Out-of-bounds write in Pillow - CVE-2020-35654

Vulnerability identifier: #VU49384

CSH Severity: High

CVSS v4: 8.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2020-35654

CWE-ID: CWE-787

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to compromise vulnerable system.

The vulnerability exists due to a boundary error when processing TIFF files. A remote attacker can create a specially crafted file, trick the victim into opening it using the affected software, trigger out-of-bounds write and execute arbitrary code on the target system.

Pillow
Gentoo Linux
Arch Linux
Ubuntu
Fedora
py3-pillow (Alpine package)
python3-pil (Ubuntu package)
python-pil (Ubuntu package)
python-pillow
mingw-python-pillow

Install updates from vendor's website.

Pillow - update to 8.1.0
py3-pillow (Alpine package) - update to 8.1.0-r0
python3-pil (Ubuntu package) - addressed in versions 3.1.2-0ubuntu1.5, 5.1.0-1ubuntu0.4, 7.0.0-4ubuntu0.2, 7.2.0-1ubuntu0.1
python-pil (Ubuntu package) - addressed in versions 3.1.2-0ubuntu1.5, 5.1.0-1ubuntu0.4
python-pillow - addressed in versions 7.0.0-5.fc32, 7.2.0-3.fc33
mingw-python-pillow - update to 7.2.0-3.fc33

• https://security.gentoo.org/glsa/202101-08
• https://bugs.gentoo.org/763210

• Multiple vulnerabilities in Pillow
• Gentoo update for Pillow
• Arch Linux update for python-pillow
• Out-of-bounds write in py3-pillow (Alpine package)
• Ubuntu update for pillow
• Fedora 33 update for mingw-python-pillow, python-pillow
• Fedora 32 update for python-pillow