The remote MiracleLinux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the AXSA:2020-206:02 advisory.

    * python-pillow: out-of-bounds write in expandrow in libImaging/SgiRleDecode.c (CVE-2020-5311)
      * python-pillow: improperly restricted operations on memory buffer in libImaging/PcxDecode.c     (CVE-2020-5312)
      * python-pillow: reading specially crafted image files leads to allocation of large amounts of memory     and denial of service (CVE-2019-16865)

Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Pillow developers report :

This release addresses several security problems, as well as addressing CVE-2019-19911.

CVE-2019-19911 is regarding FPX images. If an image reports that it has a large number of bands, a large amount of resources will be used when trying to process the image. This is fixed by limiting the number of bands to those usable by Pillow.

Buffer overruns were found when processing an SGI, PCX or FLI image.
Checks have been added to prevent this.

Overflow checks have been added when calculating the size of a memory block to be reallocated in the processing of a TIFF image.

The remote Ubuntu 16.04 LTS / 18.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-4272-1 advisory.

    It was discovered that Pillow incorrectly handled certain images. An attacker could possibly use this     issue to cause a denial of service. (CVE-2019-16865, CVE-2019-19911)

    It was discovered that Pillow incorrectly handled certain images. An attacker could possibly use this     issue to execute arbitrary code. (CVE-2020-5312)

    It was discovered that Pillow incorrectly handled certain TIFF images. An attacker could possibly use this     issue to cause a crash. This issue only affected Ubuntu 19.10. (CVE-2020-5310)

    It was discovered that Pillow incorrectly handled certain SGI images. An attacker could possibly use this     issue to execute arbitrary code or cause a crash. This issue only affected Ubuntu 18.04 and Ubuntu 19.10.
    (CVE-2020-5311)

    It was discovered that Pillow incorrectly handled certain PCX images. An attackter could possibly use this     issue to execute arbitrary code or cause a crash. (CVE-2020-5312)

    It was discovered that Pillow incorrectly handled certain Flip images. An attacker could possibly use this     issue to execute arbitrary code or cause a crash. (CVE-2020-5313)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2020:0566 advisory.

    The python-pillow packages contain a Python image processing library that provides extensive file format     support, an efficient internal representation, and powerful image-processing capabilities.

    Security Fix(es):

    * python-pillow: out-of-bounds write in expandrow in libImaging/SgiRleDecode.c (CVE-2020-5311)

    * python-pillow: improperly restricted operations on memory buffer in libImaging/PcxDecode.c     (CVE-2020-5312)

    * python-pillow: reading specially crafted image files leads to allocation of large amounts of memory and     denial of service (CVE-2019-16865)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the ELSA-2020-0580 advisory.

    - Fix for CVE-2020-5311 - out-of-bounds write in expandrow     Resolves: rhbz#1789535

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the CESA-2020:0580 advisory.

  - python-pillow: reading specially crafted image files leads to allocation of large amounts of memory and     denial of service (CVE-2019-16865)

  - python-pillow: out-of-bounds write in expandrow in libImaging/SgiRleDecode.c (CVE-2020-5311)

  - python-pillow: improperly restricted operations on memory buffer in libImaging/PcxDecode.c (CVE-2020-5312)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

According to the version of the python-pillow package installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerability :

  - libImaging/PcxDecode.c in Pillow before 6.2.2 has a PCX     P mode buffer overflow.(CVE-2020-5312)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Oracle Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2020-0578 advisory.

    - Combined fixes for CVE-2020-5312 and CVE-2019-16865     Resolves: rhbz#1789533     Resolves: rhbz#1774066

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Security Fix(es) :

  - python-pillow: improperly restricted operations on     memory buffer in libImaging/PcxDecode.c (CVE-2020-5312)

According to the versions of the python-pillow package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - Integer overflow in the ImagingResampleHorizontal     function in libImaging/Resample.c in Pillow before     3.1.1 allows remote attackers to have unspecified     impact via negative values of the new size, which     triggers a heap-based buffer overflow.(CVE-2016-4009)

  - An issue was discovered in Pillow before 6.2.0. When     reading specially crafted invalid image files, the     library can either allocate very large amounts of     memory or take an extremely long period of time to     process the image.(CVE-2019-16865)

  - libImaging/FliDecode.c in Pillow before 6.2.2 has an     FLI buffer overflow.(CVE-2020-5313)

  - libImaging/PcxDecode.c in Pillow before 6.2.2 has a PCX     P mode buffer overflow.(CVE-2020-5312)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote MiracleLinux 7 host has a package installed that is affected by multiple vulnerabilities as referenced in the AXSA:2020-4477:01 advisory.

    * python-pillow: improperly restricted operations on memory buffer in libImaging/PcxDecode.c     (CVE-2020-5312)
      * python-pillow: reading specially crafted image files leads to allocation of large amounts of memory     and denial of service (CVE-2019-16865)

Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of AOS installed on the remote host is prior to 5.17. It is, therefore, affected by multiple vulnerabilities as referenced in the NXSA-AOS-5.17 advisory.

  - A heap overflow flaw was found in the Linux kernel, all versions 3.x.x and 4.x.x before 4.18.0, in Marvell     WiFi chip driver. The vulnerability allows a remote attacker to cause a system crash, resulting in a     denial of service, or execute arbitrary code. The highest threat with this vulnerability is with the     availability of the system. If code execution occurs, the code will run with the permissions of root. This     will affect both confidentiality and integrity of files on the system. (CVE-2019-14901)

  - libImaging/PcxDecode.c in Pillow before 6.2.2 has a PCX P mode buffer overflow. (CVE-2020-5312)

  - An issue was discovered in Pillow before 6.2.0. When reading specially crafted invalid image files, the     library can either allocate very large amounts of memory or take an extremely long period of time to     process the image. (CVE-2019-16865)

  - Empty or malformed p256-ECDH public keys may trigger a segmentation fault due values being improperly     sanitized before being copied into memory and used. This vulnerability affects Firefox ESR < 60.8, Firefox     < 68, and Thunderbird < 60.8. (CVE-2019-11729)

  - When encrypting with a block cipher, if a call to NSC_EncryptUpdate was made with data smaller than the     block size, a small out of bounds write could occur. This could have caused heap corruption and a     potentially exploitable crash. This vulnerability affects Thunderbird < 68.3, Firefox ESR < 68.3, and     Firefox < 71. (CVE-2019-11745)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

According to the versions of the python-pillow packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - In Pillow before 8.1.0, PcxDecode has a buffer     over-read when decoding a crafted PCX file because the     user-supplied stride value is trusted for buffer     calculations.(CVE-2020-35653)

  - libImaging/FliDecode.c in Pillow before 6.2.2 has an     FLI buffer overflow.(CVE-2020-5313)

  - In libImaging/Jpeg2KDecode.c in Pillow before 7.1.0,     there are multiple out-of-bounds reads via a crafted     JP2 file.(CVE-2020-10994)

  - In libImaging/SgiRleDecode.c in Pillow through 7.0.0, a     number of out-of-bounds reads exist in the parsing of     SGI image files, a different issue than     CVE-2020-5311.(CVE-2020-11538)

  - There is a DoS vulnerability in Pillow before 6.2.2     caused by FpxImagePlugin.py calling the range function     on an unvalidated 32-bit integer if the number of bands     is large. On Windows running 32-bit Python, this     results in an OverflowError or MemoryError due to the 2     GB limit. However, on Linux running 64-bit Python this     results in the process being terminated by the OOM     killer.(CVE-2019-19911)

  - libImaging/TiffDecode.c in Pillow before 6.2.2 has a     TIFF decoding integer overflow, related to     realloc.(CVE-2020-5310)

  - An out-of-bounds write flaw was discovered in     python-pillow in the way SGI RLE images are decoded. An     application that uses python-pillow to decode untrusted     images may be vulnerable to this flaw, which can allow     an attacker to crash the application or potentially     execute code on the system.(CVE-2020-5311)

  - libImaging/PcxDecode.c in Pillow before 6.2.2 has a PCX     P mode buffer overflow.(CVE-2020-5312)

  - In Pillow before 7.1.0, there are two Buffer Overflows     in libImaging/TiffDecode.c.(CVE-2020-10379)

  - An issue was discovered in Pillow before 6.2.0. When     reading specially crafted invalid image files, the     library can either allocate very large amounts of     memory or take an extremely long period of time to     process the image.(CVE-2019-16865)

  - In libImaging/PcxDecode.c in Pillow before 7.1.0, an     out-of-bounds read can occur when reading PCX files     where state->shuffle is instructed to read beyond     state->buffer.(CVE-2020-10378)

  - Pillow before 7.1.0 has multiple out-of-bounds reads in     libImaging/FliDecode.c.(CVE-2020-10177)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Multiple security issues were discovered in Pillow, a Python imaging library, which could result in denial of service and potentially the execution of arbitrary code if malformed PCX, FLI, SGI or TIFF images are processed.

The remote Redhat Enterprise Linux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2020:0580 advisory.

    The python-pillow packages contain a Python image processing library that provides extensive file format     support, an efficient internal representation, and powerful image-processing capabilities.

    Security Fix(es):

    * python-pillow: out-of-bounds write in expandrow in libImaging/SgiRleDecode.c (CVE-2020-5311)

    * python-pillow: improperly restricted operations on memory buffer in libImaging/PcxDecode.c     (CVE-2020-5312)

    * python-pillow: reading specially crafted image files leads to allocation of large amounts of memory and     denial of service (CVE-2019-16865)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
294651	MiracleLinux 8 : python-pillow-5.1.1-10.el8 (AXSA:2020-206:02)	Nessus	Miracle Linux Local Security Checks	2026/1/20	2026/1/20	critical
133243	FreeBSD : Pillow -- Multiple vulnerabilities (0700e76c-3eb0-11ea-8478-3085a9a95629)	Nessus	FreeBSD Local Security Checks	2020/1/27	2020/7/14	critical
133550	Ubuntu 16.04 LTS / 18.04 LTS : Pillow vulnerabilities (USN-4272-1)	Nessus	Ubuntu Local Security Checks	2020/2/7	2025/9/3	critical
133944	RHEL 8 : python-pillow (RHSA-2020:0566)	Nessus	Red Hat Local Security Checks	2020/2/24	2024/11/7	critical
134059	Oracle Linux 8 : python-pillow (ELSA-2020-0580)	Nessus	Oracle Linux Local Security Checks	2020/2/26	2024/10/23	critical
146010	CentOS 8 : python-pillow (CESA-2020:0580)	Nessus	CentOS Local Security Checks	2021/2/1	2021/3/23	critical
141693	EulerOS Virtualization 3.0.2.2 : python-pillow (EulerOS-SA-2020-2227)	Nessus	Huawei Local Security Checks	2020/10/21	2021/1/6	critical
134022	Oracle Linux 7 : python-pillow (ELSA-2020-0578)	Nessus	Oracle Linux Local Security Checks	2020/2/25	2024/11/1	critical
134694	Scientific Linux Security Update : python-imaging on SL6.x i386/x86_64 (20200318)	Nessus	Scientific Linux Local Security Checks	2020/3/19	2020/7/14	critical
140847	EulerOS 2.0 SP3 : python-pillow (EulerOS-SA-2020-2080)	Nessus	Huawei Local Security Checks	2020/9/28	2024/2/19	critical
293842	MiracleLinux 7 : python-pillow-2.0.0-20.gitd1c6db8.el7 (AXSA:2020-4477:01)	Nessus	Miracle Linux Local Security Checks	2026/1/20	2026/1/20	critical
164561	Nutanix AOS : Multiple Vulnerabilities (NXSA-AOS-5.17)	Nessus	Misc.	2022/9/1	2025/7/22	critical
146225	EulerOS 2.0 SP9 : python-pillow (EulerOS-SA-2021-1254)	Nessus	Huawei Local Security Checks	2021/2/5	2024/1/23	critical
133879	Debian DSA-4631-1 : pillow - security update	Nessus	Debian Local Security Checks	2020/2/24	2020/7/14	critical
134034	RHEL 8 : python-pillow (RHSA-2020:0580)	Nessus	Red Hat Local Security Checks	2020/2/25	2024/11/7	critical

检测

插件搜索

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical