GitHub Advisoryadvisory · PyPI

GHSA-hf64-x4gq-p99h Pillow Out-of-bounds Read

MEDIUM Published 2021-03-18 Modified 2024-10-08 Official page ↗
Aliases
CVE-2020-35655
Ecosystem
PyPI
Packages
pillow
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:L
Weaknesses
CWE-125
Reviewed
2021-03-12

Affected packages

• PyPI pillow: >= 4.3.0, < 8.1.0 → fixed in 8.1.0

Description

In Pillow before 8.1.0, SGIRleDecode has a 4-byte buffer over-read when decoding crafted SGI RLE image files because offsets and length tables are mishandled.

Related

Alias · CVE (1)

  • CVE-2020-35655 In Pillow before 8.1.0, SGIRleDecode has a 4-byte buffer over-read when decoding crafted SGI RLE image files because offsets and length… vulnerability

Weakness · CWE (1)

  • CWE-125 Out-of-bounds Read weakness

References