CVE-2020-10378: Medium severity Python Pillow vulnerability
A flaw was found in python-pillow. In libImaging/PcxDecode.c, an out-of-bounds read occurs when reading PCX files where state->shuffle is instructed to read beyond state->buffer.
Other sources
In libImaging/PcxDecode.c in Pillow before 7.1.0, an out-of-bounds read can occur when reading PCX files where state->shuffle is instructed to read beyond state->buffer.
— GitHub
In libImaging/PcxDecode.c in Pillow before 6.2.3 and 7.x before 7.0.1, an out-of-bounds read can occur when reading PCX files where state->shuffle is instructed to read beyond state->buffer.
Pull Request:
https://github.com/python-pillow/Pillow/pull/4538
Upstream Advisory:
https://pillow.readthedocs.io/en/stable/releasenotes/7.1.0.html
Upstream Advisory:
https://pillow.readthedocs.io/en/stable/releasenotes/6.2.3.html
— Red Hat
In libImaging/PcxDecode.c in Pillow before 7.1.0, an out-of-bounds read can occur when reading PCX files where state->shuffle is instructed to read beyond state->buffer.
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the vulnerability ID for this flaw in python-pillow?
The vulnerability ID for this flaw in python-pillow is CVE-2020-10378.
What is the severity of CVE-2020-10378?
The severity of CVE-2020-10378 is medium.
Which versions of python-pillow are affected by CVE-2020-10378?
Versions up to and excluding 7.1.0 of python-pillow are affected by CVE-2020-10378.
What is the remedy for CVE-2020-10378 in ubuntu/pillow?
The remedy for CVE-2020-10378 in ubuntu/pillow is version 3.1.2-0ubuntu1.4.
Where can I find more information about CVE-2020-10378?
You can find more information about CVE-2020-10378 on the CVE website and NIST National Vulnerability Database.