0:5.1.1-11.el8_1.s390x",
"relates_to_product_reference": "AppStream-8.1.0.Z.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "python3-pillow-tk-debuginfo-0:5.1.1-11.el8_1.x86_64 as a component of Red Hat Enterprise Linux AppStream EUS (v. 8.1)",
"product_id": "AppStream-8.1.0.Z.EUS:python3-pillow-tk-debuginfo-0:5.1.1-11.el8_1.x86_64"
},
"product_reference": "python3-pillow-tk-debuginfo-0:5.1.1-11.el8_1.x86_64",
"relates_to_product_reference": "AppStream-8.1.0.Z.EUS"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2020-11538",
"cwe": {
"id": "CWE-122",
"name": "Heap-based Buffer Overflow"
},
"discovery_date": "2020-07-01T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1852814"
}
],
"notes": [
{
"category": "description",
"text": "An out-of-bounds read/write flaw was found in python-pillow, in the way SGI RLE images are decoded. An application that uses python-pillow to decode untrusted images may be vulnerable. This flaw allows an attacker to crash the application or potentially execute code on the system. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "python-pillow: out-of-bounds reads/writes in the parsing of SGI image files in expandrow/expandrow2",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This issue did not affect the versions of python-pillow and python-imaging as shipped with Red Hat Enterprise Linux 5, 6, and 7 as they did not include the SGI RLE image decoder, where the flaw lies.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"AppStream-8.1.0.Z.EUS:python-pillow-0:5.1.1-11.el8_1.src",
"AppStream-8.1.0.Z.EUS:python-pillow-debuginfo-0:5.1.1-11.el8_1.aarch64",
"AppStream-8.1.0.Z.EUS:python-pillow-debuginfo-0:5.1.1-11.el8_1.ppc64le",
"AppStream-8.1.0.Z.EUS:python-pillow-debuginfo-0:5.1.1-11.el8_1.s390x",
"AppStream-8.1.0.Z.EUS:python-pillow-debuginfo-0:5.1.1-11.el8_1.x86_64",
"AppStream-8.1.0.Z.EUS:python-pillow-debugsource-0:5.1.1-11.el8_1.aarch64",
"AppStream-8.1.0.Z.EUS:python-pillow-debugsource-0:5.1.1-11.el8_1.ppc64le",
"AppStream-8.1.0.Z.EUS:python-pillow-debugsource-0:5.1.1-11.el8_1.s390x",
"AppStream-8.1.0.Z.EUS:python-pillow-debugsource-0:5.1.1-11.el8_1.x86_64",
"AppStream-8.1.0.Z.EUS:python3-pillow-0:5.1.1-11.el8_1.aarch64",
"AppStream-8.1.0.Z.EUS:python3-pillow-0:5.1.1-11.el8_1.ppc64le",
"AppStream-8.1.0.Z.EUS:python3-pillow-0:5.1.1-11.el8_1.s390x",
"AppStream-8.1.0.Z.EUS:python3-pillow-0:5.1.1-11.el8_1.x86_64",
"AppStream-8.1.0.Z.EUS:python3-pillow-debuginfo-0:5.1.1-11.el8_1.aarch64",
"AppStream-8.1.0.Z.EUS:python3-pillow-debuginfo-0:5.1.1-11.el8_1.ppc64le",
"AppStream-8.1.0.Z.EUS:python3-pillow-debuginfo-0:5.1.1-11.el8_1.s390x",
"AppStream-8.1.0.Z.EUS:python3-pillow-debuginfo-0:5.1.1-11.el8_1.x86_64",
"AppStream-8.1.0.Z.EUS:python3-pillow-tk-debuginfo-0:5.1.1-11.el8_1.aarch64",
"AppStream-8.1.0.Z.EUS:python3-pillow-tk-debuginfo-0:5.1.1-11.el8_1.ppc64le",
"AppStream-8.1.0.Z.EUS:python3-pillow-tk-debuginfo-0:5.1.1-11.el8_1.s390x",
"AppStream-8.1.0.Z.EUS:python3-pillow-tk-debuginfo-0:5.1.1-11.el8_1.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2020-11538"
},
{
"category": "external",
"summary": "RHBZ#1852814",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1852814"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2020-11538",
"url": "https://www.cve.org/CVERecord?id=CVE-2020-11538"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2020-11538",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2020-11538"
}
],
"release_date": "2020-07-01T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2020-08-04T07:40:10+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"AppStream-8.1.0.Z.EUS:python-pillow-0:5.1.1-11.el8_1.src",
"AppStream-8.1.0.Z.EUS:python-pillow-debuginfo-0:5.1.1-11.el8_1.aarch64",
"AppStream-8.1.0.Z.EUS:python-pillow-debuginfo-0:5.1.1-11.el8_1.ppc64le",
"AppStream-8.1.0.Z.EUS:python-pillow-debuginfo-0:5.1.1-11.el8_1.s390x",
"AppStream-8.1.0.Z.EUS:python-pillow-debuginfo-0:5.1.1-11.el8_1.x86_64",
"AppStream-8.1.0.Z.EUS:python-pillow-debugsource-0:5.1.1-11.el8_1.aarch64",
"AppStream-8.1.0.Z.EUS:python-pillow-debugsource-0:5.1.1-11.el8_1.ppc64le",
"AppStream-8.1.0.Z.EUS:python-pillow-debugsource-0:5.1.1-11.el8_1.s390x",
"AppStream-8.1.0.Z.EUS:python-pillow-debugsource-0:5.1.1-11.el8_1.x86_64",
"AppStream-8.1.0.Z.EUS:python3-pillow-0:5.1.1-11.el8_1.aarch64",
"AppStream-8.1.0.Z.EUS:python3-pillow-0:5.1.1-11.el8_1.ppc64le",
"AppStream-8.1.0.Z.EUS:python3-pillow-0:5.1.1-11.el8_1.s390x",
"AppStream-8.1.0.Z.EUS:python3-pillow-0:5.1.1-11.el8_1.x86_64",
"AppStream-8.1.0.Z.EUS:python3-pillow-debuginfo-0:5.1.1-11.el8_1.aarch64",
"AppStream-8.1.0.Z.EUS:python3-pillow-debuginfo-0:5.1.1-11.el8_1.ppc64le",
"AppStream-8.1.0.Z.EUS:python3-pillow-debuginfo-0:5.1.1-11.el8_1.s390x",
"AppStream-8.1.0.Z.EUS:python3-pillow-debuginfo-0:5.1.1-11.el8_1.x86_64",
"AppStream-8.1.0.Z.EUS:python3-pillow-tk-debuginfo-0:5.1.1-11.el8_1.aarch64",
"AppStream-8.1.0.Z.EUS:python3-pillow-tk-debuginfo-0:5.1.1-11.el8_1.ppc64le",
"AppStream-8.1.0.Z.EUS:python3-pillow-tk-debuginfo-0:5.1.1-11.el8_1.s390x",
"AppStream-8.1.0.Z.EUS:python3-pillow-tk-debuginfo-0:5.1.1-11.el8_1.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2020:3299"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.1,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"AppStream-8.1.0.Z.EUS:python-pillow-0:5.1.1-11.el8_1.src",
"AppStream-8.1.0.Z.EUS:python-pillow-debuginfo-0:5.1.1-11.el8_1.aarch64",
"AppStream-8.1.0.Z.EUS:python-pillow-debuginfo-0:5.1.1-11.el8_1.ppc64le",
"AppStream-8.1.0.Z.EUS:python-pillow-debuginfo-0:5.1.1-11.el8_1.s390x",
"AppStream-8.1.0.Z.EUS:python-pillow-debuginfo-0:5.1.1-11.el8_1.x86_64",
"AppStream-8.1.0.Z.EUS:python-pillow-debugsource-0:5.1.1-11.el8_1.aarch64",
"AppStream-8.1.0.Z.EUS:python-pillow-debugsource-0:5.1.1-11.el8_1.ppc64le",
"AppStream-8.1.0.Z.EUS:python-pillow-debugsource-0:5.1.1-11.el8_1.s390x",
"AppStream-8.1.0.Z.EUS:python-pillow-debugsource-0:5.1.1-11.el8_1.x86_64",
"AppStream-8.1.0.Z.EUS:python3-pillow-0:5.1.1-11.el8_1.aarch64",
"AppStream-8.1.0.Z.EUS:python3-pillow-0:5.1.1-11.el8_1.ppc64le",
"AppStream-8.1.0.Z.EUS:python3-pillow-0:5.1.1-11.el8_1.s390x",
"AppStream-8.1.0.Z.EUS:python3-pillow-0:5.1.1-11.el8_1.x86_64",
"AppStream-8.1.0.Z.EUS:python3-pillow-debuginfo-0:5.1.1-11.el8_1.aarch64",
"AppStream-8.1.0.Z.EUS:python3-pillow-debuginfo-0:5.1.1-11.el8_1.ppc64le",
"AppStream-8.1.0.Z.EUS:python3-pillow-debuginfo-0:5.1.1-11.el8_1.s390x",
"AppStream-8.1.0.Z.EUS:python3-pillow-debuginfo-0:5.1.1-11.el8_1.x86_64",
"AppStream-8.1.0.Z.EUS:python3-pillow-tk-debuginfo-0:5.1.1-11.el8_1.aarch64",
"AppStream-8.1.0.Z.EUS:python3-pillow-tk-debuginfo-0:5.1.1-11.el8_1.ppc64le",
"AppStream-8.1.0.Z.EUS:python3-pillow-tk-debuginfo-0:5.1.1-11.el8_1.s390x",
"AppStream-8.1.0.Z.EUS:python3-pillow-tk-debuginfo-0:5.1.1-11.el8_1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "python-pillow: out-of-bounds reads/writes in the parsing of SGI image files in expandrow/expandrow2"
}
]
}
RHSA-2020:3302
Vulnerability from csaf_redhat - Published: 2020-08-04 10:29 - Updated: 2026-03-26 12:01An out-of-bounds read/write flaw was found in python-pillow, in the way SGI RLE images are decoded. An application that uses python-pillow to decode untrusted images may be vulnerable. This flaw allows an attacker to crash the application or potentially execute code on the system. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: AppStream-8.0.0.Z.E4S:python-pillow-0:5.1.1-11.el8_0.src | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-8.0.0.Z.E4S:python-pillow-debuginfo-0:5.1.1-11.el8_0.ppc64le | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-8.0.0.Z.E4S:python-pillow-debuginfo-0:5.1.1-11.el8_0.x86_64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-8.0.0.Z.E4S:python-pillow-debugsource-0:5.1.1-11.el8_0.ppc64le | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-8.0.0.Z.E4S:python-pillow-debugsource-0:5.1.1-11.el8_0.x86_64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-8.0.0.Z.E4S:python3-pillow-0:5.1.1-11.el8_0.ppc64le | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-8.0.0.Z.E4S:python3-pillow-0:5.1.1-11.el8_0.x86_64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-8.0.0.Z.E4S:python3-pillow-debuginfo-0:5.1.1-11.el8_0.ppc64le | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-8.0.0.Z.E4S:python3-pillow-debuginfo-0:5.1.1-11.el8_0.x86_64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-8.0.0.Z.E4S:python3-pillow-tk-debuginfo-0:5.1.1-11.el8_0.ppc64le | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-8.0.0.Z.E4S:python3-pillow-tk-debuginfo-0:5.1.1-11.el8_0.x86_64 | — |
Vendor Fix
fix
|
{
"document": {
"aggregate_severity": {
"namespace": "https://access.redhat.com/security/updates/classification/",
"text": "Important"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "An update for python-pillow is now available for Red Hat Enterprise Linux 8.0 Update Services for SAP Solutions.\n\nRed Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.",
"title": "Topic"
},
{
"category": "general",
"text": "The python-pillow packages contain a Python image processing library that provides extensive file format support, an efficient internal representation, and powerful image-processing capabilities.\n\nSecurity Fix(es):\n\n* python-pillow: out-of-bounds reads/writes in the parsing of SGI image files in expandrow/expandrow2 (CVE-2020-11538)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.",
"title": "Details"
},
{
"category": "legal_disclaimer",
"text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
"title": "Terms of Use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://access.redhat.com/security/team/contact/",
"issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
"name": "Red Hat Product Security",
"namespace": "https://www.redhat.com"
},
"references": [
{
"category": "self",
"summary": "https://access.redhat.com/errata/RHSA-2020:3302",
"url": "https://access.redhat.com/errata/RHSA-2020:3302"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/updates/classification/#important",
"url": "https://access.redhat.com/security/updates/classification/#important"
},
{
"category": "external",
"summary": "1852814",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1852814"
},
{
"category": "self",
"summary": "Canonical URL",
"url": "https://security.access.redhat.com/data/csaf/v2/advisories/2020/rhsa-2020_3302.json"
}
],
"title": "Red Hat Security Advisory: python-pillow security update",
"tracking": {
"current_release_date": "2026-03-26T12:01:14+00:00",
"generator": {
"date": "2026-03-26T12:01:14+00:00",
"engine": {
"name": "Red Hat SDEngine",
"version": "4.7.4"
}
},
"id": "RHSA-2020:3302",
"initial_release_date": "2020-08-04T10:29:38+00:00",
"revision_history": [
{
"date": "2020-08-04T10:29:38+00:00",
"number": "1",
"summary": "Initial version"
},
{
"date": "2020-08-04T10:29:38+00:00",
"number": "2",
"summary": "Last updated version"
},
{
"date": "2026-03-26T12:01:14+00:00",
"number": "3",
"summary": "Last generated version"
}
],
"status": "final",
"version": "3"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_name",
"name": "Red Hat Enterprise Linux AppStream E4S (v. 8.0)",
"product": {
"name": "Red Hat Enterprise Linux AppStream E4S (v. 8.0)",
"product_id": "AppStream-8.0.0.Z.E4S",
"product_identification_helper": {
"cpe": "cpe:/a:redhat:rhel_e4s:8.0::appstream"
}
}
}
],
"category": "product_family",
"name": "Red Hat Enterprise Linux"
},
{
"branches": [
{
"category": "product_version",
"name": "python-pillow-0:5.1.1-11.el8_0.src",
"product": {
"name": "python-pillow-0:5.1.1-11.el8_0.src",
"product_id": "python-pillow-0:5.1.1-11.el8_0.src",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/python-pillow@5.1.1-11.el8_0?arch=src"
}
}
}
],
"category": "architecture",
"name": "src"
},
{
"branches": [
{
"category": "product_version",
"name": "python3-pillow-0:5.1.1-11.el8_0.ppc64le",
"product": {
"name": "python3-pillow-0:5.1.1-11.el8_0.ppc64le",
"product_id": "python3-pillow-0:5.1.1-11.el8_0.ppc64le",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/python3-pillow@5.1.1-11.el8_0?arch=ppc64le"
}
}
},
{
"category": "product_version",
"name": "python-pillow-debugsource-0:5.1.1-11.el8_0.ppc64le",
"product": {
"name": "python-pillow-debugsource-0:5.1.1-11.el8_0.ppc64le",
"product_id": "python-pillow-debugsource-0:5.1.1-11.el8_0.ppc64le",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/python-pillow-debugsource@5.1.1-11.el8_0?arch=ppc64le"
}
}
},
{
"category": "product_version",
"name": "python-pillow-debuginfo-0:5.1.1-11.el8_0.ppc64le",
"product": {
"name": "python-pillow-debuginfo-0:5.1.1-11.el8_0.ppc64le",
"product_id": "python-pillow-debuginfo-0:5.1.1-11.el8_0.ppc64le",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/python-pillow-debuginfo@5.1.1-11.el8_0?arch=ppc64le"
}
}
},
{
"category": "product_version",
"name": "python3-pillow-debuginfo-0:5.1.1-11.el8_0.ppc64le",
"product": {
"name": "python3-pillow-debuginfo-0:5.1.1-11.el8_0.ppc64le",
"product_id": "python3-pillow-debuginfo-0:5.1.1-11.el8_0.ppc64le",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/python3-pillow-debuginfo@5.1.1-11.el8_0?arch=ppc64le"
}
}
},
{
"category": "product_version",
"name": "python3-pillow-tk-debuginfo-0:5.1.1-11.el8_0.ppc64le",
"product": {
"name": "python3-pillow-tk-debuginfo-0:5.1.1-11.el8_0.ppc64le",
"product_id": "python3-pillow-tk-debuginfo-0:5.1.1-11.el8_0.ppc64le",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/python3-pillow-tk-debuginfo@5.1.1-11.el8_0?arch=ppc64le"
}
}
}
],
"category": "architecture",
"name": "ppc64le"
},
{
"branches": [
{
"category": "product_version",
"name": "python3-pillow-0:5.1.1-11.el8_0.x86_64",
"product": {
"name": "python3-pillow-0:5.1.1-11.el8_0.x86_64",
"product_id": "python3-pillow-0:5.1.1-11.el8_0.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/python3-pillow@5.1.1-11.el8_0?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "python-pillow-debugsource-0:5.1.1-11.el8_0.x86_64",
"product": {
"name": "python-pillow-debugsource-0:5.1.1-11.el8_0.x86_64",
"product_id": "python-pillow-debugsource-0:5.1.1-11.el8_0.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/python-pillow-debugsource@5.1.1-11.el8_0?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "python-pillow-debuginfo-0:5.1.1-11.el8_0.x86_64",
"product": {
"name": "python-pillow-debuginfo-0:5.1.1-11.el8_0.x86_64",
"product_id": "python-pillow-debuginfo-0:5.1.1-11.el8_0.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/python-pillow-debuginfo@5.1.1-11.el8_0?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "python3-pillow-debuginfo-0:5.1.1-11.el8_0.x86_64",
"product": {
"name": "python3-pillow-debuginfo-0:5.1.1-11.el8_0.x86_64",
"product_id": "python3-pillow-debuginfo-0:5.1.1-11.el8_0.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/python3-pillow-debuginfo@5.1.1-11.el8_0?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "python3-pillow-tk-debuginfo-0:5.1.1-11.el8_0.x86_64",
"product": {
"name": "python3-pillow-tk-debuginfo-0:5.1.1-11.el8_0.x86_64",
"product_id": "python3-pillow-tk-debuginfo-0:5.1.1-11.el8_0.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/python3-pillow-tk-debuginfo@5.1.1-11.el8_0?arch=x86_64"
}
}
}
],
"category": "architecture",
"name": "x86_64"
}
],
"category": "vendor",
"name": "Red Hat"
}
],
"relationships": [
{
"category": "default_component_of",
"full_product_name": {
"name": "python-pillow-0:5.1.1-11.el8_0.src as a component of Red Hat Enterprise Linux AppStream E4S (v. 8.0)",
"product_id": "AppStream-8.0.0.Z.E4S:python-pillow-0:5.1.1-11.el8_0.src"
},
"product_reference": "python-pillow-0:5.1.1-11.el8_0.src",
"relates_to_product_reference": "AppStream-8.0.0.Z.E4S"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "python-pillow-debuginfo-0:5.1.1-11.el8_0.ppc64le as a component of Red Hat Enterprise Linux AppStream E4S (v. 8.0)",
"product_id": "AppStream-8.0.0.Z.E4S:python-pillow-debuginfo-0:5.1.1-11.el8_0.ppc64le"
},
"product_reference": "python-pillow-debuginfo-0:5.1.1-11.el8_0.ppc64le",
"relates_to_product_reference": "AppStream-8.0.0.Z.E4S"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "python-pillow-debuginfo-0:5.1.1-11.el8_0.x86_64 as a component of Red Hat Enterprise Linux AppStream E4S (v. 8.0)",
"product_id": "AppStream-8.0.0.Z.E4S:python-pillow-debuginfo-0:5.1.1-11.el8_0.x86_64"
},
"product_reference": "python-pillow-debuginfo-0:5.1.1-11.el8_0.x86_64",
"relates_to_product_reference": "AppStream-8.0.0.Z.E4S"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "python-pillow-debugsource-0:5.1.1-11.el8_0.ppc64le as a component of Red Hat Enterprise Linux AppStream E4S (v. 8.0)",
"product_id": "AppStream-8.0.0.Z.E4S:python-pillow-debugsource-0:5.1.1-11.el8_0.ppc64le"
},
"product_reference": "python-pillow-debugsource-0:5.1.1-11.el8_0.ppc64le",
"relates_to_product_reference": "AppStream-8.0.0.Z.E4S"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "python-pillow-debugsource-0:5.1.1-11.el8_0.x86_64 as a component of Red Hat Enterprise Linux AppStream E4S (v. 8.0)",
"product_id": "AppStream-8.0.0.Z.E4S:python-pillow-debugsource-0:5.1.1-11.el8_0.x86_64"
},
"product_reference": "python-pillow-debugsource-0:5.1.1-11.el8_0.x86_64",
"relates_to_product_reference": "AppStream-8.0.0.Z.E4S"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "python3-pillow-0:5.1.1-11.el8_0.ppc64le as a component of Red Hat Enterprise Linux AppStream E4S (v. 8.0)",
"product_id": "AppStream-8.0.0.Z.E4S:python3-pillow-0:5.1.1-11.el8_0.ppc64le"
},
"product_reference": "python3-pillow-0:5.1.1-11.el8_0.ppc64le",
"relates_to_product_reference": "AppStream-8.0.0.Z.E4S"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "python3-pillow-0:5.1.1-11.el8_0.x86_64 as a component of Red Hat Enterprise Linux AppStream E4S (v. 8.0)",
"product_id": "AppStream-8.0.0.Z.E4S:python3-pillow-0:5.1.1-11.el8_0.x86_64"
},
"product_reference": "python3-pillow-0:5.1.1-11.el8_0.x86_64",
"relates_to_product_reference": "AppStream-8.0.0.Z.E4S"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "python3-pillow-debuginfo-0:5.1.1-11.el8_0.ppc64le as a component of Red Hat Enterprise Linux AppStream E4S (v. 8.0)",
"product_id": "AppStream-8.0.0.Z.E4S:python3-pillow-debuginfo-0:5.1.1-11.el8_0.ppc64le"
},
"product_reference": "python3-pillow-debuginfo-0:5.1.1-11.el8_0.ppc64le",
"relates_to_product_reference": "AppStream-8.0.0.Z.E4S"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "python3-pillow-debuginfo-0:5.1.1-11.el8_0.x86_64 as a component of Red Hat Enterprise Linux AppStream E4S (v. 8.0)",
"product_id": "AppStream-8.0.0.Z.E4S:python3-pillow-debuginfo-0:5.1.1-11.el8_0.x86_64"
},
"product_reference": "python3-pillow-debuginfo-0:5.1.1-11.el8_0.x86_64",
"relates_to_product_reference": "AppStream-8.0.0.Z.E4S"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "python3-pillow-tk-debuginfo-0:5.1.1-11.el8_0.ppc64le as a component of Red Hat Enterprise Linux AppStream E4S (v. 8.0)",
"product_id": "AppStream-8.0.0.Z.E4S:python3-pillow-tk-debuginfo-0:5.1.1-11.el8_0.ppc64le"
},
"product_reference": "python3-pillow-tk-debuginfo-0:5.1.1-11.el8_0.ppc64le",
"relates_to_product_reference": "AppStream-8.0.0.Z.E4S"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "python3-pillow-tk-debuginfo-0:5.1.1-11.el8_0.x86_64 as a component of Red Hat Enterprise Linux AppStream E4S (v. 8.0)",
"product_id": "AppStream-8.0.0.Z.E4S:python3-pillow-tk-debuginfo-0:5.1.1-11.el8_0.x86_64"
},
"product_reference": "python3-pillow-tk-debuginfo-0:5.1.1-11.el8_0.x86_64",
"relates_to_product_reference": "AppStream-8.0.0.Z.E4S"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2020-11538",
"cwe": {
"id": "CWE-122",
"name": "Heap-based Buffer Overflow"
},
"discovery_date": "2020-07-01T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1852814"
}
],
"notes": [
{
"category": "description",
"text": "An out-of-bounds read/write flaw was found in python-pillow, in the way SGI RLE images are decoded. An application that uses python-pillow to decode untrusted images may be vulnerable. This flaw allows an attacker to crash the application or potentially execute code on the system. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "python-pillow: out-of-bounds reads/writes in the parsing of SGI image files in expandrow/expandrow2",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This issue did not affect the versions of python-pillow and python-imaging as shipped with Red Hat Enterprise Linux 5, 6, and 7 as they did not include the SGI RLE image decoder, where the flaw lies.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"AppStream-8.0.0.Z.E4S:python-pillow-0:5.1.1-11.el8_0.src",
"AppStream-8.0.0.Z.E4S:python-pillow-debuginfo-0:5.1.1-11.el8_0.ppc64le",
"AppStream-8.0.0.Z.E4S:python-pillow-debuginfo-0:5.1.1-11.el8_0.x86_64",
"AppStream-8.0.0.Z.E4S:python-pillow-debugsource-0:5.1.1-11.el8_0.ppc64le",
"AppStream-8.0.0.Z.E4S:python-pillow-debugsource-0:5.1.1-11.el8_0.x86_64",
"AppStream-8.0.0.Z.E4S:python3-pillow-0:5.1.1-11.el8_0.ppc64le",
"AppStream-8.0.0.Z.E4S:python3-pillow-0:5.1.1-11.el8_0.x86_64",
"AppStream-8.0.0.Z.E4S:python3-pillow-debuginfo-0:5.1.1-11.el8_0.ppc64le",
"AppStream-8.0.0.Z.E4S:python3-pillow-debuginfo-0:5.1.1-11.el8_0.x86_64",
"AppStream-8.0.0.Z.E4S:python3-pillow-tk-debuginfo-0:5.1.1-11.el8_0.ppc64le",
"AppStream-8.0.0.Z.E4S:python3-pillow-tk-debuginfo-0:5.1.1-11.el8_0.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2020-11538"
},
{
"category": "external",
"summary": "RHBZ#1852814",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1852814"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2020-11538",
"url": "https://www.cve.org/CVERecord?id=CVE-2020-11538"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2020-11538",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2020-11538"
}
],
"release_date": "2020-07-01T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2020-08-04T10:29:38+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"AppStream-8.0.0.Z.E4S:python-pillow-0:5.1.1-11.el8_0.src",
"AppStream-8.0.0.Z.E4S:python-pillow-debuginfo-0:5.1.1-11.el8_0.ppc64le",
"AppStream-8.0.0.Z.E4S:python-pillow-debuginfo-0:5.1.1-11.el8_0.x86_64",
"AppStream-8.0.0.Z.E4S:python-pillow-debugsource-0:5.1.1-11.el8_0.ppc64le",
"AppStream-8.0.0.Z.E4S:python-pillow-debugsource-0:5.1.1-11.el8_0.x86_64",
"AppStream-8.0.0.Z.E4S:python3-pillow-0:5.1.1-11.el8_0.ppc64le",
"AppStream-8.0.0.Z.E4S:python3-pillow-0:5.1.1-11.el8_0.x86_64",
"AppStream-8.0.0.Z.E4S:python3-pillow-debuginfo-0:5.1.1-11.el8_0.ppc64le",
"AppStream-8.0.0.Z.E4S:python3-pillow-debuginfo-0:5.1.1-11.el8_0.x86_64",
"AppStream-8.0.0.Z.E4S:python3-pillow-tk-debuginfo-0:5.1.1-11.el8_0.ppc64le",
"AppStream-8.0.0.Z.E4S:python3-pillow-tk-debuginfo-0:5.1.1-11.el8_0.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2020:3302"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.1,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"AppStream-8.0.0.Z.E4S:python-pillow-0:5.1.1-11.el8_0.src",
"AppStream-8.0.0.Z.E4S:python-pillow-debuginfo-0:5.1.1-11.el8_0.ppc64le",
"AppStream-8.0.0.Z.E4S:python-pillow-debuginfo-0:5.1.1-11.el8_0.x86_64",
"AppStream-8.0.0.Z.E4S:python-pillow-debugsource-0:5.1.1-11.el8_0.ppc64le",
"AppStream-8.0.0.Z.E4S:python-pillow-debugsource-0:5.1.1-11.el8_0.x86_64",
"AppStream-8.0.0.Z.E4S:python3-pillow-0:5.1.1-11.el8_0.ppc64le",
"AppStream-8.0.0.Z.E4S:python3-pillow-0:5.1.1-11.el8_0.x86_64",
"AppStream-8.0.0.Z.E4S:python3-pillow-debuginfo-0:5.1.1-11.el8_0.ppc64le",
"AppStream-8.0.0.Z.E4S:python3-pillow-debuginfo-0:5.1.1-11.el8_0.x86_64",
"AppStream-8.0.0.Z.E4S:python3-pillow-tk-debuginfo-0:5.1.1-11.el8_0.ppc64le",
"AppStream-8.0.0.Z.E4S:python3-pillow-tk-debuginfo-0:5.1.1-11.el8_0.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "python-pillow: out-of-bounds reads/writes in the parsing of SGI image files in expandrow/expandrow2"
}
]
}
RHSA-2020_3185
Vulnerability from csaf_redhat - Published: 2020-07-28 13:41 - Updated: 2024-11-13 22:14An out-of-bounds read was discovered in python-pillow in the way it decodes FLI images. An application that uses python-pillow to load untrusted images may be vulnerable to this flaw, which can allow an attacker to read the memory of the application they should be not allowed to read.
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: AppStream-8.2.0.Z.MAIN.EUS:python-pillow-0:5.1.1-12.el8_2.src | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-8.2.0.Z.MAIN.EUS:python-pillow-debuginfo-0:5.1.1-12.el8_2.aarch64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-8.2.0.Z.MAIN.EUS:python-pillow-debuginfo-0:5.1.1-12.el8_2.ppc64le | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-8.2.0.Z.MAIN.EUS:python-pillow-debuginfo-0:5.1.1-12.el8_2.s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-8.2.0.Z.MAIN.EUS:python-pillow-debuginfo-0:5.1.1-12.el8_2.x86_64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-8.2.0.Z.MAIN.EUS:python-pillow-debugsource-0:5.1.1-12.el8_2.aarch64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-8.2.0.Z.MAIN.EUS:python-pillow-debugsource-0:5.1.1-12.el8_2.ppc64le | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-8.2.0.Z.MAIN.EUS:python-pillow-debugsource-0:5.1.1-12.el8_2.s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-8.2.0.Z.MAIN.EUS:python-pillow-debugsource-0:5.1.1-12.el8_2.x86_64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-8.2.0.Z.MAIN.EUS:python3-pillow-0:5.1.1-12.el8_2.aarch64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-8.2.0.Z.MAIN.EUS:python3-pillow-0:5.1.1-12.el8_2.ppc64le | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-8.2.0.Z.MAIN.EUS:python3-pillow-0:5.1.1-12.el8_2.s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-8.2.0.Z.MAIN.EUS:python3-pillow-0:5.1.1-12.el8_2.x86_64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-8.2.0.Z.MAIN.EUS:python3-pillow-debuginfo-0:5.1.1-12.el8_2.aarch64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-8.2.0.Z.MAIN.EUS:python3-pillow-debuginfo-0:5.1.1-12.el8_2.ppc64le | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-8.2.0.Z.MAIN.EUS:python3-pillow-debuginfo-0:5.1.1-12.el8_2.s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-8.2.0.Z.MAIN.EUS:python3-pillow-debuginfo-0:5.1.1-12.el8_2.x86_64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-8.2.0.Z.MAIN.EUS:python3-pillow-tk-debuginfo-0:5.1.1-12.el8_2.aarch64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-8.2.0.Z.MAIN.EUS:python3-pillow-tk-debuginfo-0:5.1.1-12.el8_2.ppc64le | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-8.2.0.Z.MAIN.EUS:python3-pillow-tk-debuginfo-0:5.1.1-12.el8_2.s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-8.2.0.Z.MAIN.EUS:python3-pillow-tk-debuginfo-0:5.1.1-12.el8_2.x86_64 | — |
Vendor Fix
fix
|
An out-of-bounds read/write flaw was found in python-pillow, in the way SGI RLE images are decoded. An application that uses python-pillow to decode untrusted images may be vulnerable. This flaw allows an attacker to crash the application or potentially execute code on the system. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: AppStream-8.2.0.Z.MAIN.EUS:python-pillow-0:5.1.1-12.el8_2.src | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-8.2.0.Z.MAIN.EUS:python-pillow-debuginfo-0:5.1.1-12.el8_2.aarch64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-8.2.0.Z.MAIN.EUS:python-pillow-debuginfo-0:5.1.1-12.el8_2.ppc64le | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-8.2.0.Z.MAIN.EUS:python-pillow-debuginfo-0:5.1.1-12.el8_2.s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-8.2.0.Z.MAIN.EUS:python-pillow-debuginfo-0:5.1.1-12.el8_2.x86_64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-8.2.0.Z.MAIN.EUS:python-pillow-debugsource-0:5.1.1-12.el8_2.aarch64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-8.2.0.Z.MAIN.EUS:python-pillow-debugsource-0:5.1.1-12.el8_2.ppc64le | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-8.2.0.Z.MAIN.EUS:python-pillow-debugsource-0:5.1.1-12.el8_2.s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-8.2.0.Z.MAIN.EUS:python-pillow-debugsource-0:5.1.1-12.el8_2.x86_64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-8.2.0.Z.MAIN.EUS:python3-pillow-0:5.1.1-12.el8_2.aarch64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-8.2.0.Z.MAIN.EUS:python3-pillow-0:5.1.1-12.el8_2.ppc64le | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-8.2.0.Z.MAIN.EUS:python3-pillow-0:5.1.1-12.el8_2.s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-8.2.0.Z.MAIN.EUS:python3-pillow-0:5.1.1-12.el8_2.x86_64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-8.2.0.Z.MAIN.EUS:python3-pillow-debuginfo-0:5.1.1-12.el8_2.aarch64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-8.2.0.Z.MAIN.EUS:python3-pillow-debuginfo-0:5.1.1-12.el8_2.ppc64le | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-8.2.0.Z.MAIN.EUS:python3-pillow-debuginfo-0:5.1.1-12.el8_2.s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-8.2.0.Z.MAIN.EUS:python3-pillow-debuginfo-0:5.1.1-12.el8_2.x86_64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-8.2.0.Z.MAIN.EUS:python3-pillow-tk-debuginfo-0:5.1.1-12.el8_2.aarch64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-8.2.0.Z.MAIN.EUS:python3-pillow-tk-debuginfo-0:5.1.1-12.el8_2.ppc64le | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-8.2.0.Z.MAIN.EUS:python3-pillow-tk-debuginfo-0:5.1.1-12.el8_2.s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-8.2.0.Z.MAIN.EUS:python3-pillow-tk-debuginfo-0:5.1.1-12.el8_2.x86_64 | — |
Vendor Fix
fix
|
{
"document": {
"aggregate_severity": {
"namespace": "https://access.redhat.com/security/updates/classification/",
"text": "Important"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "An update for python-pillow is now available for Red Hat Enterprise Linux 8.\n\nRed Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.",
"title": "Topic"
},
{
"category": "general",
"text": "The python-pillow packages contain a Python image processing library that provides extensive file format support, an efficient internal representation, and powerful image-processing capabilities.\n\nSecurity Fix(es):\n\n* python-pillow: out-of-bounds reads/writes in the parsing of SGI image files in expandrow/expandrow2 (CVE-2020-11538)\n\n* python-pillow: out-of-bounds read in ImagingFliDecode when loading FLI images (CVE-2020-5313)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.",
"title": "Details"
},
{
"category": "legal_disclaimer",
"text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
"title": "Terms of Use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://access.redhat.com/security/team/contact/",
"issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
"name": "Red Hat Product Security",
"namespace": "https://www.redhat.com"
},
"references": [
{
"category": "self",
"summary": "https://access.redhat.com/errata/RHSA-2020:3185",
"url": "https://access.redhat.com/errata/RHSA-2020:3185"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/updates/classification/#important",
"url": "https://access.redhat.com/security/updates/classification/#important"
},
{
"category": "external",
"summary": "1789532",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1789532"
},
{
"category": "external",
"summary": "1852814",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1852814"
},
{
"category": "self",
"summary": "Canonical URL",
"url": "https://security.access.redhat.com/data/csaf/v2/advisories/2020/rhsa-2020_3185.json"
}
],
"title": "Red Hat Security Advisory: python-pillow security update",
"tracking": {
"current_release_date": "2024-11-13T22:14:13+00:00",
"generator": {
"date": "2024-11-13T22:14:13+00:00",
"engine": {
"name": "Red Hat SDEngine",
"version": "4.2.0"
}
},
"id": "RHSA-2020:3185",
"initial_release_date": "2020-07-28T13:41:04+00:00",
"revision_history": [
{
"date": "2020-07-28T13:41:04+00:00",
"number": "1",
"summary": "Initial version"
},
{
"date": "2020-07-28T13:41:04+00:00",
"number": "2",
"summary": "Last updated version"
},
{
"date": "2024-11-13T22:14:13+00:00",
"number": "3",
"summary": "Last generated version"
}
],
"status": "final",
"version": "3"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_name",
"name": "Red Hat Enterprise Linux AppStream (v. 8)",
"product": {
"name": "Red Hat Enterprise Linux AppStream (v. 8)",
"product_id": "AppStream-8.2.0.Z.MAIN.EUS",
"product_identification_helper": {
"cpe": "cpe:/a:redhat:enterprise_linux:8::appstream"
}
}
}
],
"category": "product_family",
"name": "Red Hat Enterprise Linux"
},
{
"branches": [
{
"category": "product_version",
"name": "python-pillow-0:5.1.1-12.el8_2.src",
"product": {
"name": "python-pillow-0:5.1.1-12.el8_2.src",
"product_id": "python-pillow-0:5.1.1-12.el8_2.src",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/python-pillow@5.1.1-12.el8_2?arch=src"
}
}
}
],
"category": "architecture",
"name": "src"
},
{
"branches": [
{
"category": "product_version",
"name": "python3-pillow-0:5.1.1-12.el8_2.ppc64le",
"product": {
"name": "python3-pillow-0:5.1.1-12.el8_2.ppc64le",
"product_id": "python3-pillow-0:5.1.1-12.el8_2.ppc64le",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/python3-pillow@5.1.1-12.el8_2?arch=ppc64le"
}
}
},
{
"category": "product_version",
"name": "python-pillow-debugsource-0:5.1.1-12.el8_2.ppc64le",
"product": {
"name": "python-pillow-debugsource-0:5.1.1-12.el8_2.ppc64le",
"product_id": "python-pillow-debugsource-0:5.1.1-12.el8_2.ppc64le",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/python-pillow-debugsource@5.1.1-12.el8_2?arch=ppc64le"
}
}
},
{
"category": "product_version",
"name": "python-pillow-debuginfo-0:5.1.1-12.el8_2.ppc64le",
"product": {
"name": "python-pillow-debuginfo-0:5.1.1-12.el8_2.ppc64le",
"product_id": "python-pillow-debuginfo-0:5.1.1-12.el8_2.ppc64le",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/python-pillow-debuginfo@5.1.1-12.el8_2?arch=ppc64le"
}
}
},
{
"category": "product_version",
"name": "python3-pillow-debuginfo-0:5.1.1-12.el8_2.ppc64le",
"product": {
"name": "python3-pillow-debuginfo-0:5.1.1-12.el8_2.ppc64le",
"product_id": "python3-pillow-debuginfo-0:5.1.1-12.el8_2.ppc64le",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/python3-pillow-debuginfo@5.1.1-12.el8_2?arch=ppc64le"
}
}
},
{
"category": "product_version",
"name": "python3-pillow-tk-debuginfo-0:5.1.1-12.el8_2.ppc64le",
"product": {
"name": "python3-pillow-tk-debuginfo-0:5.1.1-12.el8_2.ppc64le",
"product_id": "python3-pillow-tk-debuginfo-0:5.1.1-12.el8_2.ppc64le",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/python3-pillow-tk-debuginfo@5.1.1-12.el8_2?arch=ppc64le"
}
}
}
],
"category": "architecture",
"name": "ppc64le"
},
{
"branches": [
{
"category": "product_version",
"name": "python3-pillow-0:5.1.1-12.el8_2.s390x",
"product": {
"name": "python3-pillow-0:5.1.1-12.el8_2.s390x",
"product_id": "python3-pillow-0:5.1.1-12.el8_2.s390x",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/python3-pillow@5.1.1-12.el8_2?arch=s390x"
}
}
},
{
"category": "product_version",
"name": "python-pillow-debugsource-0:5.1.1-12.el8_2.s390x",
"product": {
"name": "python-pillow-debugsource-0:5.1.1-12.el8_2.s390x",
"product_id": "python-pillow-debugsource-0:5.1.1-12.el8_2.s390x",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/python-pillow-debugsource@5.1.1-12.el8_2?arch=s390x"
}
}
},
{
"category": "product_version",
"name": "python-pillow-debuginfo-0:5.1.1-12.el8_2.s390x",
"product": {
"name": "python-pillow-debuginfo-0:5.1.1-12.el8_2.s390x",
"product_id": "python-pillow-debuginfo-0:5.1.1-12.el8_2.s390x",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/python-pillow-debuginfo@5.1.1-12.el8_2?arch=s390x"
}
}
},
{
"category": "product_version",
"name": "python3-pillow-debuginfo-0:5.1.1-12.el8_2.s390x",
"product": {
"name": "python3-pillow-debuginfo-0:5.1.1-12.el8_2.s390x",
"product_id": "python3-pillow-debuginfo-0:5.1.1-12.el8_2.s390x",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/python3-pillow-debuginfo@5.1.1-12.el8_2?arch=s390x"
}
}
},
{
"category": "product_version",
"name": "python3-pillow-tk-debuginfo-0:5.1.1-12.el8_2.s390x",
"product": {
"name": "python3-pillow-tk-debuginfo-0:5.1.1-12.el8_2.s390x",
"product_id": "python3-pillow-tk-debuginfo-0:5.1.1-12.el8_2.s390x",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/python3-pillow-tk-debuginfo@5.1.1-12.el8_2?arch=s390x"
}
}
}
],
"category": "architecture",
"name": "s390x"
},
{
"branches": [
{
"category": "product_version",
"name": "python3-pillow-0:5.1.1-12.el8_2.x86_64",
"product": {
"name": "python3-pillow-0:5.1.1-12.el8_2.x86_64",
"product_id": "python3-pillow-0:5.1.1-12.el8_2.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/python3-pillow@5.1.1-12.el8_2?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "python-pillow-debugsource-0:5.1.1-12.el8_2.x86_64",
"product": {
"name": "python-pillow-debugsource-0:5.1.1-12.el8_2.x86_64",
"product_id": "python-pillow-debugsource-0:5.1.1-12.el8_2.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/python-pillow-debugsource@5.1.1-12.el8_2?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "python-pillow-debuginfo-0:5.1.1-12.el8_2.x86_64",
"product": {
"name": "python-pillow-debuginfo-0:5.1.1-12.el8_2.x86_64",
"product_id": "python-pillow-debuginfo-0:5.1.1-12.el8_2.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/python-pillow-debuginfo@5.1.1-12.el8_2?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "python3-pillow-debuginfo-0:5.1.1-12.el8_2.x86_64",
"product": {
"name": "python3-pillow-debuginfo-0:5.1.1-12.el8_2.x86_64",
"product_id": "python3-pillow-debuginfo-0:5.1.1-12.el8_2.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/python3-pillow-debuginfo@5.1.1-12.el8_2?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "python3-pillow-tk-debuginfo-0:5.1.1-12.el8_2.x86_64",
"product": {
"name": "python3-pillow-tk-debuginfo-0:5.1.1-12.el8_2.x86_64",
"product_id": "python3-pillow-tk-debuginfo-0:5.1.1-12.el8_2.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/python3-pillow-tk-debuginfo@5.1.1-12.el8_2?arch=x86_64"
}
}
}
],
"category": "architecture",
"name": "x86_64"
},
{
"branches": [
{
"category": "product_version",
"name": "python3-pillow-0:5.1.1-12.el8_2.aarch64",
"product": {
"name": "python3-pillow-0:5.1.1-12.el8_2.aarch64",
"product_id": "python3-pillow-0:5.1.1-12.el8_2.aarch64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/python3-pillow@5.1.1-12.el8_2?arch=aarch64"
}
}
},
{
"category": "product_version",
"name": "python-pillow-debugsource-0:5.1.1-12.el8_2.aarch64",
"product": {
"name": "python-pillow-debugsource-0:5.1.1-12.el8_2.aarch64",
"product_id": "python-pillow-debugsource-0:5.1.1-12.el8_2.aarch64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/python-pillow-debugsource@5.1.1-12.el8_2?arch=aarch64"
}
}
},
{
"category": "product_version",
"name": "python-pillow-debuginfo-0:5.1.1-12.el8_2.aarch64",
"product": {
"name": "python-pillow-debuginfo-0:5.1.1-12.el8_2.aarch64",
"product_id": "python-pillow-debuginfo-0:5.1.1-12.el8_2.aarch64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/python-pillow-debuginfo@5.1.1-12.el8_2?arch=aarch64"
}
}
},
{
"category": "product_version",
"name": "python3-pillow-debuginfo-0:5.1.1-12.el8_2.aarch64",
"product": {
"name": "python3-pillow-debuginfo-0:5.1.1-12.el8_2.aarch64",
"product_id": "python3-pillow-debuginfo-0:5.1.1-12.el8_2.aarch64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/python3-pillow-debuginfo@5.1.1-12.el8_2?arch=aarch64"
}
}
},
{
"category": "product_version",
"name": "python3-pillow-tk-debuginfo-0:5.1.1-12.el8_2.aarch64",
"product": {
"name": "python3-pillow-tk-debuginfo-0:5.1.1-12.el8_2.aarch64",
"product_id": "python3-pillow-tk-debuginfo-0:5.1.1-12.el8_2.aarch64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/python3-pillow-tk-debuginfo@5.1.1-12.el8_2?arch=aarch64"
}
}
}
],
"category": "architecture",
"name": "aarch64"
}
],
"category": "vendor",
"name": "Red Hat"
}
],
"relationships": [
{
"category": "default_component_of",
"full_product_name": {
"name": "python-pillow-0:5.1.1-12.el8_2.src as a component of Red Hat Enterprise Linux AppStream (v. 8)",
"product_id": "AppStream-8.2.0.Z.MAIN.EUS:python-pillow-0:5.1.1-12.el8_2.src"
},
"product_reference": "python-pillow-0:5.1.1-12.el8_2.src",
"relates_to_product_reference": "AppStream-8.2.0.Z.MAIN.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "python-pillow-debuginfo-0:5.1.1-12.el8_2.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 8)",
"product_id": "AppStream-8.2.0.Z.MAIN.EUS:python-pillow-debuginfo-0:5.1.1-12.el8_2.aarch64"
},
"product_reference": "python-pillow-debuginfo-0:5.1.1-12.el8_2.aarch64",
"relates_to_product_reference": "AppStream-8.2.0.Z.MAIN.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "python-pillow-debuginfo-0:5.1.1-12.el8_2.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 8)",
"product_id": "AppStream-8.2.0.Z.MAIN.EUS:python-pillow-debuginfo-0:5.1.1-12.el8_2.ppc64le"
},
"product_reference": "python-pillow-debuginfo-0:5.1.1-12.el8_2.ppc64le",
"relates_to_product_reference": "AppStream-8.2.0.Z.MAIN.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "python-pillow-debuginfo-0:5.1.1-12.el8_2.s390x as a component of Red Hat Enterprise Linux AppStream (v. 8)",
"product_id": "AppStream-8.2.0.Z.MAIN.EUS:python-pillow-debuginfo-0:5.1.1-12.el8_2.s390x"
},
"product_reference": "python-pillow-debuginfo-0:5.1.1-12.el8_2.s390x",
"relates_to_product_reference": "AppStream-8.2.0.Z.MAIN.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "python-pillow-debuginfo-0:5.1.1-12.el8_2.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 8)",
"product_id": "AppStream-8.2.0.Z.MAIN.EUS:python-pillow-debuginfo-0:5.1.1-12.el8_2.x86_64"
},
"product_reference": "python-pillow-debuginfo-0:5.1.1-12.el8_2.x86_64",
"relates_to_product_reference": "AppStream-8.2.0.Z.MAIN.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "python-pillow-debugsource-0:5.1.1-12.el8_2.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 8)",
"product_id": "AppStream-8.2.0.Z.MAIN.EUS:python-pillow-debugsource-0:5.1.1-12.el8_2.aarch64"
},
"product_reference": "python-pillow-debugsource-0:5.1.1-12.el8_2.aarch64",
"relates_to_product_reference": "AppStream-8.2.0.Z.MAIN.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "python-pillow-debugsource-0:5.1.1-12.el8_2.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 8)",
"product_id": "AppStream-8.2.0.Z.MAIN.EUS:python-pillow-debugsource-0:5.1.1-12.el8_2.ppc64le"
},
"product_reference": "python-pillow-debugsource-0:5.1.1-12.el8_2.ppc64le",
"relates_to_product_reference": "AppStream-8.2.0.Z.MAIN.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "python-pillow-debugsource-0:5.1.1-12.el8_2.s390x as a component of Red Hat Enterprise Linux AppStream (v. 8)",
"product_id": "AppStream-8.2.0.Z.MAIN.EUS:python-pillow-debugsource-0:5.1.1-12.el8_2.s390x"
},
"product_reference": "python-pillow-debugsource-0:5.1.1-12.el8_2.s390x",
"relates_to_product_reference": "AppStream-8.2.0.Z.MAIN.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "python-pillow-debugsource-0:5.1.1-12.el8_2.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 8)",
"product_id": "AppStream-8.2.0.Z.MAIN.EUS:python-pillow-debugsource-0:5.1.1-12.el8_2.x86_64"
},
"product_reference": "python-pillow-debugsource-0:5.1.1-12.el8_2.x86_64",
"relates_to_product_reference": "AppStream-8.2.0.Z.MAIN.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "python3-pillow-0:5.1.1-12.el8_2.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 8)",
"product_id": "AppStream-8.2.0.Z.MAIN.EUS:python3-pillow-0:5.1.1-12.el8_2.aarch64"
},
"product_reference": "python3-pillow-0:5.1.1-12.el8_2.aarch64",
"relates_to_product_reference": "AppStream-8.2.0.Z.MAIN.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "python3-pillow-0:5.1.1-12.el8_2.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 8)",
"product_id": "AppStream-8.2.0.Z.MAIN.EUS:python3-pillow-0:5.1.1-12.el8_2.ppc64le"
},
"product_reference": "python3-pillow-0:5.1.1-12.el8_2.ppc64le",
"relates_to_product_reference": "AppStream-8.2.0.Z.MAIN.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "python3-pillow-0:5.1.1-12.el8_2.s390x as a component of Red Hat Enterprise Linux AppStream (v. 8)",
"product_id": "AppStream-8.2.0.Z.MAIN.EUS:python3-pillow-0:5.1.1-12.el8_2.s390x"
},
"product_reference": "python3-pillow-0:5.1.1-12.el8_2.s390x",
"relates_to_product_reference": "AppStream-8.2.0.Z.MAIN.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "python3-pillow-0:5.1.1-12.el8_2.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 8)",
"product_id": "AppStream-8.2.0.Z.MAIN.EUS:python3-pillow-0:5.1.1-12.el8_2.x86_64"
},
"product_reference": "python3-pillow-0:5.1.1-12.el8_2.x86_64",
"relates_to_product_reference": "AppStream-8.2.0.Z.MAIN.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "python3-pillow-debuginfo-0:5.1.1-12.el8_2.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 8)",
"product_id": "AppStream-8.2.0.Z.MAIN.EUS:python3-pillow-debuginfo-0:5.1.1-12.el8_2.aarch64"
},
"product_reference": "python3-pillow-debuginfo-0:5.1.1-12.el8_2.aarch64",
"relates_to_product_reference": "AppStream-8.2.0.Z.MAIN.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "python3-pillow-debuginfo-0:5.1.1-12.el8_2.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 8)",
"product_id": "AppStream-8.2.0.Z.MAIN.EUS:python3-pillow-debuginfo-0:5.1.1-12.el8_2.ppc64le"
},
"product_reference": "python3-pillow-debuginfo-0:5.1.1-12.el8_2.ppc64le",
"relates_to_product_reference": "AppStream-8.2.0.Z.MAIN.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "python3-pillow-debuginfo-0:5.1.1-12.el8_2.s390x as a component of Red Hat Enterprise Linux AppStream (v. 8)",
"product_id": "AppStream-8.2.0.Z.MAIN.EUS:python3-pillow-debuginfo-0:5.1.1-12.el8_2.s390x"
},
"product_reference": "python3-pillow-debuginfo-0:5.1.1-12.el8_2.s390x",
"relates_to_product_reference": "AppStream-8.2.0.Z.MAIN.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "python3-pillow-debuginfo-0:5.1.1-12.el8_2.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 8)",
"product_id": "AppStream-8.2.0.Z.MAIN.EUS:python3-pillow-debuginfo-0:5.1.1-12.el8_2.x86_64"
},
"product_reference": "python3-pillow-debuginfo-0:5.1.1-12.el8_2.x86_64",
"relates_to_product_reference": "AppStream-8.2.0.Z.MAIN.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "python3-pillow-tk-debuginfo-0:5.1.1-12.el8_2.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 8)",
"product_id": "AppStream-8.2.0.Z.MAIN.EUS:python3-pillow-tk-debuginfo-0:5.1.1-12.el8_2.aarch64"
},
"product_reference": "python3-pillow-tk-debuginfo-0:5.1.1-12.el8_2.aarch64",
"relates_to_product_reference": "AppStream-8.2.0.Z.MAIN.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "python3-pillow-tk-debuginfo-0:5.1.1-12.el8_2.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 8)",
"product_id": "AppStream-8.2.0.Z.MAIN.EUS:python3-pillow-tk-debuginfo-0:5.1.1-12.el8_2.ppc64le"
},
"product_reference": "python3-pillow-tk-debuginfo-0:5.1.1-12.el8_2.ppc64le",
"relates_to_product_reference": "AppStream-8.2.0.Z.MAIN.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "python3-pillow-tk-debuginfo-0:5.1.1-12.el8_2.s390x as a component of Red Hat Enterprise Linux AppStream (v. 8)",
"product_id": "AppStream-8.2.0.Z.MAIN.EUS:python3-pillow-tk-debuginfo-0:5.1.1-12.el8_2.s390x"
},
"product_reference": "python3-pillow-tk-debuginfo-0:5.1.1-12.el8_2.s390x",
"relates_to_product_reference": "AppStream-8.2.0.Z.MAIN.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "python3-pillow-tk-debuginfo-0:5.1.1-12.el8_2.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 8)",
"product_id": "AppStream-8.2.0.Z.MAIN.EUS:python3-pillow-tk-debuginfo-0:5.1.1-12.el8_2.x86_64"
},
"product_reference": "python3-pillow-tk-debuginfo-0:5.1.1-12.el8_2.x86_64",
"relates_to_product_reference": "AppStream-8.2.0.Z.MAIN.EUS"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2020-5313",
"cwe": {
"id": "CWE-125",
"name": "Out-of-bounds Read"
},
"discovery_date": "2020-01-03T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1789532"
}
],
"notes": [
{
"category": "description",
"text": "An out-of-bounds read was discovered in python-pillow in the way it decodes FLI images. An application that uses python-pillow to load untrusted images may be vulnerable to this flaw, which can allow an attacker to read the memory of the application they should be not allowed to read.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "python-pillow: out-of-bounds read in ImagingFliDecode when loading FLI images",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"AppStream-8.2.0.Z.MAIN.EUS:python-pillow-0:5.1.1-12.el8_2.src",
"AppStream-8.2.0.Z.MAIN.EUS:python-pillow-debuginfo-0:5.1.1-12.el8_2.aarch64",
"AppStream-8.2.0.Z.MAIN.EUS:python-pillow-debuginfo-0:5.1.1-12.el8_2.ppc64le",
"AppStream-8.2.0.Z.MAIN.EUS:python-pillow-debuginfo-0:5.1.1-12.el8_2.s390x",
"AppStream-8.2.0.Z.MAIN.EUS:python-pillow-debuginfo-0:5.1.1-12.el8_2.x86_64",
"AppStream-8.2.0.Z.MAIN.EUS:python-pillow-debugsource-0:5.1.1-12.el8_2.aarch64",
"AppStream-8.2.0.Z.MAIN.EUS:python-pillow-debugsource-0:5.1.1-12.el8_2.ppc64le",
"AppStream-8.2.0.Z.MAIN.EUS:python-pillow-debugsource-0:5.1.1-12.el8_2.s390x",
"AppStream-8.2.0.Z.MAIN.EUS:python-pillow-debugsource-0:5.1.1-12.el8_2.x86_64",
"AppStream-8.2.0.Z.MAIN.EUS:python3-pillow-0:5.1.1-12.el8_2.aarch64",
"AppStream-8.2.0.Z.MAIN.EUS:python3-pillow-0:5.1.1-12.el8_2.ppc64le",
"AppStream-8.2.0.Z.MAIN.EUS:python3-pillow-0:5.1.1-12.el8_2.s390x",
"AppStream-8.2.0.Z.MAIN.EUS:python3-pillow-0:5.1.1-12.el8_2.x86_64",
"AppStream-8.2.0.Z.MAIN.EUS:python3-pillow-debuginfo-0:5.1.1-12.el8_2.aarch64",
"AppStream-8.2.0.Z.MAIN.EUS:python3-pillow-debuginfo-0:5.1.1-12.el8_2.ppc64le",
"AppStream-8.2.0.Z.MAIN.EUS:python3-pillow-debuginfo-0:5.1.1-12.el8_2.s390x",
"AppStream-8.2.0.Z.MAIN.EUS:python3-pillow-debuginfo-0:5.1.1-12.el8_2.x86_64",
"AppStream-8.2.0.Z.MAIN.EUS:python3-pillow-tk-debuginfo-0:5.1.1-12.el8_2.aarch64",
"AppStream-8.2.0.Z.MAIN.EUS:python3-pillow-tk-debuginfo-0:5.1.1-12.el8_2.ppc64le",
"AppStream-8.2.0.Z.MAIN.EUS:python3-pillow-tk-debuginfo-0:5.1.1-12.el8_2.s390x",
"AppStream-8.2.0.Z.MAIN.EUS:python3-pillow-tk-debuginfo-0:5.1.1-12.el8_2.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2020-5313"
},
{
"category": "external",
"summary": "RHBZ#1789532",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1789532"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2020-5313",
"url": "https://www.cve.org/CVERecord?id=CVE-2020-5313"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2020-5313",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2020-5313"
}
],
"release_date": "2020-01-03T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2020-07-28T13:41:04+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"AppStream-8.2.0.Z.MAIN.EUS:python-pillow-0:5.1.1-12.el8_2.src",
"AppStream-8.2.0.Z.MAIN.EUS:python-pillow-debuginfo-0:5.1.1-12.el8_2.aarch64",
"AppStream-8.2.0.Z.MAIN.EUS:python-pillow-debuginfo-0:5.1.1-12.el8_2.ppc64le",
"AppStream-8.2.0.Z.MAIN.EUS:python-pillow-debuginfo-0:5.1.1-12.el8_2.s390x",
"AppStream-8.2.0.Z.MAIN.EUS:python-pillow-debuginfo-0:5.1.1-12.el8_2.x86_64",
"AppStream-8.2.0.Z.MAIN.EUS:python-pillow-debugsource-0:5.1.1-12.el8_2.aarch64",
"AppStream-8.2.0.Z.MAIN.EUS:python-pillow-debugsource-0:5.1.1-12.el8_2.ppc64le",
"AppStream-8.2.0.Z.MAIN.EUS:python-pillow-debugsource-0:5.1.1-12.el8_2.s390x",
"AppStream-8.2.0.Z.MAIN.EUS:python-pillow-debugsource-0:5.1.1-12.el8_2.x86_64",
"AppStream-8.2.0.Z.MAIN.EUS:python3-pillow-0:5.1.1-12.el8_2.aarch64",
"AppStream-8.2.0.Z.MAIN.EUS:python3-pillow-0:5.1.1-12.el8_2.ppc64le",
"AppStream-8.2.0.Z.MAIN.EUS:python3-pillow-0:5.1.1-12.el8_2.s390x",
"AppStream-8.2.0.Z.MAIN.EUS:python3-pillow-0:5.1.1-12.el8_2.x86_64",
"AppStream-8.2.0.Z.MAIN.EUS:python3-pillow-debuginfo-0:5.1.1-12.el8_2.aarch64",
"AppStream-8.2.0.Z.MAIN.EUS:python3-pillow-debuginfo-0:5.1.1-12.el8_2.ppc64le",
"AppStream-8.2.0.Z.MAIN.EUS:python3-pillow-debuginfo-0:5.1.1-12.el8_2.s390x",
"AppStream-8.2.0.Z.MAIN.EUS:python3-pillow-debuginfo-0:5.1.1-12.el8_2.x86_64",
"AppStream-8.2.0.Z.MAIN.EUS:python3-pillow-tk-debuginfo-0:5.1.1-12.el8_2.aarch64",
"AppStream-8.2.0.Z.MAIN.EUS:python3-pillow-tk-debuginfo-0:5.1.1-12.el8_2.ppc64le",
"AppStream-8.2.0.Z.MAIN.EUS:python3-pillow-tk-debuginfo-0:5.1.1-12.el8_2.s390x",
"AppStream-8.2.0.Z.MAIN.EUS:python3-pillow-tk-debuginfo-0:5.1.1-12.el8_2.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2020:3185"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.2,
"baseSeverity": "HIGH",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H",
"version": "3.1"
},
"products": [
"AppStream-8.2.0.Z.MAIN.EUS:python-pillow-0:5.1.1-12.el8_2.src",
"AppStream-8.2.0.Z.MAIN.EUS:python-pillow-debuginfo-0:5.1.1-12.el8_2.aarch64",
"AppStream-8.2.0.Z.MAIN.EUS:python-pillow-debuginfo-0:5.1.1-12.el8_2.ppc64le",
"AppStream-8.2.0.Z.MAIN.EUS:python-pillow-debuginfo-0:5.1.1-12.el8_2.s390x",
"AppStream-8.2.0.Z.MAIN.EUS:python-pillow-debuginfo-0:5.1.1-12.el8_2.x86_64",
"AppStream-8.2.0.Z.MAIN.EUS:python-pillow-debugsource-0:5.1.1-12.el8_2.aarch64",
"AppStream-8.2.0.Z.MAIN.EUS:python-pillow-debugsource-0:5.1.1-12.el8_2.ppc64le",
"AppStream-8.2.0.Z.MAIN.EUS:python-pillow-debugsource-0:5.1.1-12.el8_2.s390x",
"AppStream-8.2.0.Z.MAIN.EUS:python-pillow-debugsource-0:5.1.1-12.el8_2.x86_64",
"AppStream-8.2.0.Z.MAIN.EUS:python3-pillow-0:5.1.1-12.el8_2.aarch64",
"AppStream-8.2.0.Z.MAIN.EUS:python3-pillow-0:5.1.1-12.el8_2.ppc64le",
"AppStream-8.2.0.Z.MAIN.EUS:python3-pillow-0:5.1.1-12.el8_2.s390x",
"AppStream-8.2.0.Z.MAIN.EUS:python3-pillow-0:5.1.1-12.el8_2.x86_64",
"AppStream-8.2.0.Z.MAIN.EUS:python3-pillow-debuginfo-0:5.1.1-12.el8_2.aarch64",
"AppStream-8.2.0.Z.MAIN.EUS:python3-pillow-debuginfo-0:5.1.1-12.el8_2.ppc64le",
"AppStream-8.2.0.Z.MAIN.EUS:python3-pillow-debuginfo-0:5.1.1-12.el8_2.s390x",
"AppStream-8.2.0.Z.MAIN.EUS:python3-pillow-debuginfo-0:5.1.1-12.el8_2.x86_64",
"AppStream-8.2.0.Z.MAIN.EUS:python3-pillow-tk-debuginfo-0:5.1.1-12.el8_2.aarch64",
"AppStream-8.2.0.Z.MAIN.EUS:python3-pillow-tk-debuginfo-0:5.1.1-12.el8_2.ppc64le",
"AppStream-8.2.0.Z.MAIN.EUS:python3-pillow-tk-debuginfo-0:5.1.1-12.el8_2.s390x",
"AppStream-8.2.0.Z.MAIN.EUS:python3-pillow-tk-debuginfo-0:5.1.1-12.el8_2.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "python-pillow: out-of-bounds read in ImagingFliDecode when loading FLI images"
},
{
"cve": "CVE-2020-11538",
"cwe": {
"id": "CWE-122",
"name": "Heap-based Buffer Overflow"
},
"discovery_date": "2020-07-01T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1852814"
}
],
"notes": [
{
"category": "description",
"text": "An out-of-bounds read/write flaw was found in python-pillow, in the way SGI RLE images are decoded. An application that uses python-pillow to decode untrusted images may be vulnerable. This flaw allows an attacker to crash the application or potentially execute code on the system. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "python-pillow: out-of-bounds reads/writes in the parsing of SGI image files in expandrow/expandrow2",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This issue did not affect the versions of python-pillow and python-imaging as shipped with Red Hat Enterprise Linux 5, 6, and 7 as they did not include the SGI RLE image decoder, where the flaw lies.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"AppStream-8.2.0.Z.MAIN.EUS:python-pillow-0:5.1.1-12.el8_2.src",
"AppStream-8.2.0.Z.MAIN.EUS:python-pillow-debuginfo-0:5.1.1-12.el8_2.aarch64",
"AppStream-8.2.0.Z.MAIN.EUS:python-pillow-debuginfo-0:5.1.1-12.el8_2.ppc64le",
"AppStream-8.2.0.Z.MAIN.EUS:python-pillow-debuginfo-0:5.1.1-12.el8_2.s390x",
"AppStream-8.2.0.Z.MAIN.EUS:python-pillow-debuginfo-0:5.1.1-12.el8_2.x86_64",
"AppStream-8.2.0.Z.MAIN.EUS:python-pillow-debugsource-0:5.1.1-12.el8_2.aarch64",
"AppStream-8.2.0.Z.MAIN.EUS:python-pillow-debugsource-0:5.1.1-12.el8_2.ppc64le",
"AppStream-8.2.0.Z.MAIN.EUS:python-pillow-debugsource-0:5.1.1-12.el8_2.s390x",
"AppStream-8.2.0.Z.MAIN.EUS:python-pillow-debugsource-0:5.1.1-12.el8_2.x86_64",
"AppStream-8.2.0.Z.MAIN.EUS:python3-pillow-0:5.1.1-12.el8_2.aarch64",
"AppStream-8.2.0.Z.MAIN.EUS:python3-pillow-0:5.1.1-12.el8_2.ppc64le",
"AppStream-8.2.0.Z.MAIN.EUS:python3-pillow-0:5.1.1-12.el8_2.s390x",
"AppStream-8.2.0.Z.MAIN.EUS:python3-pillow-0:5.1.1-12.el8_2.x86_64",
"AppStream-8.2.0.Z.MAIN.EUS:python3-pillow-debuginfo-0:5.1.1-12.el8_2.aarch64",
"AppStream-8.2.0.Z.MAIN.EUS:python3-pillow-debuginfo-0:5.1.1-12.el8_2.ppc64le",
"AppStream-8.2.0.Z.MAIN.EUS:python3-pillow-debuginfo-0:5.1.1-12.el8_2.s390x",
"AppStream-8.2.0.Z.MAIN.EUS:python3-pillow-debuginfo-0:5.1.1-12.el8_2.x86_64",
"AppStream-8.2.0.Z.MAIN.EUS:python3-pillow-tk-debuginfo-0:5.1.1-12.el8_2.aarch64",
"AppStream-8.2.0.Z.MAIN.EUS:python3-pillow-tk-debuginfo-0:5.1.1-12.el8_2.ppc64le",
"AppStream-8.2.0.Z.MAIN.EUS:python3-pillow-tk-debuginfo-0:5.1.1-12.el8_2.s390x",
"AppStream-8.2.0.Z.MAIN.EUS:python3-pillow-tk-debuginfo-0:5.1.1-12.el8_2.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2020-11538"
},
{
"category": "external",
"summary": "RHBZ#1852814",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1852814"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2020-11538",
"url": "https://www.cve.org/CVERecord?id=CVE-2020-11538"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2020-11538",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2020-11538"
}
],
"release_date": "2020-07-01T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2020-07-28T13:41:04+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"AppStream-8.2.0.Z.MAIN.EUS:python-pillow-0:5.1.1-12.el8_2.src",
"AppStream-8.2.0.Z.MAIN.EUS:python-pillow-debuginfo-0:5.1.1-12.el8_2.aarch64",
"AppStream-8.2.0.Z.MAIN.EUS:python-pillow-debuginfo-0:5.1.1-12.el8_2.ppc64le",
"AppStream-8.2.0.Z.MAIN.EUS:python-pillow-debuginfo-0:5.1.1-12.el8_2.s390x",
"AppStream-8.2.0.Z.MAIN.EUS:python-pillow-debuginfo-0:5.1.1-12.el8_2.x86_64",
"AppStream-8.2.0.Z.MAIN.EUS:python-pillow-debugsource-0:5.1.1-12.el8_2.aarch64",
"AppStream-8.2.0.Z.MAIN.EUS:python-pillow-debugsource-0:5.1.1-12.el8_2.ppc64le",
"AppStream-8.2.0.Z.MAIN.EUS:python-pillow-debugsource-0:5.1.1-12.el8_2.s390x",
"AppStream-8.2.0.Z.MAIN.EUS:python-pillow-debugsource-0:5.1.1-12.el8_2.x86_64",
"AppStream-8.2.0.Z.MAIN.EUS:python3-pillow-0:5.1.1-12.el8_2.aarch64",
"AppStream-8.2.0.Z.MAIN.EUS:python3-pillow-0:5.1.1-12.el8_2.ppc64le",
"AppStream-8.2.0.Z.MAIN.EUS:python3-pillow-0:5.1.1-12.el8_2.s390x",
"AppStream-8.2.0.Z.MAIN.EUS:python3-pillow-0:5.1.1-12.el8_2.x86_64",
"AppStream-8.2.0.Z.MAIN.EUS:python3-pillow-debuginfo-0:5.1.1-12.el8_2.aarch64",
"AppStream-8.2.0.Z.MAIN.EUS:python3-pillow-debuginfo-0:5.1.1-12.el8_2.ppc64le",
"AppStream-8.2.0.Z.MAIN.EUS:python3-pillow-debuginfo-0:5.1.1-12.el8_2.s390x",
"AppStream-8.2.0.Z.MAIN.EUS:python3-pillow-debuginfo-0:5.1.1-12.el8_2.x86_64",
"AppStream-8.2.0.Z.MAIN.EUS:python3-pillow-tk-debuginfo-0:5.1.1-12.el8_2.aarch64",
"AppStream-8.2.0.Z.MAIN.EUS:python3-pillow-tk-debuginfo-0:5.1.1-12.el8_2.ppc64le",
"AppStream-8.2.0.Z.MAIN.EUS:python3-pillow-tk-debuginfo-0:5.1.1-12.el8_2.s390x",
"AppStream-8.2.0.Z.MAIN.EUS:python3-pillow-tk-debuginfo-0:5.1.1-12.el8_2.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2020:3185"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.1,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"AppStream-8.2.0.Z.MAIN.EUS:python-pillow-0:5.1.1-12.el8_2.src",
"AppStream-8.2.0.Z.MAIN.EUS:python-pillow-debuginfo-0:5.1.1-12.el8_2.aarch64",
"AppStream-8.2.0.Z.MAIN.EUS:python-pillow-debuginfo-0:5.1.1-12.el8_2.ppc64le",
"AppStream-8.2.0.Z.MAIN.EUS:python-pillow-debuginfo-0:5.1.1-12.el8_2.s390x",
"AppStream-8.2.0.Z.MAIN.EUS:python-pillow-debuginfo-0:5.1.1-12.el8_2.x86_64",
"AppStream-8.2.0.Z.MAIN.EUS:python-pillow-debugsource-0:5.1.1-12.el8_2.aarch64",
"AppStream-8.2.0.Z.MAIN.EUS:python-pillow-debugsource-0:5.1.1-12.el8_2.ppc64le",
"AppStream-8.2.0.Z.MAIN.EUS:python-pillow-debugsource-0:5.1.1-12.el8_2.s390x",
"AppStream-8.2.0.Z.MAIN.EUS:python-pillow-debugsource-0:5.1.1-12.el8_2.x86_64",
"AppStream-8.2.0.Z.MAIN.EUS:python3-pillow-0:5.1.1-12.el8_2.aarch64",
"AppStream-8.2.0.Z.MAIN.EUS:python3-pillow-0:5.1.1-12.el8_2.ppc64le",
"AppStream-8.2.0.Z.MAIN.EUS:python3-pillow-0:5.1.1-12.el8_2.s390x",
"AppStream-8.2.0.Z.MAIN.EUS:python3-pillow-0:5.1.1-12.el8_2.x86_64",
"AppStream-8.2.0.Z.MAIN.EUS:python3-pillow-debuginfo-0:5.1.1-12.el8_2.aarch64",
"AppStream-8.2.0.Z.MAIN.EUS:python3-pillow-debuginfo-0:5.1.1-12.el8_2.ppc64le",
"AppStream-8.2.0.Z.MAIN.EUS:python3-pillow-debuginfo-0:5.1.1-12.el8_2.s390x",
"AppStream-8.2.0.Z.MAIN.EUS:python3-pillow-debuginfo-0:5.1.1-12.el8_2.x86_64",
"AppStream-8.2.0.Z.MAIN.EUS:python3-pillow-tk-debuginfo-0:5.1.1-12.el8_2.aarch64",
"AppStream-8.2.0.Z.MAIN.EUS:python3-pillow-tk-debuginfo-0:5.1.1-12.el8_2.ppc64le",
"AppStream-8.2.0.Z.MAIN.EUS:python3-pillow-tk-debuginfo-0:5.1.1-12.el8_2.s390x",
"AppStream-8.2.0.Z.MAIN.EUS:python3-pillow-tk-debuginfo-0:5.1.1-12.el8_2.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "python-pillow: out-of-bounds reads/writes in the parsing of SGI image files in expandrow/expandrow2"
}
]
}
Sightings
| Author | Source | Type | Date | Other |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.