The remote NewStart CGSL host, running version CORE 5.04 / MAIN 5.04, has python-pillow packages installed that are affected by multiple vulnerabilities:

  - An issue was discovered in Pillow before 6.2.0. When     reading specially crafted invalid image files, the     library can either allocate very large amounts of memory     or take an extremely long period of time to process the     image. (CVE-2019-16865)

  - libImaging/PcxDecode.c in Pillow before 6.2.2 has a PCX     P mode buffer overflow. (CVE-2020-5312)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote NewStart CGSL host, running version MAIN 4.05, has python-imaging packages installed that are affected by a vulnerability:

  - libImaging/PcxDecode.c in Pillow before 6.2.2 has a PCX P mode buffer overflow. (CVE-2020-5312)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

According to the versions of the python-pillow package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - An issue was discovered in Pillow before 6.2.0. When     reading specially crafted invalid image files, the     library can either allocate very large amounts of     memory or take an extremely long period of time to     process the image.(CVE-2019-16865)

  - libImaging/PcxDecode.c in Pillow before 6.2.2 has a PCX     P mode buffer overflow.(CVE-2020-5312)

  - libImaging/FliDecode.c in Pillow before 6.2.2 has an     FLI buffer overflow.(CVE-2020-5313)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The version of AOS installed on the remote host is prior to 5.15.1. It is, therefore, affected by multiple vulnerabilities as referenced in the NXSA-AOS-5.15.1 advisory.

  - rtl_p2p_noa_ie in drivers/net/wireless/realtek/rtlwifi/ps.c in the Linux kernel through 5.3.6 lacks a     certain upper-bound check, leading to a buffer overflow. (CVE-2019-17666)

  - libImaging/PcxDecode.c in Pillow before 6.2.2 has a PCX P mode buffer overflow. (CVE-2020-5312)

  - An issue was discovered in Pillow before 6.2.0. When reading specially crafted invalid image files, the     library can either allocate very large amounts of memory or take an extremely long period of time to     process the image. (CVE-2019-16865)

  - The Linux kernel before 5.1-rc5 allows page->_refcount reference count overflow, with resultant use-after-     free issues, if about 140 GiB of RAM exists. This is related to fs/fuse/dev.c, fs/pipe.c, fs/splice.c,     include/linux/mm.h, include/linux/pipe_fs_i.h, kernel/trace/trace.c, mm/gup.c, and mm/hugetlb.c. It can     occur with FUSE requests. (CVE-2019-11487)

  - A flaw was found in the fix for CVE-2019-11135, in the Linux upstream kernel versions before 5.5 where,     the way Intel CPUs handle speculative execution of instructions when a TSX Asynchronous Abort (TAA) error     occurs. When a guest is running on a host CPU affected by the TAA flaw (TAA_NO=0), but is not affected by     the MDS issue (MDS_NO=1), the guest was to clear the affected buffers by using a VERW instruction     mechanism. But when the MDS_NO=1 bit was exported to the guests, the guests did not use the VERW mechanism     to clear the affected buffers. This issue affects guests running on Cascade Lake CPUs and requires that     host has 'TSX' enabled. Confidentiality of data is the highest threat associated with this vulnerability.
    (CVE-2019-19338)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Pillow developers report :

This release addresses several security problems, as well as addressing CVE-2019-19911.

CVE-2019-19911 is regarding FPX images. If an image reports that it has a large number of bands, a large amount of resources will be used when trying to process the image. This is fixed by limiting the number of bands to those usable by Pillow.

Buffer overruns were found when processing an SGI, PCX or FLI image.
Checks have been added to prevent this.

Overflow checks have been added when calculating the size of a memory block to be reallocated in the processing of a TIFF image.

The remote Ubuntu 16.04 LTS / 18.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-4272-1 advisory.

    It was discovered that Pillow incorrectly handled certain images. An attacker could possibly use this     issue to cause a denial of service. (CVE-2019-16865, CVE-2019-19911)

    It was discovered that Pillow incorrectly handled certain images. An attacker could possibly use this     issue to execute arbitrary code. (CVE-2020-5312)

    It was discovered that Pillow incorrectly handled certain TIFF images. An attacker could possibly use this     issue to cause a crash. This issue only affected Ubuntu 19.10. (CVE-2020-5310)

    It was discovered that Pillow incorrectly handled certain SGI images. An attacker could possibly use this     issue to execute arbitrary code or cause a crash. This issue only affected Ubuntu 18.04 and Ubuntu 19.10.
    (CVE-2020-5311)

    It was discovered that Pillow incorrectly handled certain PCX images. An attackter could possibly use this     issue to execute arbitrary code or cause a crash. (CVE-2020-5312)

    It was discovered that Pillow incorrectly handled certain Flip images. An attacker could possibly use this     issue to execute arbitrary code or cause a crash. (CVE-2020-5313)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2020:0566 advisory.

    The python-pillow packages contain a Python image processing library that provides extensive file format     support, an efficient internal representation, and powerful image-processing capabilities.

    Security Fix(es):

    * python-pillow: out-of-bounds write in expandrow in libImaging/SgiRleDecode.c (CVE-2020-5311)

    * python-pillow: improperly restricted operations on memory buffer in libImaging/PcxDecode.c     (CVE-2020-5312)

    * python-pillow: reading specially crafted image files leads to allocation of large amounts of memory and     denial of service (CVE-2019-16865)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the ELSA-2020-0580 advisory.

    - Fix for CVE-2020-5311 - out-of-bounds write in expandrow     Resolves: rhbz#1789535

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of python-pillow installed on the remote host is prior to 2.0.0-20.gitd1c6db8. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2020-1412 advisory.

    A flaw was discovered in the way the python-pillow may allocate a large amount of memory or require a long     time while processing specially crafted image files, possibly causing a denial of service. Applications     that use the library to process untrusted files may be vulnerable to this flaw. (CVE-2019-16865)

    A flaw was discovered in python-pillow where it does not properly restrict operations within the bounds of     a memory buffer when decoding PCX images. An application that uses python-pillow to decode untrusted     images may be vulnerable to this flaw, which can allow an attacker to crash the application or potentially     execute code on the system. (CVE-2020-5312)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the CESA-2020:0580 advisory.

  - python-pillow: reading specially crafted image files leads to allocation of large amounts of memory and     denial of service (CVE-2019-16865)

  - python-pillow: out-of-bounds write in expandrow in libImaging/SgiRleDecode.c (CVE-2020-5311)

  - python-pillow: improperly restricted operations on memory buffer in libImaging/PcxDecode.c (CVE-2020-5312)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote MiracleLinux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the AXSA:2020-206:02 advisory.

    * python-pillow: out-of-bounds write in expandrow in libImaging/SgiRleDecode.c (CVE-2020-5311)
      * python-pillow: improperly restricted operations on memory buffer in libImaging/PcxDecode.c     (CVE-2020-5312)
      * python-pillow: reading specially crafted image files leads to allocation of large amounts of memory     and denial of service (CVE-2019-16865)

Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
136903	NewStart CGSL CORE 5.04 / MAIN 5.04 : python-pillow Multiple Vulnerabilities (NS-SA-2020-0024)	Nessus	NewStart CGSL Local Security Checks	2020/5/27	2021/1/14	critical
140288	NewStart CGSL MAIN 4.05 : python-imaging Vulnerability (NS-SA-2020-0045)	Nessus	NewStart CGSL Local Security Checks	2020/9/7	2021/1/14	critical
142354	EulerOS 2.0 SP2 : python-pillow (EulerOS-SA-2020-2389)	Nessus	Huawei Local Security Checks	2020/11/3	2024/2/12	critical
164580	Nutanix AOS : Multiple Vulnerabilities (NXSA-AOS-5.15.1)	Nessus	Misc.	2022/9/1	2025/2/17	critical
133243	FreeBSD : Pillow -- Multiple vulnerabilities (0700e76c-3eb0-11ea-8478-3085a9a95629)	Nessus	FreeBSD Local Security Checks	2020/1/27	2020/7/14	critical
133550	Ubuntu 16.04 LTS / 18.04 LTS : Pillow vulnerabilities (USN-4272-1)	Nessus	Ubuntu Local Security Checks	2020/2/7	2025/9/3	critical
133944	RHEL 8 : python-pillow (RHSA-2020:0566)	Nessus	Red Hat Local Security Checks	2020/2/24	2024/11/7	critical
134059	Oracle Linux 8 : python-pillow (ELSA-2020-0580)	Nessus	Oracle Linux Local Security Checks	2020/2/26	2024/10/23	critical
135930	Amazon Linux 2 : python-pillow (ALAS-2020-1412)	Nessus	Amazon Linux Local Security Checks	2020/4/24	2024/12/11	critical
146010	CentOS 8 : python-pillow (CESA-2020:0580)	Nessus	CentOS Local Security Checks	2021/2/1	2021/3/23	critical
294651	MiracleLinux 8 : python-pillow-5.1.1-10.el8 (AXSA:2020-206:02)	Nessus	Miracle Linux Local Security Checks	2026/1/20	2026/1/20	critical

检测

插件搜索

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical