CVE-2020-11538 Out-of-bounds read in Pillow
Out-of-bounds reads in Pillow's SGI image parser allow attackers to cause denial of service or potentially execute code via malicious files.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2020-11538?
CVE-2020-11538 is a high-severity memory corruption vulnerability in Canonical Ubuntu Linux, published on 25 Jun 2020. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
In libImaging/SgiRleDecode.c in Pillow through 7.0.0, a number of out-of-bounds reads exist in the parsing of SGI image files, a different issue than CVE-2020-5311.
Weakness: CWE-125
Which versions are affected by CVE-2020-11538?
4 open source packages ship an affected version, including pillow. It affects 3 products.
| Package | Affected | Fixed in |
|---|---|---|
pillow Bitnami | All versions | 7.0.1 |
pillow PyPI | All versions | 7.1.0 |
pillow PyPI | All versions | 7.1.0 |
pillow PyPI | All versions | 7.1.0 |
Linux distribution packages (12)
python-pillow Red Hat:rhel_e4s:8.0::appstream | All versions | 0:5.1.1-11.el8_0 |
python-pillow-debuginfo Red Hat:rhel_e4s:8.0::appstream | All versions | 0:5.1.1-11.el8_0 |
python-pillow-debugsource Red Hat:rhel_e4s:8.0::appstream | All versions | 0:5.1.1-11.el8_0 |
python3-pillow Red Hat:rhel_e4s:8.0::appstream | All versions | 0:5.1.1-11.el8_0 |
python3-pillow-debuginfo Red Hat:rhel_e4s:8.0::appstream | All versions | 0:5.1.1-11.el8_0 |
python3-pillow-tk-debuginfo Red Hat:rhel_e4s:8.0::appstream | All versions | 0:5.1.1-11.el8_0 |
python-pillow Red Hat:rhel_eus:8.1::appstream | All versions | 0:5.1.1-11.el8_1 |
python-pillow-debuginfo Red Hat:rhel_eus:8.1::appstream | All versions | 0:5.1.1-11.el8_1 |
python-pillow-debugsource Red Hat:rhel_eus:8.1::appstream | All versions | 0:5.1.1-11.el8_1 |
python3-pillow Red Hat:rhel_eus:8.1::appstream | All versions | 0:5.1.1-11.el8_1 |
python3-pillow-debuginfo Red Hat:rhel_eus:8.1::appstream | All versions | 0:5.1.1-11.el8_1 |
python3-pillow-tk-debuginfo Red Hat:rhel_eus:8.1::appstream | All versions | 0:5.1.1-11.el8_1 |
Products include Canonical Ubuntu Linux, Fedoraproject Fedora, Python Pillow.
How do I fix CVE-2020-11538?
Upgrade pillow to a fixed version for your release line: 7.0.1 or 7.1.0.
Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.
Is CVE-2020-11538 being exploited?
There is no known exploitation of CVE-2020-11538 in the wild and no public exploit code.
Other vulnerabilities in Canonical Ubuntu Linux
Sources
Also known as BIT-pillow-2020-11538, DEBIAN-CVE-2020-11538, GHSA-43fq-w8qq-v88h, PYSEC-2020-80, RHSA-2020:3299, RHSA-2020:3302 and 1 more.