Pillow Out-of-bounds Read

보통 5.4CVE-2020-35655 · BIT-pillow-2020-35655 · GHSA-hf64-x4gq-p99h · Published 12/01/2021 · updated 17/06/2026

요약

CVE-2020-35655은(는) pillow, pillow (python)에 영향을 주는 보통 (CVSS 5.4) 취약점입니다.
향후 30일 내 악용 확률(EPSS): 1.7%, 전체 취약점의 76.7%보다 높음.
조치: 8.1.0 이상으로 업데이트하세요.

Package	Affected versions	Patched versions
pillow PyPI	`≥ 4.3.0, < 8.1.0`	`8.1.0`
pillow python	`≥ 4.3.0, < 8.1.0`	`8.1.0`

Description

In Pillow before 8.1.0, SGIRleDecode has a 4-byte buffer over-read when decoding crafted SGI RLE image files because offsets and length tables are mishandled.

NVD description

In Pillow before 8.1.0, SGIRleDecode has a 4-byte buffer over-read when decoding crafted SGI RLE image files because offsets and length tables are mishandled.

References

pillow의 다른 취약점

모두 보기 →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free