According to the versions of the python-pillow package installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities :

  - libImaging/FliDecode.c in Pillow before 6.2.2 has an     FLI buffer overflow.(CVE-2020-5313)

  - An out-of-bounds write flaw was discovered in     python-pillow in the way SGI RLE images are decoded. An     application that uses python-pillow to decode untrusted     images may be vulnerable to this flaw, which can allow     an attacker to crash the application or potentially     execute code on the system.(CVE-2020-5311)

  - libImaging/PcxDecode.c in Pillow before 6.2.2 has a PCX     P mode buffer overflow.(CVE-2020-5312)

  - In libImaging/SgiRleDecode.c in Pillow through 7.0.0, a     number of out-of-bounds reads exist in the parsing of     SGI image files, a different issue than     CVE-2020-5311.(CVE-2020-11538)

  - In libImaging/Jpeg2KDecode.c in Pillow before 7.1.0,     there are multiple out-of-bounds reads via a crafted     JP2 file.(CVE-2020-10994)

  - In libImaging/PcxDecode.c in Pillow before 7.1.0, an     out-of-bounds read can occur when reading PCX files     where state->shuffle is instructed to read beyond     state->buffer.(CVE-2020-10378)

  - Pillow before 7.1.0 has multiple out-of-bounds reads in     libImaging/FliDecode.c.(CVE-2020-10177)

  - libImaging/TiffDecode.c in Pillow before 6.2.2 has a     TIFF decoding integer overflow, related to     realloc.(CVE-2020-5310)

  - In Pillow before 7.1.0, there are two Buffer Overflows     in libImaging/TiffDecode.c.(CVE-2020-10379)

  - There is a DoS vulnerability in Pillow before 6.2.2     caused by FpxImagePlugin.py calling the range function     on an unvalidated 32-bit integer if the number of bands     is large. On Windows running 32-bit Python, this     results in an OverflowError or MemoryError due to the 2     GB limit. However, on Linux running 64-bit Python this     results in the process being terminated by the OOM     killer.(CVE-2019-19911)

  - ** RESERVED ** This candidate has been reserved by an     organization or individual that will use it when     announcing a new security problem. When the candidate     has been publicized, the details for this candidate     will be provided.(CVE-2020-19911)

  - In Pillow before 8.1.0, PcxDecode has a buffer     over-read when decoding a crafted PCX file because the     user-supplied stride value is trusted for buffer     calculations.(CVE-2020-35653)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

It was discovered that Pillow incorrectly handled certain images. An attacker could possibly use this issue to cause a denial of service.
(CVE-2019-16865, CVE-2019-19911)

It was discovered that Pillow incorrectly handled certain images. An attacker could possibly use this issue to execute arbitrary code.
(CVE-2020-5312)

It was discovered that Pillow incorrectly handled certain TIFF images.
An attacker could possibly use this issue to cause a crash. This issue only affected Ubuntu 19.10. (CVE-2020-5310)

It was discovered that Pillow incorrectly handled certain SGI images.
An attacker could possibly use this issue to execute arbitrary code or cause a crash. This issue only affected Ubuntu 18.04 and Ubuntu 19.10.
(CVE-2020-5311)

It was discovered that Pillow incorrectly handled certain PCX images.
An attackter could possibly use this issue to execute arbitrary code or cause a crash. (CVE-2020-5312)

It was discovered that Pillow incorrectly handled certain Flip images.
An attacker could possibly use this issue to execute arbitrary code or cause a crash. (CVE-2020-5313).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Pillowが、特定の画像を不適切に処理することがわかりました。攻撃者がこの問題を悪用して、サービス拒否を引き起こす可能性があります。
(CVE-2019-16865、CVE-2019-19911) 

Pillowが、特定の画像を不適切に処理することがわかりました。攻撃者がこの問題を悪用して、任意のコードを実行する可能性があります。
(CVE-2020-5312)

Pillowが、特定のTIFF画像を不適切に処理することがわかりました。
攻撃者がこの問題を悪用して、クラッシュを引き起こす可能性があります。この問題の影響を受けるのは Ubuntu 19.10のみです。(CVE-2020-5310) 

Pillowが、特定のSGI画像を不適切に処理することがわかりました。
攻撃者がこの問題を悪用して、任意のコードを実行したり、クラッシュを引き起こしたりする可能性があります。この問題の影響を受けるのは、Ubuntu 18.04とUbuntu 19.10のみです。
(CVE-2020-5311)

Pillowが、特定のPCX画像を不適切に処理することがわかりました。
攻撃者がこの問題を悪用して、任意のコードを実行したり、クラッシュを引き起こしたりする可能性があります。(CVE-2020-5312)

Pillowが、特定のFlip画像を不適切に処理することがわかりました。
攻撃者がこの問題を悪用して、任意のコードを実行したり、クラッシュを引き起こしたりする可能性があります。(CVE-2020-5313)。

注意: Tenable Network Security は、前述の説明ブロックを Ubuntu セキュリティアドバイザリからすでに直接抽出しています。Tenable では、新たな問題を持ち込まずに、できる限り自動的に整理して書式設定するようにしています。

Pillow開発者による報告: 

このリリースでは、いくつかのセキュリティ問題とCVE-2019-19911に対処しています。

CVE-2019-19911はFPXイメージに関するものです。画像に多数のバンドがあることが報告された場合、画像を処理しようとする際に大量のリソースが使用されます。これは、Pillowが使用できるバンド数に制限することで修正されています。

SGI、PCX、またはFLIイメージを処理する際に、バッファオーバーランが見つかりました。
これを防ぐためのチェックが追加されました。

TIFF画像の処理で再割り当てされるメモリブロックのサイズを計算する際に、オーバーフローチェックが追加されました。

據發現，Pillow 未正確處理某些影像。攻擊者可能利用此問題造成拒絕服務。
(CVE-2019-16865、CVE-2019-19911)

據發現，Pillow 未正確處理某些影像。攻擊者可能利用此問題執行任意程式碼。
(CVE-2020-5312)

據發現，Pillow 未正確處理某些 TIFF 影像。
攻擊者可能利用此問題造成當機。此問題只會影響 Ubuntu 19.10。(CVE-2020-5310)

據發現，Pillow 未正確處理某些 SGI 影像。
攻擊者可能利用此問題執行任意程式碼或造成當機。此問題僅影響 Ubuntu 18.04 和 Ubuntu 19.10。
(CVE-2020-5311)

據發現，Pillow 未正確處理某些 PCX 影像。
攻擊者可能利用此問題執行任意程式碼或造成當機。(CVE-2020-5312)

據發現，Pillow 未正確處理某些 Flip 影像。
攻擊者可能利用此問題執行任意程式碼或造成當機。(CVE-2020-5313)

請注意，Tenable Network Security 已直接從 Ubuntu 安全性公告擷取前置描述區塊。Tenable 已盡量在不造成其他問題的前提下，嘗試自動清理並將其格式化。

发现 Pillow 未能正确处理某些图像。攻击者可能利用此问题造成拒绝服务。
（CVE-2019-16865、CVE-2019-19911）

发现 Pillow 未能正确处理某些图像。攻击者可能利用此问题执行任意代码。
(CVE-2020-5312)

发现 Pillow 未能正确处理某些 TIFF 图像。
攻击者可能利用此问题造成崩溃。此问题仅影响 Ubuntu 19.10。(CVE-2020-5310)

发现 Pillow 未能正确处理某些 SGI 图像。
攻击者可能利用此问题执行任意代码或造成崩溃。此问题仅影响 Ubuntu 18.04 和 Ubuntu 19.10。
(CVE-2020-5311)

发现 Pillow 未能正确处理某些 PCX 图像。
攻击者可能利用此问题执行任意代码或造成崩溃。(CVE-2020-5312)

发现 Pillow 未能正确处理某些 Flip 图像。
攻击者可能利用此问题执行任意代码或造成崩溃。(CVE-2020-5313)。

请注意，Tenable Network Security 已直接从 Ubuntu 安全公告中提取上述描述块。Tenable 已尝试在不引入其他问题的情况下，尽可能进行自动清理和排版。

According to the versions of the python-pillow packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - In libImaging/PcxDecode.c in Pillow before 7.1.0, an     out-of-bounds read can occur when reading PCX files     where state->shuffle is instructed to read beyond     state->buffer.(CVE-2020-10378)

  - Pillow before 7.1.0 has multiple out-of-bounds reads in     libImaging/FliDecode.c.(CVE-2020-10177)

  - libImaging/TiffDecode.c in Pillow before 6.2.2 has a     TIFF decoding integer overflow, related to     realloc.(CVE-2020-5310)

  - In Pillow before 7.1.0, there are two Buffer Overflows     in libImaging/TiffDecode.c.(CVE-2020-10379)

  - In libImaging/Jpeg2KDecode.c in Pillow before 7.1.0,     there are multiple out-of-bounds reads via a crafted     JP2 file.(CVE-2020-10994)

  - In Pillow before 8.1.0, PcxDecode has a buffer     over-read when decoding a crafted PCX file because the     user-supplied stride value is trusted for buffer     calculations.(CVE-2020-35653)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Pillow developers report :

This release addresses several security problems, as well as addressing CVE-2019-19911.

CVE-2019-19911 is regarding FPX images. If an image reports that it has a large number of bands, a large amount of resources will be used when trying to process the image. This is fixed by limiting the number of bands to those usable by Pillow.

Buffer overruns were found when processing an SGI, PCX or FLI image.
Checks have been added to prevent this.

Overflow checks have been added when calculating the size of a memory block to be reallocated in the processing of a TIFF image.

According to the versions of the python-pillow packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - In Pillow before 8.1.0, PcxDecode has a buffer     over-read when decoding a crafted PCX file because the     user-supplied stride value is trusted for buffer     calculations.(CVE-2020-35653)

  - libImaging/FliDecode.c in Pillow before 6.2.2 has an     FLI buffer overflow.(CVE-2020-5313)

  - In libImaging/Jpeg2KDecode.c in Pillow before 7.1.0,     there are multiple out-of-bounds reads via a crafted     JP2 file.(CVE-2020-10994)

  - In libImaging/SgiRleDecode.c in Pillow through 7.0.0, a     number of out-of-bounds reads exist in the parsing of     SGI image files, a different issue than     CVE-2020-5311.(CVE-2020-11538)

  - There is a DoS vulnerability in Pillow before 6.2.2     caused by FpxImagePlugin.py calling the range function     on an unvalidated 32-bit integer if the number of bands     is large. On Windows running 32-bit Python, this     results in an OverflowError or MemoryError due to the 2     GB limit. However, on Linux running 64-bit Python this     results in the process being terminated by the OOM     killer.(CVE-2019-19911)

  - libImaging/TiffDecode.c in Pillow before 6.2.2 has a     TIFF decoding integer overflow, related to     realloc.(CVE-2020-5310)

  - An out-of-bounds write flaw was discovered in     python-pillow in the way SGI RLE images are decoded. An     application that uses python-pillow to decode untrusted     images may be vulnerable to this flaw, which can allow     an attacker to crash the application or potentially     execute code on the system.(CVE-2020-5311)

  - libImaging/PcxDecode.c in Pillow before 6.2.2 has a PCX     P mode buffer overflow.(CVE-2020-5312)

  - In Pillow before 7.1.0, there are two Buffer Overflows     in libImaging/TiffDecode.c.(CVE-2020-10379)

  - An issue was discovered in Pillow before 6.2.0. When     reading specially crafted invalid image files, the     library can either allocate very large amounts of     memory or take an extremely long period of time to     process the image.(CVE-2019-16865)

  - In libImaging/PcxDecode.c in Pillow before 7.1.0, an     out-of-bounds read can occur when reading PCX files     where state->shuffle is instructed to read beyond     state->buffer.(CVE-2020-10378)

  - Pillow before 7.1.0 has multiple out-of-bounds reads in     libImaging/FliDecode.c.(CVE-2020-10177)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

6.2.2に更新し、CVE-2020-5313、CVE-2020-5312、CVE-2020-5311、CVE-2020-5310を修正してください。

注意：Tenable Network Securityは、前述の記述ブロックをFedora更新システムのWebサイトから直接抽出しています。
Tenableでは、新たな問題を持ち込まずに、できる限り自動的に整理して書式設定するようにしています。

CVE-2020-5313、CVE-2020-5312、CVE-2020-5311、CVE-2020-5310、CVE-2019-19911のバックポートパッチ 

注意：Tenable Network Securityは、前述の記述ブロックをFedora更新システムのWebサイトから直接抽出しています。
Tenableでは、新たな問題を持ち込まずに、できる限り自動的に整理して書式設定するようにしています。

Update to 6.2.2, fixes CVE-2020-5313, CVE-2020-5312, CVE-2020-5311, CVE-2020-5310.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Backport patches for CVE-2020-5313, CVE-2020-5312, CVE-2020-5311, CVE-2020-5310, CVE-2019-19911

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the python-pillow package installed, the EulerOS Virtualization for ARM 64 installation on the remote host is affected by the following vulnerabilities :

  - In Pillow before 8.1.0, PcxDecode has a buffer     over-read when decoding a crafted PCX file because the     user-supplied stride value is trusted for buffer     calculations.(CVE-2020-35653)

  - In Pillow before 7.1.0, there are two Buffer Overflows     in libImaging/TiffDecode.c.(CVE-2020-10379)

  - libImaging/TiffDecode.c in Pillow before 6.2.2 has a     TIFF decoding integer overflow, related to     realloc.(CVE-2020-5310)

  - In libImaging/PcxDecode.c in Pillow before 7.1.0, an     out-of-bounds read can occur when reading PCX files     where state->shuffle is instructed to read beyond     state->buffer.(CVE-2020-10378)

  - In libImaging/Jpeg2KDecode.c in Pillow before 7.1.0,     there are multiple out-of-bounds reads via a crafted     JP2 file.(CVE-2020-10994)

  - Pillow before 7.1.0 has multiple out-of-bounds reads in     libImaging/FliDecode.c.(CVE-2020-10177)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	名稱	產品	系列	已發布	已更新	嚴重性
148585	EulerOS Virtualization 2.9.1 : python-pillow (EulerOS-SA-2021-1729)	Nessus	Huawei Local Security Checks	2021/4/15	2024/1/4	critical
133550	Ubuntu 16.04 LTS / 18.04 LTS : Pillow vulnerabilities (USN-4272-1)	Nessus	Ubuntu Local Security Checks	2020/2/7	2023/10/21	critical
133550	Ubuntu 16.04 LTS / 18.04 LTS : Pillowの脆弱性 (USN-4272-1)	Nessus	Ubuntu Local Security Checks	2020/2/7	2023/10/21	critical
133243	FreeBSD：Pillow -- 複数の脆弱性（0700e76c-3eb0-11ea-8478-3085a9a95629）	Nessus	FreeBSD Local Security Checks	2020/1/27	2020/7/14	critical
133550	Ubuntu 16.04 LTS / 18.04 LTS：Pillow 弱點 (USN-4272-1)	Nessus	Ubuntu Local Security Checks	2020/2/7	2023/10/21	critical
133550	Ubuntu 16.04 LTS / 18.04 LTS：Pillow 漏洞 (USN-4272-1)	Nessus	Ubuntu Local Security Checks	2020/2/7	2023/10/21	critical
145750	EulerOS 2.0 SP8 : python-pillow (EulerOS-SA-2021-1167)	Nessus	Huawei Local Security Checks	2021/2/1	2024/1/25	high
148586	EulerOS Virtualization 2.9.0 : python-pillow (EulerOS-SA-2021-1743)	Nessus	Huawei Local Security Checks	2021/4/15	2024/1/4	critical
133243	FreeBSD : Pillow -- Multiple vulnerabilities (0700e76c-3eb0-11ea-8478-3085a9a95629)	Nessus	FreeBSD Local Security Checks	2020/1/27	2020/7/14	critical
146225	EulerOS 2.0 SP9 : python-pillow (EulerOS-SA-2021-1254)	Nessus	Huawei Local Security Checks	2021/2/5	2024/1/23	critical
133376	Fedora 31：python-pillow（2020-df444e464e）	Nessus	Fedora Local Security Checks	2020/1/31	2020/7/14	critical
133887	Fedora 30：python-pillow（2020-5cdbb19cca）	Nessus	Fedora Local Security Checks	2020/2/24	2020/7/14	critical
133376	Fedora 31 : python-pillow (2020-df444e464e)	Nessus	Fedora Local Security Checks	2020/1/31	2020/7/14	critical
133887	Fedora 30 : python-pillow (2020-5cdbb19cca)	Nessus	Fedora Local Security Checks	2020/2/24	2020/7/14	critical
146238	EulerOS 2.0 SP9 : python-pillow (EulerOS-SA-2021-1273)	Nessus	Huawei Local Security Checks	2021/2/5	2024/1/23	critical
147058	EulerOS Virtualization for ARM 64 3.0.6.0 : python-pillow (EulerOS-SA-2021-1570)	Nessus	Huawei Local Security Checks	2021/3/4	2024/1/16	high

偵測

搜尋 Plugin

critical

critical

critical

critical

critical

critical

high

critical

critical

critical

critical

critical

critical

critical

critical

high