{"id":"CVE-2020-10379","aliases":["BIT-pillow-2020-10379","DEBIAN-CVE-2020-10379","EUVD-2020-0131","GHSA-8843-m7mw-mxqm","PYSEC-2020-78","UBUNTU-CVE-2020-10379","USN-4430-2"],"status":"published","title":"Buffer overflow in Pillow","description":"In Pillow before 7.1.0, there are two Buffer Overflows in libImaging/TiffDecode.c.","severity":{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-09","score":0.01129,"percentile":0.66606,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-120"],"published":"2020-06-25T18:24:32Z","modified":"2026-10-26T12:01:10Z","fixes":[{"ecosystem":"PyPI","package":"pillow","fixed_in":["7.1.0"],"sources":["ghsa","osv"]},{"ecosystem":"Bitnami","package":"pillow","fixed_in":["7.1.0"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"pillow","fixed_in":["7.2.0-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"pillow","fixed_in":["7.2.0-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"pillow","fixed_in":["7.2.0-1"],"sources":["osv"]},{"ecosystem":"Ubuntu:20.04:LTS","package":"pillow","fixed_in":["7.0.0-4ubuntu0.1"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"PyPI","package":"pillow","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.1.0"}]}]},{"source":"osv","ecosystem":"Bitnami","package":"pillow","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"7.1.0"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"pillow","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.2.0-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"pillow","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.2.0-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"pillow","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.2.0-1"}]}]},{"source":"osv","ecosystem":"PyPI","package":"pillow","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.1.0"}]}],"versions":["1.0","1.1","1.2","1.3","1.4","1.5","1.6","1.7.0","1.7.1","1.7.2","1.7.3","1.7.4","1.7.5","1.7.6","1.7.7","1.7.8","2.0.0","2.1.0","2.2.0","2.2.1","2.2.2","2.3.0","2.3.1","2.3.2","2.4.0","2.5.0","2.5.1","2.5.2","2.5.3","2.6.0","2.6.1","2.6.2","2.7.0","2.8.0","2.8.1","2.8.2","2.9.0","3.0.0","3.1.0","3.1.0.rc1","3.1.0rc1","3.1.1","3.1.2","3.2.0","3.3.0","3.3.1","3.3.2","3.3.3","3.4.0","3.4.1","3.4.2","4.0.0","4.1.0","4.1.1","4.2.0","4.2.1","4.3.0","5.0.0","5.1.0","5.2.0","5.3.0","5.4.0","5.4.0.dev0","5.4.1","6.0.0","6.1.0","6.2.0","6.2.1","6.2.2","7.0.0"]},{"source":"osv","ecosystem":"PyPI","package":"pillow","ranges":[{"type":"GIT","events":[{"introduced":"0"},{"fixed":"46f4a349b88915787fea3fb91348bb1665831bbb"}]},{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.1.0"}]}],"versions":["1.0","1.1","1.2","1.3","1.4","1.5","1.6","1.7.0","1.7.1","1.7.2","1.7.3","1.7.4","1.7.5","1.7.6","1.7.7","1.7.8","2.0.0","2.1.0","2.2.0","2.2.1","2.2.2","2.3.0","2.3.1","2.3.2","2.4.0","2.5.0","2.5.1","2.5.2","2.5.3","2.6.0","2.6.1","2.6.2","2.7.0","2.8.0","2.8.1","2.8.2","2.9.0","3.0.0","3.1.0rc1","3.1.0.rc1","3.1.0","3.1.1","3.1.2","3.2.0","3.3.0","3.3.1","3.3.2","3.3.3","3.4.0","3.4.1","3.4.2","4.0.0","4.1.0","4.1.1","4.2.0","4.2.1","4.3.0","5.0.0","5.1.0","5.2.0","5.3.0","5.4.0.dev0","5.4.0","5.4.1","6.0.0","6.1.0","6.2.0","6.2.1","6.2.2","7.0.0"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"pillow","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.0.0-4ubuntu0.1"}]}],"versions":["6.1.0-1","6.1.0-1build1","6.2.1-2","7.0.0-4","7.0.0-4build1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"pillow-python2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.2.1-3~build1","6.2.1-3","6.2.1-3ubuntu0.1~esm1","6.2.1-3ubuntu0.1~esm2"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"pillow","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.0.0-4ubuntu0.1"}]}],"versions":["6.1.0-1","6.1.0-1build1","6.2.1-2","7.0.0-4","7.0.0-4build1"],"bundled":5}],"products":[{"vendor":"canonical","product":"ubuntu_linux"},{"vendor":"fedoraproject","product":"fedora"},{"vendor":"python","product":"pillow"}],"references":[{"url":"https://github.com/python-pillow/Pillow/commits/master/src/libImaging","tags":["x_refsource_MISC","x_transferred","Broken Link","web","report"]},{"url":"https://github.com/python-pillow/Pillow/pull/4538","tags":["x_refsource_MISC","x_transferred","Issue Tracking","Patch","fix","web","report"]},{"url":"https://github.com/python-pillow/Pillow/commit/46f4a349b88915787fea3fb91348bb1665831bbb#diff-9478f2787e3ae9668a15123b165c23ac","tags":["x_refsource_MISC","x_transferred","Patch","fix","web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HOKHNWV2VS5GESY7IBD237E7C6T3I427/","tags":["vendor-advisory","x_refsource_FEDORA","x_transferred","web"]},{"url":"https://pillow.readthedocs.io/en/stable/releasenotes/7.1.0.html","tags":["x_refsource_CONFIRM","x_transferred","Product","web","report"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/BEBCPE4F2VHTIT6EZA2YZQZLPVDEBJGD/","tags":["vendor-advisory","x_refsource_FEDORA","x_transferred","web"]},{"url":"https://usn.ubuntu.com/4430-2/","tags":["vendor-advisory","x_refsource_UBUNTU","x_transferred","Third Party Advisory","advisory","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2020-10379","tags":["web","advisory"]},{"url":"https://pillow.readthedocs.io/en/stable/releasenotes/6.2.3.html","tags":["web","report"]},{"url":"https://snyk.io/vuln/SNYK-PYTHON-PILLOW-574577","tags":["web"]},{"url":"https://github.com/python-pillow/Pillow/issues/4750","tags":["web"]},{"url":"https://github.com/advisories/GHSA-8843-m7mw-mxqm","tags":["advisory"]},{"url":"https://github.com/pypa/advisory-database/tree/main/vulns/pillow/PYSEC-2020-78.yaml","tags":["web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/BEBCPE4F2VHTIT6EZA2YZQZLPVDEBJGD","tags":["web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/HOKHNWV2VS5GESY7IBD237E7C6T3I427","tags":["web"]},{"url":"https://usn.ubuntu.com/4430-2","tags":["web"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2020-10379","tags":["advisory"]},{"url":"https://github.com/python-pillow/Pillow","tags":["package"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/HOKHNWV2VS5GESY7IBD237E7C6T3I427/","tags":["web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/BEBCPE4F2VHTIT6EZA2YZQZLPVDEBJGD/","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2020-10379","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-4430-2","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2020-10379","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2020-10177","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2020-10378","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2020-10994","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2020-11538","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2020-10379","description":"In Pillow before 7.1.0, there are two Buffer Overflows in libImaging/TiffDecode.c.","status":"published","published":"2020-06-25T18:24:32Z","modified":"2024-08-04T10:58:40.541Z","updated_at":"2026-11-02T14:35:48.213211Z"}],"euvd":[{"id":"EUVD-2020-0131","description":"In Pillow before 7.1.0, there are two Buffer Overflows in libImaging/TiffDecode.c.","status":"published","published":"2020-06-25T18:24:32Z","modified":"2024-08-04T10:58:40Z","updated_at":"2026-11-03T03:07:50.893254Z"}],"ghsa":[{"id":"GHSA-8843-m7mw-mxqm","title":"Buffer overflow in Pillow","description":"In Pillow before 7.1.0, there are two Buffer Overflows in `libImaging/TiffDecode.c`.","status":"published","published":"2020-07-27T21:52:41Z","modified":"2024-10-09T19:44:22Z","cvss":[{"version":"4.0","score":8.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","level":"high"},{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-120"],"updated_at":"2026-11-02T14:38:09.785133Z"}],"nvd":[{"id":"CVE-2020-10379","description":"In Pillow before 7.1.0, there are two Buffer Overflows in libImaging/TiffDecode.c.","status":"published","published":"2020-06-25T19:15:12.27Z","modified":"2026-06-17T02:47:40.31Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high","assessor":"primary"},{"version":"2.0","score":6.8,"vector":"AV:N/AC:M/Au:N/C:P/I:P/A:P","level":"medium","assessor":"primary"}],"cwes":["CWE-120"],"updated_at":"2026-11-02T14:06:08.145904Z"}],"osv":[{"id":"CVE-2020-10379","description":"In Pillow before 7.1.0, there are two Buffer Overflows in libImaging/TiffDecode.c.","status":"published","published":"2020-06-25T19:15:12.27Z","modified":"2026-10-20T10:50:58.715241217Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:44:13.492058Z"},{"id":"DEBIAN-CVE-2020-10379","description":"In Pillow before 7.1.0, there are two Buffer Overflows in libImaging/TiffDecode.c.","status":"published","published":"2020-06-25T19:15:12.27Z","modified":"2026-10-26T12:01:10.80888961Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:45:32.862554Z"},{"id":"GHSA-8843-m7mw-mxqm","title":"Buffer overflow in Pillow","description":"In Pillow before 7.1.0, there are two Buffer Overflows in `libImaging/TiffDecode.c`.","status":"published","published":"2020-07-27T21:52:41Z","modified":"2025-06-06T15:13:20.298139Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"},{"version":"4.0","score":8.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","level":"high"}],"cwes":["CWE-120"],"updated_at":"2026-11-02T15:46:42.077781Z"},{"id":"UBUNTU-CVE-2020-10379","description":"In Pillow before 7.1.0, there are two Buffer Overflows in libImaging/TiffDecode.c.","status":"published","published":"2020-06-25T19:15:00Z","modified":"2026-02-04T03:40:44.987233Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:54:22.212782Z"},{"id":"BIT-pillow-2020-10379","description":"In Pillow before 7.1.0, there are two Buffer Overflows in libImaging/TiffDecode.c.","status":"published","published":"2024-03-06T11:07:09.096Z","modified":"2026-09-08T08:48:24.779007501Z","updated_at":"2026-11-02T15:28:34.724063Z"},{"id":"PYSEC-2020-78","description":"In Pillow before 7.1.0, there are two Buffer Overflows in libImaging/TiffDecode.c.","status":"published","published":"2020-06-25T19:15:00Z","modified":"2025-06-06T15:13:20.298139Z","updated_at":"2026-11-02T15:52:52.682031Z"},{"id":"USN-4430-2","title":"pillow vulnerabilities","description":"USN-4430-1 fixed vulnerabilities in Pillow. This update provides the\ncorresponding updates for Ubuntu 20.04 LTS.\n\nOriginal advisory details:\n\n It was discovered that Pillow incorrectly handled certain image files. If\n a user or automated system were tricked into opening a specially-crafted\n image file, a remote attacker could possibly cause Pillow to crash,\n resulting in a denial of service.\n","status":"published","published":"2020-07-23T11:14:32Z","modified":"2026-04-27T15:39:46.694342Z","updated_at":"2026-11-02T16:58:14.547547Z"}]}}