CVE-2020-35655

MEDIUM5.4

In Pillow before 8.1.0, SGIRleDecode has a 4-byte buffer over-read when decoding crafted SGI RLE image files because offsets and length tables are mishandled

Published Jan 12, 2021

Modified 2 years ago

Details

In Pillow before 8.1.0, SGIRleDecode has a 4-byte buffer over-read when decoding crafted SGI RLE image files because offsets and length tables are mishandled.

References

ADVISORY

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6BYVI5G44MRIPERKYDQEL3S3YQCZTVHE/

ADVISORY

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/BF553AMNNNBW7SH4IM4MNE4M6GNZQ7YD/

WEB

https://pillow.readthedocs.io/en/stable/releasenotes/index.html

ADVISORY

https://www.cve.org/CVERecord?id=CVE-2020-35655

CVSS Analysis

CVSS v3.1

5.4