Out-of-bounds Read in Pillow · CVE-2020-5313 · GitHub Advisory Database · GitHub

Out-of-bounds Read in Pillow

High severity GitHub Reviewed Published Apr 1, 2020 to the GitHub Advisory Database • Updated Sep 5, 2023

Package

Pillow (pip)

Affected versions

< 6.2.2

Patched versions

6.2.2

Description

libImaging/FliDecode.c in Pillow before 6.2.2 has an FLI buffer overflow.

References

Published by the National Vulnerability Database

Jan 3, 2020

Reviewed Apr 1, 2020

Published to the GitHub Advisory Database Apr 1, 2020

Last updated Sep 5, 2023

Severity

High

7.1

/ 10

CVSS base metrics

Attack vector

Network

Attack complexity

Low

Privileges required

None

User interaction

Required

Scope

Unchanged

Confidentiality

Low

Integrity

None

Availability

High

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H