Buffer overflow in Pillow - CVE-2020-35655

Vulnerability identifier: #VU49385

CSH Severity: High

CVSS v4: 8.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2020-35655

CWE-ID: CWE-119

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to a boundary error when processing SGI files. A remote attacker can create a specially crafted SGI file, trick the victim into opening it, trigger memory corruption and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

Pillow
Gentoo Linux
Arch Linux
Ubuntu
Fedora
py3-pillow (Alpine package)
python3-pil (Ubuntu package)
python-pil (Ubuntu package)
python-pillow
mingw-python-pillow

Install updates from vendor's website.

Pillow - update to 8.1.0
py3-pillow (Alpine package) - addressed in versions 7.1.2-r1, 7.2.0-r1, 8.1.0-r0
python3-pil (Ubuntu package) - addressed in versions 3.1.2-0ubuntu1.5, 5.1.0-1ubuntu0.4, 7.0.0-4ubuntu0.2, 7.2.0-1ubuntu0.1
python-pil (Ubuntu package) - addressed in versions 3.1.2-0ubuntu1.5, 5.1.0-1ubuntu0.4
python-pillow - addressed in versions 7.0.0-5.fc32, 7.2.0-3.fc33
mingw-python-pillow - update to 7.2.0-3.fc33

• https://security.gentoo.org/glsa/202101-08
• https://bugs.gentoo.org/763210

• Multiple vulnerabilities in Pillow
• Gentoo update for Pillow
• Arch Linux update for python-pillow
• Buffer overflow in py3-pillow (Alpine package)
• Ubuntu update for pillow
• Fedora 33 update for mingw-python-pillow, python-pillow
• Fedora 32 update for python-pillow