Test ID:	1.3.6.1.4.1.25623.1.1.10.2020.0434
Category:	Mageia Linux Local Security Checks
Title:	Mageia: Security Advisory (MGASA-2020-0434)
Summary:	The remote host is missing an update for the 'python-pillow' package(s) announced via the MGASA-2020-0434 advisory.
Description:	Summary: The remote host is missing an update for the 'python-pillow' package(s) announced via the MGASA-2020-0434 advisory. Vulnerability Insight: Pillow before 6.2.3 and 7.x before 7.0.1 has multiple out-of-bounds reads in libImaging/FliDecode.c (CVE-2020-10177). In libImaging/PcxDecode.c in Pillow before 6.2.3 and 7.x before 7.0.1, an out-of-bounds read can occur when reading PCX files where state->shuffle is instructed to read beyond state->buffer (CVE-2020-10378). An out-of-bounds read flaw was found in python-pillow in the way JP2 images are parsed. An application that uses python-pillow to decode untrusted images may be vulnerable to this issue. This flaw allows an attacker to read data. The highest threat from this vulnerability is to confidentiality (CVE-2020-10994). An out-of-bounds read/write flaw was found in python-pillow, in the way SGI RLE images are decoded. An application that uses python-pillow to decode untrusted images may be vulnerable. This flaw allows an attacker to crash the application or potentially execute code on the system. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability (CVE-2020-11538). Also, python-pillow is now built with OpenJPEG2000 image support. Affected Software/OS: 'python-pillow' package(s) on Mageia 7. Solution: Please install the updated package(s). CVSS Score: 6.8 CVSS Vector: AV:N/AC:M/Au:N/C:P/I:P/A:P
Cross-Ref:	Common Vulnerability Exposure (CVE) ID: CVE-2020-10177 https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/HOKHNWV2VS5GESY7IBD237E7C6T3I427/ https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/BEBCPE4F2VHTIT6EZA2YZQZLPVDEBJGD/ https://github.com/python-pillow/Pillow/commits/master/src/libImaging https://github.com/python-pillow/Pillow/pull/4503 https://github.com/python-pillow/Pillow/pull/4538 https://pillow.readthedocs.io/en/stable/releasenotes/7.1.0.html https://lists.debian.org/debian-lts-announce/2020/08/msg00012.html https://usn.ubuntu.com/4430-1/ https://usn.ubuntu.com/4430-2/ Common Vulnerability Exposure (CVE) ID: CVE-2020-10378 https://github.com/python-pillow/Pillow/commit/6a83e4324738bb0452fbe8074a995b1c73f08de7#diff-9478f2787e3ae9668a15123b165c23ac Common Vulnerability Exposure (CVE) ID: CVE-2020-10994 https://github.com/python-pillow/Pillow/commits/master/src/libImaging/ https://github.com/python-pillow/Pillow/pull/4505 https://pillow.readthedocs.io/en/stable/releasenotes/ Common Vulnerability Exposure (CVE) ID: CVE-2020-11538 https://github.com/python-pillow/Pillow/pull/4504 https://pillow.readthedocs.io/en/stable/releasenotes/index.html
Copyright	Copyright (C) 2022 Greenbone AG

This is only one of 145615 vulnerability tests in our test suite. Find out more about running a complete security audit. To run a free test of this vulnerability against your system, register below.