Vulnerabilities > CVE-2020-5312 - Classic Buffer Overflow vulnerability in multiple products

047910
CVSS 9.8 - CRITICAL
Attack vector
NETWORK
Attack complexity
LOW
Privileges required
NONE
Confidentiality impact
HIGH
Integrity impact
HIGH
Availability impact
HIGH
network
low complexity
python
canonical
debian
fedoraproject
CWE-120
critical
nessus

Summary

libImaging/PcxDecode.c in Pillow before 6.2.2 has a PCX P mode buffer overflow.

Common Attack Pattern Enumeration and Classification (CAPEC)

  • Buffer Overflow via Environment Variables
    This attack pattern involves causing a buffer overflow through manipulation of environment variables. Once the attacker finds that they can modify an environment variable, they may try to overflow associated buffers. This attack leverages implicit trust often placed in environment variables.
  • Overflow Buffers
    Buffer Overflow attacks target improper or missing bounds checking on buffer operations, typically triggered by input injected by an attacker. As a consequence, an attacker is able to write past the boundaries of allocated buffer regions in memory, causing a program crash or potentially redirection of execution as per the attackers' choice.
  • Client-side Injection-induced Buffer Overflow
    This type of attack exploits a buffer overflow vulnerability in targeted client software through injection of malicious content from a custom-built hostile service.
  • Filter Failure through Buffer Overflow
    In this attack, the idea is to cause an active filter to fail by causing an oversized transaction. An attacker may try to feed overly long input strings to the program in an attempt to overwhelm the filter (by causing a buffer overflow) and hoping that the filter does not fail securely (i.e. the user input is let into the system unfiltered).
  • MIME Conversion
    An attacker exploits a weakness in the MIME conversion routine to cause a buffer overflow and gain control over the mail server machine. The MIME system is designed to allow various different information formats to be interpreted and sent via e-mail. Attack points exist when data are converted to MIME compatible format and back.

Nessus

  • NASL familyUbuntu Local Security Checks
    NASL idUBUNTU_USN-4272-1.NASL
    descriptionIt was discovered that Pillow incorrectly handled certain images. An attacker could possibly use this issue to cause a denial of service. (CVE-2019-16865, CVE-2019-19911) It was discovered that Pillow incorrectly handled certain images. An attacker could possibly use this issue to execute arbitrary code. (CVE-2020-5312) It was discovered that Pillow incorrectly handled certain TIFF images. An attacker could possibly use this issue to cause a crash. This issue only affected Ubuntu 19.10. (CVE-2020-5310) It was discovered that Pillow incorrectly handled certain SGI images. An attacker could possibly use this issue to execute arbitrary code or cause a crash. This issue only affected Ubuntu 18.04 and Ubuntu 19.10. (CVE-2020-5311) It was discovered that Pillow incorrectly handled certain PCX images. An attackter could possibly use this issue to execute arbitrary code or cause a crash. (CVE-2020-5312) It was discovered that Pillow incorrectly handled certain Flip images. An attacker could possibly use this issue to execute arbitrary code or cause a crash. (CVE-2020-5313). Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
    last seen2020-06-01
    modified2020-06-02
    plugin id133550
    published2020-02-07
    reporterUbuntu Security Notice (C) 2020 Canonical, Inc. / NASL script (C) 2020 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/133550
    titleUbuntu 16.04 LTS / 18.04 LTS / 19.10 : pillow vulnerabilities (USN-4272-1)
    code
    #
    # (C) Tenable Network Security, Inc.
    #
    # The descriptive text and package checks in this plugin were
    # extracted from Ubuntu Security Notice USN-4272-1. The text 
    # itself is copyright (C) Canonical, Inc. See 
    # <http://www.ubuntu.com/usn/>. Ubuntu(R) is a registered 
    # trademark of Canonical, Inc.
    #
    
    include("compat.inc");
    
    if (description)
    {
      script_id(133550);
      script_version("1.3");
      script_set_attribute(attribute:"plugin_modification_date", value:"2020/07/14");
    
      script_cve_id("CVE-2019-16865", "CVE-2019-19911", "CVE-2020-5310", "CVE-2020-5311", "CVE-2020-5312", "CVE-2020-5313");
      script_xref(name:"USN", value:"4272-1");
    
      script_name(english:"Ubuntu 16.04 LTS / 18.04 LTS / 19.10 : pillow vulnerabilities (USN-4272-1)");
      script_summary(english:"Checks dpkg output for updated packages.");
    
      script_set_attribute(
        attribute:"synopsis",
        value:
    "The remote Ubuntu host is missing one or more security-related
    patches."
      );
      script_set_attribute(
        attribute:"description",
        value:
    "It was discovered that Pillow incorrectly handled certain images. An
    attacker could possibly use this issue to cause a denial of service.
    (CVE-2019-16865, CVE-2019-19911)
    
    It was discovered that Pillow incorrectly handled certain images. An
    attacker could possibly use this issue to execute arbitrary code.
    (CVE-2020-5312)
    
    It was discovered that Pillow incorrectly handled certain TIFF images.
    An attacker could possibly use this issue to cause a crash. This issue
    only affected Ubuntu 19.10. (CVE-2020-5310)
    
    It was discovered that Pillow incorrectly handled certain SGI images.
    An attacker could possibly use this issue to execute arbitrary code or
    cause a crash. This issue only affected Ubuntu 18.04 and Ubuntu 19.10.
    (CVE-2020-5311)
    
    It was discovered that Pillow incorrectly handled certain PCX images.
    An attackter could possibly use this issue to execute arbitrary code
    or cause a crash. (CVE-2020-5312)
    
    It was discovered that Pillow incorrectly handled certain Flip images.
    An attacker could possibly use this issue to execute arbitrary code or
    cause a crash. (CVE-2020-5313).
    
    Note that Tenable Network Security has extracted the preceding
    description block directly from the Ubuntu security advisory. Tenable
    has attempted to automatically clean and format it as much as possible
    without introducing additional issues."
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://usn.ubuntu.com/4272-1/"
      );
      script_set_attribute(attribute:"solution", value:"Update the affected packages.");
      script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P");
      script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
      script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H");
      script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C");
      script_set_attribute(attribute:"cvss_score_source", value:"CVE-2020-5312");
      script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
    
      script_set_attribute(attribute:"plugin_type", value:"local");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:canonical:ubuntu_linux:python-imaging");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:canonical:ubuntu_linux:python-pil");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:canonical:ubuntu_linux:python3-imaging");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:canonical:ubuntu_linux:python3-pil");
      script_set_attribute(attribute:"cpe", value:"cpe:/o:canonical:ubuntu_linux:14.04");
      script_set_attribute(attribute:"cpe", value:"cpe:/o:canonical:ubuntu_linux:16.04");
      script_set_attribute(attribute:"cpe", value:"cpe:/o:canonical:ubuntu_linux:18.04:-:lts");
      script_set_attribute(attribute:"cpe", value:"cpe:/o:canonical:ubuntu_linux:19.10");
    
      script_set_attribute(attribute:"vuln_publication_date", value:"2019/10/04");
      script_set_attribute(attribute:"patch_publication_date", value:"2020/02/06");
      script_set_attribute(attribute:"plugin_publication_date", value:"2020/02/07");
      script_set_attribute(attribute:"generated_plugin", value:"current");
      script_end_attributes();
    
      script_category(ACT_GATHER_INFO);
      script_copyright(english:"Ubuntu Security Notice (C) 2020 Canonical, Inc. / NASL script (C) 2020 and is owned by Tenable, Inc. or an Affiliate thereof.");
      script_family(english:"Ubuntu Local Security Checks");
    
      script_dependencies("ssh_get_info.nasl");
      script_require_keys("Host/cpu", "Host/Ubuntu", "Host/Ubuntu/release", "Host/Debian/dpkg-l");
    
      exit(0);
    }
    
    
    include("audit.inc");
    include("ubuntu.inc");
    include("misc_func.inc");
    
    if ( ! get_kb_item("Host/local_checks_enabled") ) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
    release = get_kb_item("Host/Ubuntu/release");
    if ( isnull(release) ) audit(AUDIT_OS_NOT, "Ubuntu");
    release = chomp(release);
    if (! preg(pattern:"^(14\.04|16\.04|18\.04|19\.10)$", string:release)) audit(AUDIT_OS_NOT, "Ubuntu 14.04 / 16.04 / 18.04 / 19.10", "Ubuntu " + release);
    if ( ! get_kb_item("Host/Debian/dpkg-l") ) audit(AUDIT_PACKAGE_LIST_MISSING);
    
    cpu = get_kb_item("Host/cpu");
    if (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);
    if ("x86_64" >!< cpu && cpu !~ "^i[3-6]86$") audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, "Ubuntu", cpu);
    
    flag = 0;
    
    if (ubuntu_check(osver:"16.04", pkgname:"python-imaging", pkgver:"3.1.2-0ubuntu1.3")) flag++;
    if (ubuntu_check(osver:"16.04", pkgname:"python-pil", pkgver:"3.1.2-0ubuntu1.3")) flag++;
    if (ubuntu_check(osver:"16.04", pkgname:"python3-pil", pkgver:"3.1.2-0ubuntu1.3")) flag++;
    if (ubuntu_check(osver:"18.04", pkgname:"python-pil", pkgver:"5.1.0-1ubuntu0.2")) flag++;
    if (ubuntu_check(osver:"18.04", pkgname:"python3-pil", pkgver:"5.1.0-1ubuntu0.2")) flag++;
    if (ubuntu_check(osver:"19.10", pkgname:"python-pil", pkgver:"6.1.0-1ubuntu0.2")) flag++;
    if (ubuntu_check(osver:"19.10", pkgname:"python3-pil", pkgver:"6.1.0-1ubuntu0.2")) flag++;
    
    if (flag)
    {
      security_report_v4(
        port       : 0,
        severity   : SECURITY_HOLE,
        extra      : ubuntu_report_get()
      );
      exit(0);
    }
    else
    {
      tested = ubuntu_pkg_tests_get();
      if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
      else audit(AUDIT_PACKAGE_NOT_INSTALLED, "python-imaging / python-pil / python3-imaging / python3-pil");
    }
    
  • NASL familyFedora Local Security Checks
    NASL idFEDORA_2020-5CDBB19CCA.NASL
    descriptionBackport patches for CVE-2020-5313, CVE-2020-5312, CVE-2020-5311, CVE-2020-5310, CVE-2019-19911 Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
    last seen2020-03-18
    modified2020-02-24
    plugin id133887
    published2020-02-24
    reporterThis script is Copyright (C) 2020 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/133887
    titleFedora 30 : python-pillow (2020-5cdbb19cca)
    code
    #
    # (C) Tenable Network Security, Inc.
    #
    # The descriptive text and package checks in this plugin were  
    # extracted from Fedora Security Advisory FEDORA-2020-5cdbb19cca.
    #
    
    include("compat.inc");
    
    if (description)
    {
      script_id(133887);
      script_version("1.3");
      script_set_attribute(attribute:"plugin_modification_date", value:"2020/07/14");
    
      script_cve_id("CVE-2019-19911", "CVE-2020-5310", "CVE-2020-5311", "CVE-2020-5312", "CVE-2020-5313");
      script_xref(name:"FEDORA", value:"2020-5cdbb19cca");
    
      script_name(english:"Fedora 30 : python-pillow (2020-5cdbb19cca)");
      script_summary(english:"Checks rpm output for the updated package.");
    
      script_set_attribute(
        attribute:"synopsis",
        value:"The remote Fedora host is missing a security update."
      );
      script_set_attribute(
        attribute:"description",
        value:
    "Backport patches for CVE-2020-5313, CVE-2020-5312, CVE-2020-5311,
    CVE-2020-5310, CVE-2019-19911
    
    Note that Tenable Network Security has extracted the preceding
    description block directly from the Fedora update system website.
    Tenable has attempted to automatically clean and format it as much as
    possible without introducing additional issues."
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://bodhi.fedoraproject.org/updates/FEDORA-2020-5cdbb19cca"
      );
      script_set_attribute(
        attribute:"solution",
        value:"Update the affected python-pillow package."
      );
      script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P");
      script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
      script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H");
      script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C");
      script_set_attribute(attribute:"cvss_score_source", value:"CVE-2020-5312");
      script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
    
      script_set_attribute(attribute:"plugin_type", value:"local");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:fedoraproject:fedora:python-pillow");
      script_set_attribute(attribute:"cpe", value:"cpe:/o:fedoraproject:fedora:30");
    
      script_set_attribute(attribute:"vuln_publication_date", value:"2020/01/03");
      script_set_attribute(attribute:"patch_publication_date", value:"2020/02/22");
      script_set_attribute(attribute:"plugin_publication_date", value:"2020/02/24");
      script_set_attribute(attribute:"generated_plugin", value:"current");
      script_end_attributes();
    
      script_category(ACT_GATHER_INFO);
      script_copyright(english:"This script is Copyright (C) 2020 and is owned by Tenable, Inc. or an Affiliate thereof.");
      script_family(english:"Fedora Local Security Checks");
    
      script_dependencies("ssh_get_info.nasl");
      script_require_keys("Host/local_checks_enabled", "Host/RedHat/release", "Host/RedHat/rpm-list");
    
      exit(0);
    }
    
    
    include("audit.inc");
    include("global_settings.inc");
    include("rpm.inc");
    
    
    if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
    release = get_kb_item("Host/RedHat/release");
    if (isnull(release) || "Fedora" >!< release) audit(AUDIT_OS_NOT, "Fedora");
    os_ver = pregmatch(pattern: "Fedora.*release ([0-9]+)", string:release);
    if (isnull(os_ver)) audit(AUDIT_UNKNOWN_APP_VER, "Fedora");
    os_ver = os_ver[1];
    if (! preg(pattern:"^30([^0-9]|$)", string:os_ver)) audit(AUDIT_OS_NOT, "Fedora 30", "Fedora " + os_ver);
    
    if (!get_kb_item("Host/RedHat/rpm-list")) audit(AUDIT_PACKAGE_LIST_MISSING);
    
    
    cpu = get_kb_item("Host/cpu");
    if (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);
    if ("x86_64" >!< cpu && cpu !~ "^i[3-6]86$") audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, "Fedora", cpu);
    
    
    flag = 0;
    if (rpm_check(release:"FC30", reference:"python-pillow-5.4.1-4.fc30")) flag++;
    
    
    if (flag)
    {
      security_report_v4(
        port       : 0,
        severity   : SECURITY_HOLE,
        extra      : rpm_report_get()
      );
      exit(0);
    }
    else
    {
      tested = pkg_tests_get();
      if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
      else audit(AUDIT_PACKAGE_NOT_INSTALLED, "python-pillow");
    }
    
  • NASL familyOracle Linux Local Security Checks
    NASL idORACLELINUX_ELSA-2020-0580.NASL
    descriptionFrom Red Hat Security Advisory 2020:0580 : An update for python-pillow is now available for Red Hat Enterprise Linux 8. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. The python-pillow packages contain a Python image processing library that provides extensive file format support, an efficient internal representation, and powerful image-processing capabilities. Security Fix(es) : * python-pillow: out-of-bounds write in expandrow in libImaging/ SgiRleDecode.c (CVE-2020-5311) * python-pillow: improperly restricted operations on memory buffer in libImaging/PcxDecode.c (CVE-2020-5312) * python-pillow: reading specially crafted image files leads to allocation of large amounts of memory and denial of service (CVE-2019-16865) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
    last seen2020-03-18
    modified2020-02-26
    plugin id134059
    published2020-02-26
    reporterThis script is Copyright (C) 2020 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/134059
    titleOracle Linux 8 : python-pillow (ELSA-2020-0580)
    code
    #
    # (C) Tenable Network Security, Inc.
    #
    # The descriptive text and package checks in this plugin were
    # extracted from Red Hat Security Advisory RHSA-2020:0580 and 
    # Oracle Linux Security Advisory ELSA-2020-0580 respectively.
    #
    
    include("compat.inc");
    
    if (description)
    {
      script_id(134059);
      script_version("1.3");
      script_set_attribute(attribute:"plugin_modification_date", value:"2020/07/14");
    
      script_cve_id("CVE-2019-16865", "CVE-2020-5311", "CVE-2020-5312");
      script_xref(name:"RHSA", value:"2020:0580");
    
      script_name(english:"Oracle Linux 8 : python-pillow (ELSA-2020-0580)");
      script_summary(english:"Checks rpm output for the updated package");
    
      script_set_attribute(
        attribute:"synopsis",
        value:"The remote Oracle Linux host is missing a security update."
      );
      script_set_attribute(
        attribute:"description",
        value:
    "From Red Hat Security Advisory 2020:0580 :
    
    An update for python-pillow is now available for Red Hat Enterprise
    Linux 8.
    
    Red Hat Product Security has rated this update as having a security
    impact of Important. A Common Vulnerability Scoring System (CVSS) base
    score, which gives a detailed severity rating, is available for each
    vulnerability from the CVE link(s) in the References section.
    
    The python-pillow packages contain a Python image processing library
    that provides extensive file format support, an efficient internal
    representation, and powerful image-processing capabilities.
    
    Security Fix(es) :
    
    * python-pillow: out-of-bounds write in expandrow in libImaging/
    SgiRleDecode.c (CVE-2020-5311)
    
    * python-pillow: improperly restricted operations on memory buffer in
    libImaging/PcxDecode.c (CVE-2020-5312)
    
    * python-pillow: reading specially crafted image files leads to
    allocation of large amounts of memory and denial of service
    (CVE-2019-16865)
    
    For more details about the security issue(s), including the impact, a
    CVSS score, acknowledgments, and other related information, refer to
    the CVE page(s) listed in the References section."
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://oss.oracle.com/pipermail/el-errata/2020-February/009660.html"
      );
      script_set_attribute(
        attribute:"solution",
        value:"Update the affected python-pillow package."
      );
      script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P");
      script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
      script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H");
      script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C");
      script_set_attribute(attribute:"cvss_score_source", value:"CVE-2020-5312");
      script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
    
      script_set_attribute(attribute:"plugin_type", value:"local");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:oracle:linux:python3-pillow");
      script_set_attribute(attribute:"cpe", value:"cpe:/o:oracle:linux:8");
    
      script_set_attribute(attribute:"vuln_publication_date", value:"2019/10/04");
      script_set_attribute(attribute:"patch_publication_date", value:"2020/02/25");
      script_set_attribute(attribute:"plugin_publication_date", value:"2020/02/26");
      script_set_attribute(attribute:"generated_plugin", value:"current");
      script_end_attributes();
    
      script_category(ACT_GATHER_INFO);
      script_copyright(english:"This script is Copyright (C) 2020 and is owned by Tenable, Inc. or an Affiliate thereof.");
      script_family(english:"Oracle Linux Local Security Checks");
    
      script_dependencies("ssh_get_info.nasl");
      script_require_keys("Host/local_checks_enabled", "Host/OracleLinux", "Host/RedHat/release", "Host/RedHat/rpm-list");
    
      exit(0);
    }
    
    
    include("audit.inc");
    include("global_settings.inc");
    include("rpm.inc");
    
    
    if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
    if (!get_kb_item("Host/OracleLinux")) audit(AUDIT_OS_NOT, "Oracle Linux");
    release = get_kb_item("Host/RedHat/release");
    if (isnull(release) || !pregmatch(pattern: "Oracle (?:Linux Server|Enterprise Linux)", string:release)) audit(AUDIT_OS_NOT, "Oracle Linux");
    os_ver = pregmatch(pattern: "Oracle (?:Linux Server|Enterprise Linux) .*release ([0-9]+(\.[0-9]+)?)", string:release);
    if (isnull(os_ver)) audit(AUDIT_UNKNOWN_APP_VER, "Oracle Linux");
    os_ver = os_ver[1];
    if (! preg(pattern:"^8([^0-9]|$)", string:os_ver)) audit(AUDIT_OS_NOT, "Oracle Linux 8", "Oracle Linux " + os_ver);
    
    if (!get_kb_item("Host/RedHat/rpm-list")) audit(AUDIT_PACKAGE_LIST_MISSING);
    
    cpu = get_kb_item("Host/cpu");
    if (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);
    if ("x86_64" >!< cpu && cpu !~ "^i[3-6]86$") audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, "Oracle Linux", cpu);
    if ("x86_64" >!< cpu) audit(AUDIT_ARCH_NOT, "x86_64", cpu);
    
    flag = 0;
    if (rpm_check(release:"EL8", cpu:"x86_64", reference:"python3-pillow-5.1.1-10.el8_1")) flag++;
    
    
    if (flag)
    {
      if (report_verbosity > 0) security_hole(port:0, extra:rpm_report_get());
      else security_hole(0);
      exit(0);
    }
    else
    {
      tested = pkg_tests_get();
      if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
      else audit(AUDIT_PACKAGE_NOT_INSTALLED, "python3-pillow");
    }
    
  • NASL familyRed Hat Local Security Checks
    NASL idREDHAT-RHSA-2020-0580.NASL
    descriptionAn update for python-pillow is now available for Red Hat Enterprise Linux 8. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. The python-pillow packages contain a Python image processing library that provides extensive file format support, an efficient internal representation, and powerful image-processing capabilities. Security Fix(es) : * python-pillow: out-of-bounds write in expandrow in libImaging/ SgiRleDecode.c (CVE-2020-5311) * python-pillow: improperly restricted operations on memory buffer in libImaging/PcxDecode.c (CVE-2020-5312) * python-pillow: reading specially crafted image files leads to allocation of large amounts of memory and denial of service (CVE-2019-16865) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
    last seen2020-03-18
    modified2020-02-25
    plugin id134034
    published2020-02-25
    reporterThis script is Copyright (C) 2020 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/134034
    titleRHEL 8 : python-pillow (RHSA-2020:0580)
    code
    #
    # (C) Tenable Network Security, Inc.
    #
    # The descriptive text and package checks in this plugin were  
    # extracted from Red Hat Security Advisory RHSA-2020:0580. The text 
    # itself is copyright (C) Red Hat, Inc.
    #
    
    include("compat.inc");
    
    if (description)
    {
      script_id(134034);
      script_version("1.2");
      script_set_attribute(attribute:"plugin_modification_date", value:"2020/02/27");
    
      script_cve_id("CVE-2019-16865", "CVE-2020-5311", "CVE-2020-5312");
      script_xref(name:"RHSA", value:"2020:0580");
    
      script_name(english:"RHEL 8 : python-pillow (RHSA-2020:0580)");
      script_summary(english:"Checks the rpm output for the updated packages");
    
      script_set_attribute(
        attribute:"synopsis", 
        value:"The remote Red Hat host is missing one or more security updates."
      );
      script_set_attribute(
        attribute:"description", 
        value:
    "An update for python-pillow is now available for Red Hat Enterprise
    Linux 8.
    
    Red Hat Product Security has rated this update as having a security
    impact of Important. A Common Vulnerability Scoring System (CVSS) base
    score, which gives a detailed severity rating, is available for each
    vulnerability from the CVE link(s) in the References section.
    
    The python-pillow packages contain a Python image processing library
    that provides extensive file format support, an efficient internal
    representation, and powerful image-processing capabilities.
    
    Security Fix(es) :
    
    * python-pillow: out-of-bounds write in expandrow in libImaging/
    SgiRleDecode.c (CVE-2020-5311)
    
    * python-pillow: improperly restricted operations on memory buffer in
    libImaging/PcxDecode.c (CVE-2020-5312)
    
    * python-pillow: reading specially crafted image files leads to
    allocation of large amounts of memory and denial of service
    (CVE-2019-16865)
    
    For more details about the security issue(s), including the impact, a
    CVSS score, acknowledgments, and other related information, refer to
    the CVE page(s) listed in the References section."
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://access.redhat.com/errata/RHSA-2020:0580"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://access.redhat.com/security/cve/cve-2019-16865"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://access.redhat.com/security/cve/cve-2020-5311"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://access.redhat.com/security/cve/cve-2020-5312"
      );
      script_set_attribute(attribute:"solution", value:"Update the affected packages.");
      script_set_cvss_base_vector("CVSS2#AV:N/AC:M/Au:N/C:P/I:P/A:P");
      script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
      script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H");
      script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C");
      script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
    
      script_set_attribute(attribute:"plugin_type", value:"local");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:python-pillow-debuginfo");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:python-pillow-debugsource");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:python3-pillow");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:python3-pillow-debuginfo");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:python3-pillow-tk-debuginfo");
      script_set_attribute(attribute:"cpe", value:"cpe:/o:redhat:enterprise_linux:8");
      script_set_attribute(attribute:"cpe", value:"cpe:/o:redhat:enterprise_linux:8.1");
    
      script_set_attribute(attribute:"vuln_publication_date", value:"2019/10/04");
      script_set_attribute(attribute:"patch_publication_date", value:"2020/02/24");
      script_set_attribute(attribute:"plugin_publication_date", value:"2020/02/25");
      script_set_attribute(attribute:"generated_plugin", value:"current");
      script_end_attributes();
    
      script_category(ACT_GATHER_INFO);
      script_copyright(english:"This script is Copyright (C) 2020 and is owned by Tenable, Inc. or an Affiliate thereof.");
      script_family(english:"Red Hat Local Security Checks");
    
      script_dependencies("ssh_get_info.nasl");
      script_require_keys("Host/local_checks_enabled", "Host/RedHat/release", "Host/RedHat/rpm-list", "Host/cpu");
    
      exit(0);
    }
    
    
    include("audit.inc");
    include("global_settings.inc");
    include("misc_func.inc");
    include("rpm.inc");
    
    if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
    release = get_kb_item("Host/RedHat/release");
    if (isnull(release) || "Red Hat" >!< release) audit(AUDIT_OS_NOT, "Red Hat");
    os_ver = pregmatch(pattern: "Red Hat Enterprise Linux.*release ([0-9]+(\.[0-9]+)?)", string:release);
    if (isnull(os_ver)) audit(AUDIT_UNKNOWN_APP_VER, "Red Hat");
    os_ver = os_ver[1];
    if (! preg(pattern:"^8([^0-9]|$)", string:os_ver)) audit(AUDIT_OS_NOT, "Red Hat 8.x", "Red Hat " + os_ver);
    
    if (!get_kb_item("Host/RedHat/rpm-list")) audit(AUDIT_PACKAGE_LIST_MISSING);
    
    cpu = get_kb_item("Host/cpu");
    if (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);
    if ("x86_64" >!< cpu && cpu !~ "^i[3-6]86$" && "s390" >!< cpu) audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, "Red Hat", cpu);
    
    yum_updateinfo = get_kb_item("Host/RedHat/yum-updateinfo");
    if (!empty_or_null(yum_updateinfo)) 
    {
      rhsa = "RHSA-2020:0580";
      yum_report = redhat_generate_yum_updateinfo_report(rhsa:rhsa);
      if (!empty_or_null(yum_report))
      {
        security_report_v4(
          port       : 0,
          severity   : SECURITY_WARNING,
          extra      : yum_report 
        );
        exit(0);
      }
      else
      {
        audit_message = "affected by Red Hat security advisory " + rhsa;
        audit(AUDIT_OS_NOT, audit_message);
      }
    }
    else
    {
      flag = 0;
      if (rpm_check(release:"RHEL8", cpu:"s390x", reference:"python-pillow-debuginfo-5.1.1-10.el8_1")) flag++;
    
      if (rpm_check(release:"RHEL8", cpu:"x86_64", reference:"python-pillow-debuginfo-5.1.1-10.el8_1")) flag++;
    
      if (rpm_check(release:"RHEL8", cpu:"s390x", reference:"python-pillow-debugsource-5.1.1-10.el8_1")) flag++;
    
      if (rpm_check(release:"RHEL8", cpu:"x86_64", reference:"python-pillow-debugsource-5.1.1-10.el8_1")) flag++;
    
      if (rpm_check(release:"RHEL8", cpu:"s390x", reference:"python3-pillow-5.1.1-10.el8_1")) flag++;
    
      if (rpm_check(release:"RHEL8", cpu:"x86_64", reference:"python3-pillow-5.1.1-10.el8_1")) flag++;
    
      if (rpm_check(release:"RHEL8", cpu:"s390x", reference:"python3-pillow-debuginfo-5.1.1-10.el8_1")) flag++;
    
      if (rpm_check(release:"RHEL8", cpu:"x86_64", reference:"python3-pillow-debuginfo-5.1.1-10.el8_1")) flag++;
    
      if (rpm_check(release:"RHEL8", cpu:"s390x", reference:"python3-pillow-tk-debuginfo-5.1.1-10.el8_1")) flag++;
    
      if (rpm_check(release:"RHEL8", cpu:"x86_64", reference:"python3-pillow-tk-debuginfo-5.1.1-10.el8_1")) flag++;
    
    
      if (flag)
      {
        security_report_v4(
          port       : 0,
          severity   : SECURITY_WARNING,
          extra      : rpm_report_get() + redhat_report_package_caveat()
        );
        exit(0);
      }
      else
      {
        tested = pkg_tests_get();
        if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
        else audit(AUDIT_PACKAGE_NOT_INSTALLED, "python-pillow-debuginfo / python-pillow-debugsource / etc");
      }
    }
    
  • NASL familyOracle Linux Local Security Checks
    NASL idORACLELINUX_ELSA-2020-0898.NASL
    descriptionFrom Red Hat Security Advisory 2020:0898 : The remote Redhat Enterprise Linux 6 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2020:0898 advisory. - python-pillow: improperly restricted operations on memory buffer in libImaging/PcxDecode.c (CVE-2020-5312) Note that Nessus has not tested for this issue but has instead relied only on the application
    last seen2020-06-06
    modified2020-03-20
    plugin id134752
    published2020-03-20
    reporterThis script is Copyright (C) 2020 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/134752
    titleOracle Linux 6 : python-imaging (ELSA-2020-0898)
    code
    #
    # (C) Tenable Network Security, Inc.
    #
    # The descriptive text and package checks in this plugin were
    # extracted from Red Hat Security Advisory RHSA-2020:0898 and 
    # Oracle Linux Security Advisory ELSA-2020-0898 respectively.
    #
    
    include("compat.inc");
    
    if (description)
    {
      script_id(134752);
      script_version("1.4");
      script_set_attribute(attribute:"plugin_modification_date", value:"2020/07/14");
    
      script_cve_id("CVE-2020-5312");
      script_xref(name:"RHSA", value:"2020:0898");
    
      script_name(english:"Oracle Linux 6 : python-imaging (ELSA-2020-0898)");
      script_summary(english:"Checks rpm output for the updated packages");
    
      script_set_attribute(
        attribute:"synopsis",
        value:"The remote Oracle Linux host is missing one or more security updates."
      );
      script_set_attribute(
        attribute:"description",
        value:
    "From Red Hat Security Advisory 2020:0898 :
    
    The remote Redhat Enterprise Linux 6 host has packages installed that are affected by a vulnerability as referenced in
    the RHSA-2020:0898 advisory.
    
      - python-pillow: improperly restricted operations on
        memory buffer in libImaging/PcxDecode.c (CVE-2020-5312)
    
    Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version
    number."
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://oss.oracle.com/pipermail/el-errata/2020-March/009745.html"
      );
      script_set_attribute(
        attribute:"solution",
        value:"Update the affected python-imaging packages."
      );
      script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P");
      script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
      script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H");
      script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C");
      script_set_attribute(attribute:"cvss_score_source", value:"CVE-2020-5312");
      script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
    
      script_set_attribute(attribute:"plugin_type", value:"local");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:oracle:linux:python-imaging");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:oracle:linux:python-imaging-devel");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:oracle:linux:python-imaging-sane");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:oracle:linux:python-imaging-tk");
      script_set_attribute(attribute:"cpe", value:"cpe:/o:oracle:linux:6");
    
      script_set_attribute(attribute:"vuln_publication_date", value:"2020/01/03");
      script_set_attribute(attribute:"patch_publication_date", value:"2020/03/19");
      script_set_attribute(attribute:"plugin_publication_date", value:"2020/03/20");
      script_set_attribute(attribute:"generated_plugin", value:"current");
      script_end_attributes();
    
      script_category(ACT_GATHER_INFO);
      script_copyright(english:"This script is Copyright (C) 2020 and is owned by Tenable, Inc. or an Affiliate thereof.");
      script_family(english:"Oracle Linux Local Security Checks");
    
      script_dependencies("ssh_get_info.nasl");
      script_require_keys("Host/local_checks_enabled", "Host/OracleLinux", "Host/RedHat/release", "Host/RedHat/rpm-list");
    
      exit(0);
    }
    
    
    include("audit.inc");
    include("global_settings.inc");
    include("rpm.inc");
    
    
    if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
    if (!get_kb_item("Host/OracleLinux")) audit(AUDIT_OS_NOT, "Oracle Linux");
    release = get_kb_item("Host/RedHat/release");
    if (isnull(release) || !pregmatch(pattern: "Oracle (?:Linux Server|Enterprise Linux)", string:release)) audit(AUDIT_OS_NOT, "Oracle Linux");
    os_ver = pregmatch(pattern: "Oracle (?:Linux Server|Enterprise Linux) .*release ([0-9]+(\.[0-9]+)?)", string:release);
    if (isnull(os_ver)) audit(AUDIT_UNKNOWN_APP_VER, "Oracle Linux");
    os_ver = os_ver[1];
    if (! preg(pattern:"^6([^0-9]|$)", string:os_ver)) audit(AUDIT_OS_NOT, "Oracle Linux 6", "Oracle Linux " + os_ver);
    
    if (!get_kb_item("Host/RedHat/rpm-list")) audit(AUDIT_PACKAGE_LIST_MISSING);
    
    cpu = get_kb_item("Host/cpu");
    if (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);
    if ("x86_64" >!< cpu && cpu !~ "^i[3-6]86$") audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, "Oracle Linux", cpu);
    
    flag = 0;
    if (rpm_check(release:"EL6", reference:"python-imaging-1.1.6-20.el6_10")) flag++;
    if (rpm_check(release:"EL6", reference:"python-imaging-devel-1.1.6-20.el6_10")) flag++;
    if (rpm_check(release:"EL6", reference:"python-imaging-sane-1.1.6-20.el6_10")) flag++;
    if (rpm_check(release:"EL6", reference:"python-imaging-tk-1.1.6-20.el6_10")) flag++;
    
    
    if (flag)
    {
      if (report_verbosity > 0) security_hole(port:0, extra:rpm_report_get());
      else security_hole(0);
      exit(0);
    }
    else
    {
      tested = pkg_tests_get();
      if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
      else audit(AUDIT_PACKAGE_NOT_INSTALLED, "python-imaging / python-imaging-devel / python-imaging-sane / etc");
    }
    
  • NASL familyRed Hat Local Security Checks
    NASL idREDHAT-RHSA-2020-0566.NASL
    descriptionAn update for python-pillow is now available for Red Hat Enterprise Linux 8.0 Update Services for SAP Solutions. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. The python-pillow packages contain a Python image processing library that provides extensive file format support, an efficient internal representation, and powerful image-processing capabilities. Security Fix(es) : * python-pillow: out-of-bounds write in expandrow in libImaging/ SgiRleDecode.c (CVE-2020-5311) * python-pillow: improperly restricted operations on memory buffer in libImaging/PcxDecode.c (CVE-2020-5312) * python-pillow: reading specially crafted image files leads to allocation of large amounts of memory and denial of service (CVE-2019-16865) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
    last seen2020-03-18
    modified2020-02-24
    plugin id133944
    published2020-02-24
    reporterThis script is Copyright (C) 2020 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/133944
    titleRHEL 8 : python-pillow (RHSA-2020:0566)
    code
    #
    # (C) Tenable Network Security, Inc.
    #
    # The descriptive text and package checks in this plugin were  
    # extracted from Red Hat Security Advisory RHSA-2020:0566. The text 
    # itself is copyright (C) Red Hat, Inc.
    #
    
    include("compat.inc");
    
    if (description)
    {
      script_id(133944);
      script_version("1.2");
      script_set_attribute(attribute:"plugin_modification_date", value:"2020/02/26");
    
      script_cve_id("CVE-2019-16865", "CVE-2020-5311", "CVE-2020-5312");
      script_xref(name:"RHSA", value:"2020:0566");
    
      script_name(english:"RHEL 8 : python-pillow (RHSA-2020:0566)");
      script_summary(english:"Checks the rpm output for the updated packages");
    
      script_set_attribute(
        attribute:"synopsis", 
        value:"The remote Red Hat host is missing one or more security updates."
      );
      script_set_attribute(
        attribute:"description", 
        value:
    "An update for python-pillow is now available for Red Hat Enterprise
    Linux 8.0 Update Services for SAP Solutions.
    
    Red Hat Product Security has rated this update as having a security
    impact of Important. A Common Vulnerability Scoring System (CVSS) base
    score, which gives a detailed severity rating, is available for each
    vulnerability from the CVE link(s) in the References section.
    
    The python-pillow packages contain a Python image processing library
    that provides extensive file format support, an efficient internal
    representation, and powerful image-processing capabilities.
    
    Security Fix(es) :
    
    * python-pillow: out-of-bounds write in expandrow in libImaging/
    SgiRleDecode.c (CVE-2020-5311)
    
    * python-pillow: improperly restricted operations on memory buffer in
    libImaging/PcxDecode.c (CVE-2020-5312)
    
    * python-pillow: reading specially crafted image files leads to
    allocation of large amounts of memory and denial of service
    (CVE-2019-16865)
    
    For more details about the security issue(s), including the impact, a
    CVSS score, acknowledgments, and other related information, refer to
    the CVE page(s) listed in the References section."
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://access.redhat.com/errata/RHSA-2020:0566"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://access.redhat.com/security/cve/cve-2019-16865"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://access.redhat.com/security/cve/cve-2020-5311"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://access.redhat.com/security/cve/cve-2020-5312"
      );
      script_set_attribute(attribute:"solution", value:"Update the affected packages.");
      script_set_cvss_base_vector("CVSS2#AV:N/AC:M/Au:N/C:P/I:P/A:P");
      script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
      script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H");
      script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C");
      script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
    
      script_set_attribute(attribute:"plugin_type", value:"local");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:python-pillow-debuginfo");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:python-pillow-debugsource");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:python3-pillow");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:python3-pillow-debuginfo");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:python3-pillow-tk-debuginfo");
      script_set_attribute(attribute:"cpe", value:"cpe:/o:redhat:enterprise_linux:8.0");
    
      script_set_attribute(attribute:"vuln_publication_date", value:"2019/10/04");
      script_set_attribute(attribute:"patch_publication_date", value:"2020/02/20");
      script_set_attribute(attribute:"plugin_publication_date", value:"2020/02/24");
      script_set_attribute(attribute:"generated_plugin", value:"current");
      script_end_attributes();
    
      script_category(ACT_GATHER_INFO);
      script_copyright(english:"This script is Copyright (C) 2020 and is owned by Tenable, Inc. or an Affiliate thereof.");
      script_family(english:"Red Hat Local Security Checks");
    
      script_dependencies("ssh_get_info.nasl");
      script_require_keys("Host/local_checks_enabled", "Host/RedHat/release", "Host/RedHat/rpm-list", "Host/cpu");
    
      exit(0);
    }
    
    
    include("audit.inc");
    include("global_settings.inc");
    include("misc_func.inc");
    include("rpm.inc");
    
    if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
    release = get_kb_item("Host/RedHat/release");
    if (isnull(release) || "Red Hat" >!< release) audit(AUDIT_OS_NOT, "Red Hat");
    os_ver = pregmatch(pattern: "Red Hat Enterprise Linux.*release ([0-9]+(\.[0-9]+)?)", string:release);
    if (isnull(os_ver)) audit(AUDIT_UNKNOWN_APP_VER, "Red Hat");
    os_ver = os_ver[1];
    if (! preg(pattern:"^8\.0([^0-9]|$)", string:os_ver)) audit(AUDIT_OS_NOT, "Red Hat 8.0", "Red Hat " + os_ver);
    
    if (!get_kb_item("Host/RedHat/rpm-list")) audit(AUDIT_PACKAGE_LIST_MISSING);
    
    cpu = get_kb_item("Host/cpu");
    if (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);
    if ("x86_64" >!< cpu && cpu !~ "^i[3-6]86$" && "s390" >!< cpu) audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, "Red Hat", cpu);
    if ("x86_64" >!< cpu) audit(AUDIT_ARCH_NOT, "x86_64", cpu);
    
    yum_updateinfo = get_kb_item("Host/RedHat/yum-updateinfo");
    if (!empty_or_null(yum_updateinfo)) 
    {
      rhsa = "RHSA-2020:0566";
      yum_report = redhat_generate_yum_updateinfo_report(rhsa:rhsa);
      if (!empty_or_null(yum_report))
      {
        security_report_v4(
          port       : 0,
          severity   : SECURITY_WARNING,
          extra      : yum_report 
        );
        exit(0);
      }
      else
      {
        audit_message = "affected by Red Hat security advisory " + rhsa;
        audit(AUDIT_OS_NOT, audit_message);
      }
    }
    else
    {
      flag = 0;
      if (rpm_check(release:"RHEL8", sp:"0", cpu:"x86_64", reference:"python-pillow-debuginfo-5.1.1-10.el8_0")) flag++;
      if (rpm_check(release:"RHEL8", sp:"0", cpu:"x86_64", reference:"python-pillow-debugsource-5.1.1-10.el8_0")) flag++;
      if (rpm_check(release:"RHEL8", sp:"0", cpu:"x86_64", reference:"python3-pillow-5.1.1-10.el8_0")) flag++;
      if (rpm_check(release:"RHEL8", sp:"0", cpu:"x86_64", reference:"python3-pillow-debuginfo-5.1.1-10.el8_0")) flag++;
      if (rpm_check(release:"RHEL8", sp:"0", cpu:"x86_64", reference:"python3-pillow-tk-debuginfo-5.1.1-10.el8_0")) flag++;
    
      if (flag)
      {
        security_report_v4(
          port       : 0,
          severity   : SECURITY_WARNING,
          extra      : rpm_report_get() + redhat_report_package_caveat()
        );
        exit(0);
      }
      else
      {
        tested = pkg_tests_get();
        if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
        else audit(AUDIT_PACKAGE_NOT_INSTALLED, "python-pillow-debuginfo / python-pillow-debugsource / etc");
      }
    }
    
  • NASL familyNewStart CGSL Local Security Checks
    NASL idNEWSTART_CGSL_NS-SA-2020-0024_PYTHON-PILLOW.NASL
    descriptionThe remote NewStart CGSL host, running version CORE 5.04 / MAIN 5.04, has python-pillow packages installed that are affected by multiple vulnerabilities: - An issue was discovered in Pillow before 6.2.0. When reading specially crafted invalid image files, the library can either allocate very large amounts of memory or take an extremely long period of time to process the image. (CVE-2019-16865) - libImaging/PcxDecode.c in Pillow before 6.2.2 has a PCX P mode buffer overflow. (CVE-2020-5312) Note that Nessus has not tested for this issue but has instead relied only on the application
    last seen2020-06-05
    modified2020-05-27
    plugin id136903
    published2020-05-27
    reporterThis script is Copyright (C) 2020 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/136903
    titleNewStart CGSL CORE 5.04 / MAIN 5.04 : python-pillow Multiple Vulnerabilities (NS-SA-2020-0024)
    code
    #
    # (C) Tenable Network Security, Inc.
    #
    
    # The descriptive text and package checks in this plugin were
    # extracted from ZTE advisory NS-SA-2020-0024. The text
    # itself is copyright (C) ZTE, Inc.
    
    include('compat.inc');
    
    if (description)
    {
      script_id(136903);
      script_version("1.3");
      script_set_attribute(attribute:"plugin_modification_date", value:"2020/07/13");
    
      script_cve_id("CVE-2019-16865", "CVE-2020-5312");
    
      script_name(english:"NewStart CGSL CORE 5.04 / MAIN 5.04 : python-pillow Multiple Vulnerabilities (NS-SA-2020-0024)");
    
      script_set_attribute(attribute:"synopsis", value:
    "The remote machine is affected by multiple vulnerabilities.");
      script_set_attribute(attribute:"description", value:
    "The remote NewStart CGSL host, running version CORE 5.04 / MAIN 5.04, has python-pillow packages installed that are
    affected by multiple vulnerabilities:
    
      - An issue was discovered in Pillow before 6.2.0. When
        reading specially crafted invalid image files, the
        library can either allocate very large amounts of memory
        or take an extremely long period of time to process the
        image. (CVE-2019-16865)
    
      - libImaging/PcxDecode.c in Pillow before 6.2.2 has a PCX
        P mode buffer overflow. (CVE-2020-5312)
    
    Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version
    number.");
      script_set_attribute(attribute:"see_also", value:"http://security.gd-linux.com/notice/NS-SA-2020-0024");
      script_set_attribute(attribute:"solution", value:
    "Upgrade the vulnerable CGSL python-pillow packages. Note that updated packages may not be available yet. Please contact
    ZTE for more information.");
      script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P");
      script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
      script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H");
      script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C");
      script_set_attribute(attribute:"cvss_score_source", value:"CVE-2020-5312");
    
      script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
    
      script_set_attribute(attribute:"vuln_publication_date", value:"2019/10/04");
      script_set_attribute(attribute:"patch_publication_date", value:"2020/05/25");
      script_set_attribute(attribute:"plugin_publication_date", value:"2020/05/27");
    
      script_set_attribute(attribute:"plugin_type", value:"local");
      script_end_attributes();
    
      script_category(ACT_GATHER_INFO);
      script_family(english:"NewStart CGSL Local Security Checks");
    
      script_copyright(english:"This script is Copyright (C) 2020 and is owned by Tenable, Inc. or an Affiliate thereof.");
    
      script_dependencies("ssh_get_info.nasl");
      script_require_keys("Host/local_checks_enabled", "Host/ZTE-CGSL/release", "Host/ZTE-CGSL/rpm-list", "Host/cpu");
    
      exit(0);
    }
    
    include("audit.inc");
    include("global_settings.inc");
    include("rpm.inc");
    
    if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
    
    release = get_kb_item("Host/ZTE-CGSL/release");
    if (isnull(release) || release !~ "^CGSL (MAIN|CORE)") audit(AUDIT_OS_NOT, "NewStart Carrier Grade Server Linux");
    
    if (release !~ "CGSL CORE 5.04" &&
        release !~ "CGSL MAIN 5.04")
      audit(AUDIT_OS_NOT, 'NewStart CGSL CORE 5.04 / NewStart CGSL MAIN 5.04');
    
    if (!get_kb_item("Host/ZTE-CGSL/rpm-list")) audit(AUDIT_PACKAGE_LIST_MISSING);
    
    cpu = get_kb_item("Host/cpu");
    if (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);
    if ("x86_64" >!< cpu && cpu !~ "^i[3-6]86$") audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, "NewStart Carrier Grade Server Linux", cpu);
    
    flag = 0;
    
    pkgs = {
      "CGSL CORE 5.04": [
        "python-pillow-2.0.0-20.gitd1c6db8.el7_7",
        "python-pillow-debuginfo-2.0.0-20.gitd1c6db8.el7_7",
        "python-pillow-devel-2.0.0-20.gitd1c6db8.el7_7",
        "python-pillow-doc-2.0.0-20.gitd1c6db8.el7_7",
        "python-pillow-qt-2.0.0-20.gitd1c6db8.el7_7",
        "python-pillow-sane-2.0.0-20.gitd1c6db8.el7_7",
        "python-pillow-tk-2.0.0-20.gitd1c6db8.el7_7"
      ],
      "CGSL MAIN 5.04": [
        "python-pillow-2.0.0-20.gitd1c6db8.el7_7",
        "python-pillow-debuginfo-2.0.0-20.gitd1c6db8.el7_7",
        "python-pillow-devel-2.0.0-20.gitd1c6db8.el7_7",
        "python-pillow-doc-2.0.0-20.gitd1c6db8.el7_7",
        "python-pillow-qt-2.0.0-20.gitd1c6db8.el7_7",
        "python-pillow-sane-2.0.0-20.gitd1c6db8.el7_7",
        "python-pillow-tk-2.0.0-20.gitd1c6db8.el7_7"
      ]
    };
    pkg_list = pkgs[release];
    
    foreach (pkg in pkg_list)
      if (rpm_check(release:"ZTE " + release, reference:pkg)) flag++;
    
    if (flag)
    {
      security_report_v4(
        port       : 0,
        severity   : SECURITY_HOLE,
        extra      : rpm_report_get()
      );
      exit(0);
    }
    else
    {
      tested = pkg_tests_get();
      if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
      else audit(AUDIT_PACKAGE_NOT_INSTALLED, "python-pillow");
    }
    
  • NASL familyDebian Local Security Checks
    NASL idDEBIAN_DSA-4631.NASL
    descriptionMultiple security issues were discovered in Pillow, a Python imaging library, which could result in denial of service and potentially the execution of arbitrary code if malformed PCX, FLI, SGI or TIFF images are processed.
    last seen2020-03-17
    modified2020-02-24
    plugin id133879
    published2020-02-24
    reporterThis script is Copyright (C) 2020 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/133879
    titleDebian DSA-4631-1 : pillow - security update
    code
    #
    # (C) Tenable Network Security, Inc.
    #
    # The descriptive text and package checks in this plugin were  
    # extracted from Debian Security Advisory DSA-4631. The text 
    # itself is copyright (C) Software in the Public Interest, Inc.
    #
    
    include("compat.inc");
    
    if (description)
    {
      script_id(133879);
      script_version("1.3");
      script_set_attribute(attribute:"plugin_modification_date", value:"2020/07/14");
    
      script_cve_id("CVE-2019-16865", "CVE-2019-19911", "CVE-2020-5311", "CVE-2020-5312", "CVE-2020-5313");
      script_xref(name:"DSA", value:"4631");
    
      script_name(english:"Debian DSA-4631-1 : pillow - security update");
      script_summary(english:"Checks dpkg output for the updated package");
    
      script_set_attribute(
        attribute:"synopsis",
        value:"The remote Debian host is missing a security-related update."
      );
      script_set_attribute(
        attribute:"description",
        value:
    "Multiple security issues were discovered in Pillow, a Python imaging
    library, which could result in denial of service and potentially the
    execution of arbitrary code if malformed PCX, FLI, SGI or TIFF images
    are processed."
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://security-tracker.debian.org/tracker/source-package/pillow"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://packages.debian.org/source/stretch/pillow"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://packages.debian.org/source/buster/pillow"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://www.debian.org/security/2020/dsa-4631"
      );
      script_set_attribute(
        attribute:"solution",
        value:
    "Upgrade the pillow packages.
    
    For the oldstable distribution (stretch), these problems have been
    fixed in version 4.0.0-4+deb9u1.
    
    For the stable distribution (buster), these problems have been fixed
    in version 5.4.1-2+deb10u1."
      );
      script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P");
      script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
      script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H");
      script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C");
      script_set_attribute(attribute:"cvss_score_source", value:"CVE-2020-5312");
      script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
    
      script_set_attribute(attribute:"plugin_type", value:"local");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:pillow");
      script_set_attribute(attribute:"cpe", value:"cpe:/o:debian:debian_linux:10.0");
      script_set_attribute(attribute:"cpe", value:"cpe:/o:debian:debian_linux:9.0");
    
      script_set_attribute(attribute:"vuln_publication_date", value:"2019/10/04");
      script_set_attribute(attribute:"patch_publication_date", value:"2020/02/21");
      script_set_attribute(attribute:"plugin_publication_date", value:"2020/02/24");
      script_set_attribute(attribute:"generated_plugin", value:"current");
      script_end_attributes();
    
      script_category(ACT_GATHER_INFO);
      script_copyright(english:"This script is Copyright (C) 2020 and is owned by Tenable, Inc. or an Affiliate thereof.");
      script_family(english:"Debian Local Security Checks");
    
      script_dependencies("ssh_get_info.nasl");
      script_require_keys("Host/local_checks_enabled", "Host/Debian/release", "Host/Debian/dpkg-l");
    
      exit(0);
    }
    
    
    include("audit.inc");
    include("debian_package.inc");
    
    
    if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
    if (!get_kb_item("Host/Debian/release")) audit(AUDIT_OS_NOT, "Debian");
    if (!get_kb_item("Host/Debian/dpkg-l")) audit(AUDIT_PACKAGE_LIST_MISSING);
    
    
    flag = 0;
    if (deb_check(release:"10.0", prefix:"python-pil", reference:"5.4.1-2+deb10u1")) flag++;
    if (deb_check(release:"10.0", prefix:"python-pil-dbg", reference:"5.4.1-2+deb10u1")) flag++;
    if (deb_check(release:"10.0", prefix:"python-pil-doc", reference:"5.4.1-2+deb10u1")) flag++;
    if (deb_check(release:"10.0", prefix:"python-pil.imagetk", reference:"5.4.1-2+deb10u1")) flag++;
    if (deb_check(release:"10.0", prefix:"python-pil.imagetk-dbg", reference:"5.4.1-2+deb10u1")) flag++;
    if (deb_check(release:"10.0", prefix:"python3-pil", reference:"5.4.1-2+deb10u1")) flag++;
    if (deb_check(release:"10.0", prefix:"python3-pil-dbg", reference:"5.4.1-2+deb10u1")) flag++;
    if (deb_check(release:"10.0", prefix:"python3-pil.imagetk", reference:"5.4.1-2+deb10u1")) flag++;
    if (deb_check(release:"10.0", prefix:"python3-pil.imagetk-dbg", reference:"5.4.1-2+deb10u1")) flag++;
    if (deb_check(release:"9.0", prefix:"python-imaging", reference:"4.0.0-4+deb9u1")) flag++;
    if (deb_check(release:"9.0", prefix:"python-pil", reference:"4.0.0-4+deb9u1")) flag++;
    if (deb_check(release:"9.0", prefix:"python-pil-dbg", reference:"4.0.0-4+deb9u1")) flag++;
    if (deb_check(release:"9.0", prefix:"python-pil-doc", reference:"4.0.0-4+deb9u1")) flag++;
    if (deb_check(release:"9.0", prefix:"python-pil.imagetk", reference:"4.0.0-4+deb9u1")) flag++;
    if (deb_check(release:"9.0", prefix:"python-pil.imagetk-dbg", reference:"4.0.0-4+deb9u1")) flag++;
    if (deb_check(release:"9.0", prefix:"python3-pil", reference:"4.0.0-4+deb9u1")) flag++;
    if (deb_check(release:"9.0", prefix:"python3-pil-dbg", reference:"4.0.0-4+deb9u1")) flag++;
    if (deb_check(release:"9.0", prefix:"python3-pil.imagetk", reference:"4.0.0-4+deb9u1")) flag++;
    if (deb_check(release:"9.0", prefix:"python3-pil.imagetk-dbg", reference:"4.0.0-4+deb9u1")) flag++;
    
    if (flag)
    {
      if (report_verbosity > 0) security_hole(port:0, extra:deb_report_get());
      else security_hole(0);
      exit(0);
    }
    else audit(AUDIT_HOST_NOT, "affected");
    
  • NASL familyHuawei Local Security Checks
    NASL idEULEROS_SA-2020-1589.NASL
    descriptionAccording to the versions of the python-pillow packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - libImaging/PcxDecode.c in Pillow before 6.2.2 has a PCX P mode buffer overflow.(CVE-2020-5312) - libImaging/FliDecode.c in Pillow before 6.2.2 has an FLI buffer overflow.(CVE-2020-5313) Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
    last seen2020-06-06
    modified2020-05-26
    plugin id136867
    published2020-05-26
    reporterThis script is Copyright (C) 2020 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/136867
    titleEulerOS 2.0 SP8 : python-pillow (EulerOS-SA-2020-1589)
    code
    #
    # (C) Tenable Network Security, Inc.
    #
    
    include("compat.inc");
    
    if (description)
    {
      script_id(136867);
      script_version("1.5");
      script_set_attribute(attribute:"plugin_modification_date", value:"2020/07/14");
    
      script_cve_id(
        "CVE-2020-5312",
        "CVE-2020-5313"
      );
    
      script_name(english:"EulerOS 2.0 SP8 : python-pillow (EulerOS-SA-2020-1589)");
      script_summary(english:"Checks the rpm output for the updated packages.");
    
      script_set_attribute(attribute:"synopsis", value:
    "The remote EulerOS host is missing multiple security updates.");
      script_set_attribute(attribute:"description", value:
    "According to the versions of the python-pillow packages installed,
    the EulerOS installation on the remote host is affected by the
    following vulnerabilities :
    
      - libImaging/PcxDecode.c in Pillow before 6.2.2 has a PCX
        P mode buffer overflow.(CVE-2020-5312)
    
      - libImaging/FliDecode.c in Pillow before 6.2.2 has an
        FLI buffer overflow.(CVE-2020-5313)
    
    Note that Tenable Network Security has extracted the preceding
    description block directly from the EulerOS security advisory. Tenable
    has attempted to automatically clean and format it as much as possible
    without introducing additional issues.");
      # https://developer.huaweicloud.com/ict/en/site-euleros/euleros/security-advisories/EulerOS-SA-2020-1589
      script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?0aaca1cd");
      script_set_attribute(attribute:"solution", value:
    "Update the affected python-pillow packages.");
      script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P");
      script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
      script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H");
      script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C");
      script_set_attribute(attribute:"cvss_score_source", value:"CVE-2020-5312");
      script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
    
      script_set_attribute(attribute:"patch_publication_date", value:"2020/05/28");
      script_set_attribute(attribute:"plugin_publication_date", value:"2020/05/26");
    
      script_set_attribute(attribute:"plugin_type", value:"local");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:huawei:euleros:python2-pillow");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:huawei:euleros:python3-pillow");
      script_set_attribute(attribute:"cpe", value:"cpe:/o:huawei:euleros:2.0");
      script_set_attribute(attribute:"generated_plugin", value:"current");
      script_end_attributes();
    
      script_category(ACT_GATHER_INFO);
      script_family(english:"Huawei Local Security Checks");
    
      script_copyright(english:"This script is Copyright (C) 2020 and is owned by Tenable, Inc. or an Affiliate thereof.");
    
      script_dependencies("ssh_get_info.nasl");
      script_require_keys("Host/local_checks_enabled", "Host/EulerOS/release", "Host/EulerOS/rpm-list", "Host/EulerOS/sp");
      script_exclude_keys("Host/EulerOS/uvp_version");
    
      exit(0);
    }
    
    include("audit.inc");
    include("global_settings.inc");
    include("rpm.inc");
    
    if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
    
    release = get_kb_item("Host/EulerOS/release");
    if (isnull(release) || release !~ "^EulerOS") audit(AUDIT_OS_NOT, "EulerOS");
    if (release !~ "^EulerOS release 2\.0(\D|$)") audit(AUDIT_OS_NOT, "EulerOS 2.0");
    
    sp = get_kb_item("Host/EulerOS/sp");
    if (isnull(sp) || sp !~ "^(8)$") audit(AUDIT_OS_NOT, "EulerOS 2.0 SP8");
    
    uvp = get_kb_item("Host/EulerOS/uvp_version");
    if (!empty_or_null(uvp)) audit(AUDIT_OS_NOT, "EulerOS 2.0 SP8", "EulerOS UVP " + uvp);
    
    if (!get_kb_item("Host/EulerOS/rpm-list")) audit(AUDIT_PACKAGE_LIST_MISSING);
    
    cpu = get_kb_item("Host/cpu");
    if (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);
    if ("x86_64" >!< cpu && cpu !~ "^i[3-6]86$" && "aarch64" >!< cpu) audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, "EulerOS", cpu);
    if ("aarch64" >!< cpu) audit(AUDIT_ARCH_NOT, "aarch64", cpu);
    
    flag = 0;
    
    pkgs = ["python2-pillow-5.3.0-1.h2.eulerosv2r8",
            "python3-pillow-5.3.0-1.h2.eulerosv2r8"];
    
    foreach (pkg in pkgs)
      if (rpm_check(release:"EulerOS-2.0", sp:"8", reference:pkg)) flag++;
    
    if (flag)
    {
      security_report_v4(
        port       : 0,
        severity   : SECURITY_HOLE,
        extra      : rpm_report_get()
      );
      exit(0);
    }
    else
    {
      tested = pkg_tests_get();
      if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
      else audit(AUDIT_PACKAGE_NOT_INSTALLED, "python-pillow");
    }
    
  • NASL familyCentOS Local Security Checks
    NASL idCENTOS_RHSA-2020-0578.NASL
    descriptionAn update for python-pillow is now available for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. The python-pillow packages contain a Python image processing library that provides extensive file format support, an efficient internal representation, and powerful image-processing capabilities. Security Fix(es) : * python-pillow: improperly restricted operations on memory buffer in libImaging/PcxDecode.c (CVE-2020-5312) * python-pillow: reading specially crafted image files leads to allocation of large amounts of memory and denial of service (CVE-2019-16865) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
    last seen2020-03-17
    modified2020-02-27
    plugin id134091
    published2020-02-27
    reporterThis script is Copyright (C) 2020 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/134091
    titleCentOS 7 : python-pillow (CESA-2020:0578)
  • NASL familyCentOS Local Security Checks
    NASL idCENTOS_RHSA-2020-0898.NASL
    descriptionThe remote Redhat Enterprise Linux 6 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2020:0898 advisory. - python-pillow: improperly restricted operations on memory buffer in libImaging/PcxDecode.c (CVE-2020-5312) Note that Nessus has not tested for this issue but has instead relied only on the application
    last seen2020-06-06
    modified2020-03-26
    plugin id134910
    published2020-03-26
    reporterThis script is Copyright (C) 2020 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/134910
    titleCentOS 6 : python-imaging (CESA-2020:0898)
  • NASL familyAmazon Linux Local Security Checks
    NASL idAL2_ALAS-2020-1412.NASL
    descriptionA flaw was discovered in the way the python-pillow may allocate a large amount of memory or require a long time while processing specially crafted image files, possibly causing a denial of service. Applications that use the library to process untrusted files may be vulnerable to this flaw. (CVE-2019-16865) A flaw was discovered in python-pillow where it does not properly restrict operations within the bounds of a memory buffer when decoding PCX images. An application that uses python-pillow to decode untrusted images may be vulnerable to this flaw, which can allow an attacker to crash the application or potentially execute code on the system. (CVE-2020-5312)
    last seen2020-04-30
    modified2020-04-24
    plugin id135930
    published2020-04-24
    reporterThis script is Copyright (C) 2020 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/135930
    titleAmazon Linux 2 : python-pillow (ALAS-2020-1412)
  • NASL familyScientific Linux Local Security Checks
    NASL idSL_20200318_PYTHON_IMAGING_ON_SL6_X.NASL
    descriptionSecurity Fix(es) : - python-pillow: improperly restricted operations on memory buffer in libImaging/PcxDecode.c (CVE-2020-5312)
    last seen2020-03-24
    modified2020-03-19
    plugin id134694
    published2020-03-19
    reporterThis script is Copyright (C) 2020 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/134694
    titleScientific Linux Security Update : python-imaging on SL6.x i386/x86_64 (20200318)
  • NASL familyOracle Linux Local Security Checks
    NASL idORACLELINUX_ELSA-2020-0578.NASL
    descriptionFrom Red Hat Security Advisory 2020:0578 : An update for python-pillow is now available for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. The python-pillow packages contain a Python image processing library that provides extensive file format support, an efficient internal representation, and powerful image-processing capabilities. Security Fix(es) : * python-pillow: improperly restricted operations on memory buffer in libImaging/PcxDecode.c (CVE-2020-5312) * python-pillow: reading specially crafted image files leads to allocation of large amounts of memory and denial of service (CVE-2019-16865) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
    last seen2020-03-18
    modified2020-02-25
    plugin id134022
    published2020-02-25
    reporterThis script is Copyright (C) 2020 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/134022
    titleOracle Linux 7 : python-pillow (ELSA-2020-0578)
  • NASL familyRed Hat Local Security Checks
    NASL idREDHAT-RHSA-2020-0578.NASL
    descriptionAn update for python-pillow is now available for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. The python-pillow packages contain a Python image processing library that provides extensive file format support, an efficient internal representation, and powerful image-processing capabilities. Security Fix(es) : * python-pillow: improperly restricted operations on memory buffer in libImaging/PcxDecode.c (CVE-2020-5312) * python-pillow: reading specially crafted image files leads to allocation of large amounts of memory and denial of service (CVE-2019-16865) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
    last seen2020-03-18
    modified2020-02-25
    plugin id134033
    published2020-02-25
    reporterThis script is Copyright (C) 2020 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/134033
    titleRHEL 7 : python-pillow (RHSA-2020:0578)
  • NASL familyScientific Linux Local Security Checks
    NASL idSL_20200224_PYTHON_PILLOW_ON_SL7_X.NASL
    descriptionSecurity Fix(es) : python-pillow: improperly restricted operations on memory buffer in libImaging/PcxDecode.c (CVE-2020-5312) python-pillow: reading specially crafted image files leads to allocation of large amounts of memory and denial of service (CVE-2019-16865)
    last seen2020-03-18
    modified2020-02-26
    plugin id134070
    published2020-02-26
    reporterThis script is Copyright (C) 2020 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/134070
    titleScientific Linux Security Update : python-pillow on SL7.x x86_64 (20200224)
  • NASL familyFedora Local Security Checks
    NASL idFEDORA_2020-DF444E464E.NASL
    descriptionUpdate to 6.2.2, fixes CVE-2020-5313, CVE-2020-5312, CVE-2020-5311, CVE-2020-5310. Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
    last seen2020-06-01
    modified2020-06-02
    plugin id133376
    published2020-01-31
    reporterThis script is Copyright (C) 2020 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/133376
    titleFedora 31 : python-pillow (2020-df444e464e)
  • NASL familyDebian Local Security Checks
    NASL idDEBIAN_DLA-2057.NASL
    descriptionIt was discovered that there were three vulnerabilities in Pillow, an imaging library for the Python programming language : - CVE-2019-19911: Prevent a denial of service vulnerability caused by FpxImagePlugin.py calling the range function on an unvalidated 32-bit integer if the number of bands is large. - CVE-2020-5312: PCX
    last seen2020-06-01
    modified2020-06-02
    plugin id132681
    published2020-01-07
    reporterThis script is Copyright (C) 2020 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/132681
    titleDebian DLA-2057-1 : pillow security update
  • NASL familyRed Hat Local Security Checks
    NASL idREDHAT-RHSA-2020-0898.NASL
    descriptionThe remote Redhat Enterprise Linux 6 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2020:0898 advisory. - python-pillow: improperly restricted operations on memory buffer in libImaging/PcxDecode.c (CVE-2020-5312) Note that Nessus has not tested for this issue but has instead relied only on the application
    last seen2020-04-23
    modified2020-03-23
    plugin id134832
    published2020-03-23
    reporterThis script is Copyright (C) 2020 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/134832
    titleRHEL 6 : python-imaging (RHSA-2020:0898)
  • NASL familyFreeBSD Local Security Checks
    NASL idFREEBSD_PKG_0700E76C3EB011EA84783085A9A95629.NASL
    descriptionPillow developers report : This release addresses several security problems, as well as addressing CVE-2019-19911. CVE-2019-19911 is regarding FPX images. If an image reports that it has a large number of bands, a large amount of resources will be used when trying to process the image. This is fixed by limiting the number of bands to those usable by Pillow. Buffer overruns were found when processing an SGI, PCX or FLI image. Checks have been added to prevent this. Overflow checks have been added when calculating the size of a memory block to be reallocated in the processing of a TIFF image.
    last seen2020-06-01
    modified2020-06-02
    plugin id133243
    published2020-01-27
    reporterThis script is Copyright (C) 2020 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/133243
    titleFreeBSD : Pillow -- Multiple vulnerabilities (0700e76c-3eb0-11ea-8478-3085a9a95629)
  • NASL familyHuawei Local Security Checks
    NASL idEULEROS_SA-2020-1532.NASL
    descriptionAccording to the versions of the python-pillow package installed, the EulerOS Virtualization for ARM 64 installation on the remote host is affected by the following vulnerabilities : - Integer overflow in the ImagingResampleHorizontal function in libImaging/Resample.c in Pillow before 3.1.1 allows remote attackers to have unspecified impact via negative values of the new size, which triggers a heap-based buffer overflow.(CVE-2016-4009) - An issue was discovered in urllib2 in Python 2.x through 2.7.17 and urllib in Python 3.x through 3.8.0. CRLF injection is possible if the attacker controls a url parameter, as demonstrated by the first argument to urllib.request.urlopen with \r\n (specifically in the host component of a URL) followed by an HTTP header. This is similar to the CVE-2019-9740 query string issue and the CVE-2019-9947 path string issue. (This is not exploitable when glibc has CVE-2016-10739 fixed.)(CVE-2014-3589) - Python Image Library (PIL) 1.1.7 and earlier and Pillow 2.3 might allow remote attackers to execute arbitrary commands via shell metacharacters in unspecified vectors related to CVE-2014-1932, possibly JpegImagePlugin.py.(CVE-2014-3007) - The documentation XML-RPC server in Python through 2.7.16, 3.x through 3.6.9, and 3.7.x through 3.7.4 has XSS via the server_title field. This occurs in Lib/DocXMLRPCServer.py in Python 2.x, and in Lib/xmlrpc/server.py in Python 3.x. If set_server_title is called with untrusted input, arbitrary JavaScript can be delivered to clients that visit the http URL for this server.(CVE-2014-1933) - Directory traversal vulnerability in the (1) extract and (2) extractall functions in the tarfile module in Python allows user-assisted remote attackers to overwrite arbitrary files via a .. (dot dot) sequence in filenames in a TAR archive, a related issue to CVE-2001-1267.(CVE-2014-1932) - An issue was discovered in Pillow before 6.2.0. When reading specially crafted invalid image files, the library can either allocate very large amounts of memory or take an extremely long period of time to process the image.(CVE-2019-16865) - libImaging/FliDecode.c in Pillow before 6.2.2 has an FLI buffer overflow.(CVE-2020-5313) - libImaging/PcxDecode.c in Pillow before 6.2.2 has a PCX P mode buffer overflow.(CVE-2020-5312) Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
    last seen2020-05-08
    modified2020-05-01
    plugin id136235
    published2020-05-01
    reporterThis script is Copyright (C) 2020 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/136235
    titleEulerOS Virtualization for ARM 64 3.0.2.0 : python-pillow (EulerOS-SA-2020-1532)
  • NASL familyHuawei Local Security Checks
    NASL idEULEROS_SA-2020-1322.NASL
    descriptionAccording to the version of the python-pillow package installed, the EulerOS installation on the remote host is affected by the following vulnerability : - libImaging/PcxDecode.c in Pillow before 6.2.2 has a PCX P mode buffer overflow.(CVE-2020-5312) Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
    last seen2020-05-06
    modified2020-03-23
    plugin id134813
    published2020-03-23
    reporterThis script is Copyright (C) 2020 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/134813
    titleEulerOS 2.0 SP5 : python-pillow (EulerOS-SA-2020-1322)

Redhat

advisories
  • bugzilla
    id1789533
    titleCVE-2020-5312 python-pillow: improperly restricted operations on memory buffer in libImaging/PcxDecode.c
    oval
    OR
    • commentRed Hat Enterprise Linux must be installed
      ovaloval:com.redhat.rhba:tst:20070304026
    • AND
      • commentRed Hat Enterprise Linux 7 is installed
        ovaloval:com.redhat.rhba:tst:20150364027
      • OR
        • AND
          • commentpython-pillow-tk is earlier than 0:2.0.0-20.gitd1c6db8.el7_7
            ovaloval:com.redhat.rhsa:tst:20200578001
          • commentpython-pillow-tk is signed with Red Hat redhatrelease2 key
            ovaloval:com.redhat.rhsa:tst:20200578002
        • AND
          • commentpython-pillow-sane is earlier than 0:2.0.0-20.gitd1c6db8.el7_7
            ovaloval:com.redhat.rhsa:tst:20200578003
          • commentpython-pillow-sane is signed with Red Hat redhatrelease2 key
            ovaloval:com.redhat.rhsa:tst:20200578004
        • AND
          • commentpython-pillow-qt is earlier than 0:2.0.0-20.gitd1c6db8.el7_7
            ovaloval:com.redhat.rhsa:tst:20200578005
          • commentpython-pillow-qt is signed with Red Hat redhatrelease2 key
            ovaloval:com.redhat.rhsa:tst:20200578006
        • AND
          • commentpython-pillow-doc is earlier than 0:2.0.0-20.gitd1c6db8.el7_7
            ovaloval:com.redhat.rhsa:tst:20200578007
          • commentpython-pillow-doc is signed with Red Hat redhatrelease2 key
            ovaloval:com.redhat.rhsa:tst:20200578008
        • AND
          • commentpython-pillow-devel is earlier than 0:2.0.0-20.gitd1c6db8.el7_7
            ovaloval:com.redhat.rhsa:tst:20200578009
          • commentpython-pillow-devel is signed with Red Hat redhatrelease2 key
            ovaloval:com.redhat.rhsa:tst:20200578010
        • AND
          • commentpython-pillow is earlier than 0:2.0.0-20.gitd1c6db8.el7_7
            ovaloval:com.redhat.rhsa:tst:20200578011
          • commentpython-pillow is signed with Red Hat redhatrelease2 key
            ovaloval:com.redhat.rhsa:tst:20200578012
    rhsa
    idRHSA-2020:0578
    released2020-02-24
    severityImportant
    titleRHSA-2020:0578: python-pillow security update (Important)
  • bugzilla
    id1789535
    titleCVE-2020-5311 python-pillow: out-of-bounds write in expandrow in libImaging/SgiRleDecode.c
    oval
    OR
    • commentRed Hat Enterprise Linux must be installed
      ovaloval:com.redhat.rhba:tst:20070304026
    • AND
      • commentRed Hat Enterprise Linux 8 is installed
        ovaloval:com.redhat.rhba:tst:20193384074
      • OR
        • AND
          • commentpython-pillow-debugsource is earlier than 0:5.1.1-10.el8_1
            ovaloval:com.redhat.rhsa:tst:20200580001
          • commentpython-pillow-debugsource is signed with Red Hat redhatrelease2 key
            ovaloval:com.redhat.rhsa:tst:20200580002
        • AND
          • commentpython3-pillow is earlier than 0:5.1.1-10.el8_1
            ovaloval:com.redhat.rhsa:tst:20200580003
          • commentpython3-pillow is signed with Red Hat redhatrelease2 key
            ovaloval:com.redhat.rhsa:tst:20200580004
    rhsa
    idRHSA-2020:0580
    released2020-02-24
    severityImportant
    titleRHSA-2020:0580: python-pillow security update (Important)
  • bugzilla
    id1789533
    titleCVE-2020-5312 python-pillow: improperly restricted operations on memory buffer in libImaging/PcxDecode.c
    oval
    OR
    • commentRed Hat Enterprise Linux must be installed
      ovaloval:com.redhat.rhba:tst:20070304026
    • AND
      • commentRed Hat Enterprise Linux 6 is installed
        ovaloval:com.redhat.rhba:tst:20111656003
      • OR
        • AND
          • commentpython-imaging is earlier than 0:1.1.6-20.el6_10
            ovaloval:com.redhat.rhsa:tst:20200898001
          • commentpython-imaging is signed with Red Hat redhatrelease2 key
            ovaloval:com.redhat.rhsa:tst:20200898002
        • AND
          • commentpython-imaging-tk is earlier than 0:1.1.6-20.el6_10
            ovaloval:com.redhat.rhsa:tst:20200898003
          • commentpython-imaging-tk is signed with Red Hat redhatrelease2 key
            ovaloval:com.redhat.rhsa:tst:20200898004
        • AND
          • commentpython-imaging-sane is earlier than 0:1.1.6-20.el6_10
            ovaloval:com.redhat.rhsa:tst:20200898005
          • commentpython-imaging-sane is signed with Red Hat redhatrelease2 key
            ovaloval:com.redhat.rhsa:tst:20200898006
        • AND
          • commentpython-imaging-devel is earlier than 0:1.1.6-20.el6_10
            ovaloval:com.redhat.rhsa:tst:20200898007
          • commentpython-imaging-devel is signed with Red Hat redhatrelease2 key
            ovaloval:com.redhat.rhsa:tst:20200898008
    rhsa
    idRHSA-2020:0898
    released2020-03-18
    severityImportant
    titleRHSA-2020:0898: python-imaging security update (Important)
  • rhsa
    idRHSA-2020:0566
  • rhsa
    idRHSA-2020:0681
  • rhsa
    idRHSA-2020:0683
  • rhsa
    idRHSA-2020:0694
rpms
  • python-pillow-debuginfo-0:5.1.1-10.el8_0
  • python-pillow-debugsource-0:5.1.1-10.el8_0
  • python3-pillow-0:5.1.1-10.el8_0
  • python3-pillow-debuginfo-0:5.1.1-10.el8_0
  • python3-pillow-tk-debuginfo-0:5.1.1-10.el8_0
  • python-pillow-0:2.0.0-20.gitd1c6db8.el7_7
  • python-pillow-debuginfo-0:2.0.0-20.gitd1c6db8.el7_7
  • python-pillow-devel-0:2.0.0-20.gitd1c6db8.el7_7
  • python-pillow-doc-0:2.0.0-20.gitd1c6db8.el7_7
  • python-pillow-qt-0:2.0.0-20.gitd1c6db8.el7_7
  • python-pillow-sane-0:2.0.0-20.gitd1c6db8.el7_7
  • python-pillow-tk-0:2.0.0-20.gitd1c6db8.el7_7
  • python-pillow-debuginfo-0:5.1.1-10.el8_1
  • python-pillow-debugsource-0:5.1.1-10.el8_1
  • python3-pillow-0:5.1.1-10.el8_1
  • python3-pillow-debuginfo-0:5.1.1-10.el8_1
  • python3-pillow-tk-debuginfo-0:5.1.1-10.el8_1
  • python-imaging-0:1.1.6-20.el6_10
  • python-imaging-debuginfo-0:1.1.6-20.el6_10
  • python-imaging-devel-0:1.1.6-20.el6_10
  • python-imaging-sane-0:1.1.6-20.el6_10
  • python-imaging-tk-0:1.1.6-20.el6_10

References