PublicDateAtUSN: 2020-06-25 19:15:00 UTC
Candidate: CVE-2020-10379
PublicDate: 2020-06-25 19:15:00 UTC
References:
 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-10379
 https://github.com/python-pillow/Pillow/pull/4538
 https://github.com/python-pillow/Pillow/commits/master/src/libImaging
 https://pillow.readthedocs.io/en/stable/releasenotes/6.2.3.html
 https://pillow.readthedocs.io/en/stable/releasenotes/7.1.0.html
 https://ubuntu.com/security/notices/USN-4430-2
Description:
 In Pillow before 7.1.0, there are two Buffer Overflows in
 libImaging/TiffDecode.c.
Ubuntu-Description:
Notes:
Mitigation:
Bugs:
Priority: medium
Discovered-by:
Assigned-to: mdeslaur
CVSS:
 nvd: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H [7.8 HIGH]


Patches_pillow:
 upstream: https://github.com/python-pillow/Pillow/pull/4507
upstream_pillow: needs-triage
precise/esm_pillow: DNE
trusty_pillow: ignored (out of standard support)
trusty/esm_pillow: not-affected (code not present)
xenial_pillow: not-affected (code not present)
esm-infra/xenial_pillow: not-affected (code not present)
bionic_pillow: not-affected (code not present)
eoan_pillow: ignored (reached end-of-life)
focal_pillow: released (7.0.0-4ubuntu0.1)
groovy_pillow: not-affected (7.2.0-1)
hirsute_pillow: not-affected (7.2.0-1)
impish_pillow: not-affected (7.2.0-1)
jammy_pillow: not-affected (7.2.0-1)
devel_pillow: not-affected (7.2.0-1)

Patches_pillow-python2:
upstream_pillow-python2: needs-triage
precise/esm_pillow-python2: DNE
trusty_pillow-python2: DNE
trusty/esm_pillow-python2: DNE
xenial_pillow-python2: DNE
bionic_pillow-python2: DNE
focal_pillow-python2: needs-triage
groovy_pillow-python2: ignored (reached end-of-life)
hirsute_pillow-python2: DNE
impish_pillow-python2: DNE
jammy_pillow-python2: DNE
devel_pillow-python2: DNE

Patches_python-imaging:
upstream_python-imaging:  needs-triage
precise/esm_python-imaging: not-affected
trusty_python-imaging: DNE
trusty/esm_python-imaging: DNE
xenial_python-imaging: DNE
bionic_python-imaging: DNE
focal_python-imaging: DNE
groovy_python-imaging: DNE
hirsute_python-imaging: DNE
impish_python-imaging: DNE
jammy_python-imaging: DNE
devel_python-imaging: DNE