Out-of-bounds read in Pillow
In `libImaging/PcxDecode.c` in Pillow before 7.1.0, an out-of-bounds read can occur when reading PCX files where `state->shuffle` is instructed to read beyond `state->buffer`.
01
beschreibt (1)
Zugehörige CVEs.
| ID | Schweregrad | ausnutzbar | ||
|---|---|---|---|---|
| CVE-2020-10378US | medium5.5 | — | ||
In libImaging/PcxDecode.c in Pillow before 7.1.0, an out-of-bounds read can occur when reading PCX files where state->shuffle is instructed to read beyond state->buffer. | ||||
02
Referenzen
Externe Belege — Patches, Meldungen, Analysen.
- https://github.com/advisories/GHSA-3xv8-3j54-hgrpADVISORY
- https://github.com/pypa/advisory-database/tree/main/vulns/pillow/PYSEC-2020-77.yamlWEB
- https://github.com/pypa/advisory-db/blob/7872b0a91b4d980f749e6d75a81f8cc1af32829f/vulns/pillow/PYSEC-2020-77.yamlWEB
- https://github.com/python-pillow/PillowPACKAGE
- https://github.com/python-pillow/Pillow/commit/124f4bb591e16212605d0e41c413ed53e242cba2WEB
- https://github.com/python-pillow/Pillow/commit/6a83e4324738bb0452fbe8074a995b1c73f08de7#diff-9478f2787e3ae9668a15123b165c23acWEB
- https://github.com/python-pillow/Pillow/commits/master/src/libImagingWEB
- https://github.com/python-pillow/Pillow/issues/4750WEB
scry
Advisories wie diese benennen die exponierten Produkte, die Angreifer auf Ihrer Angriffsfläche ins Visier nehmen. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.
Kostenloser Scan