CVE-2020-10571: Buffer Overflow
Impact An issue was discovered in psd-tools before 1.9.4. The Cython implementation of RLE decoding did not check for malformed PSD input data during decoding to the PIL.Image or NumPy format, leading to a Buffer Overflow.
Patches Users of psd-tools version v1.8.37 to v1.9.3 should upgrade to v1.9.4.
Workarounds Without Cython present on installation, buffer overflow does not occur but IndexError will be thrown. However, already installed psd-tools with Cython extention should be upgraded.
References https://github.com/psd-tools/psd-tools/pull/198
For more information If you have any questions or comments about this advisory: Open an issue in psd-tools
Other sources
An issue was discovered in psd-tools before 1.9.4. The Cython implementation of RLE decoding did not check for malicious data.
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2020-10571?
CVE-2020-10571 is classified as a high severity vulnerability due to the potential for a buffer overflow.
How do I fix CVE-2020-10571?
To fix CVE-2020-10571, upgrade psd-tools to version 1.9.4 or later.
Which versions of psd-tools are affected by CVE-2020-10571?
CVE-2020-10571 affects psd-tools versions between 1.8.37 and 1.9.3.
What type of issue is CVE-2020-10571?
CVE-2020-10571 is a buffer overflow vulnerability caused by a lack of input validation in the RLE decoding implementation.
Is there a specific implementation affected by CVE-2020-10571?
Yes, the Cython implementation of RLE decoding in psd-tools is specifically affected by CVE-2020-10571.