Search for vulnerabilities
Vulnerability details: VCID-beyg-bzsk-h7dd
Vulnerability ID VCID-beyg-bzsk-h7dd
Aliases BIT-pillow-2020-5312
CVE-2020-5312
GHSA-p49h-hjvm-jg3h
PYSEC-2020-83
Summary libImaging/PcxDecode.c in Pillow before 6.2.2 has a PCX P mode buffer overflow.
Status Published
Exploitability 0.5
Weighted Severity 9.0
Risk 4.5
Affected and Fixed Packages Package Details
Weaknesses (4)
CWE-120 Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')
CWE-937 OWASP Top Ten 2013 Category A9 - Using Components with Known Vulnerabilities
CWE-1035 OWASP Top Ten 2017 Category A9 - Using Components with Known Vulnerabilities
CWE-119 Improper Restriction of Operations within the Bounds of a Memory Buffer
System Score Found at
cvssv3.1 9.8 https://access.redhat.com/errata/RHSA-2020:0566
generic_textual CRITICAL https://access.redhat.com/errata/RHSA-2020:0566
cvssv3.1 9.8 https://access.redhat.com/errata/RHSA-2020:0578
generic_textual CRITICAL https://access.redhat.com/errata/RHSA-2020:0578
cvssv3.1 9.8 https://access.redhat.com/errata/RHSA-2020:0580
generic_textual CRITICAL https://access.redhat.com/errata/RHSA-2020:0580
cvssv3.1 9.8 https://access.redhat.com/errata/RHSA-2020:0681
generic_textual CRITICAL https://access.redhat.com/errata/RHSA-2020:0681
cvssv3.1 9.8 https://access.redhat.com/errata/RHSA-2020:0683
generic_textual CRITICAL https://access.redhat.com/errata/RHSA-2020:0683
cvssv3.1 9.8 https://access.redhat.com/errata/RHSA-2020:0694
generic_textual CRITICAL https://access.redhat.com/errata/RHSA-2020:0694
cvssv3 9.8 https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2020-5312.json
epss 0.01002 https://api.first.org/data/v1/epss?cve=CVE-2020-5312
epss 0.01002 https://api.first.org/data/v1/epss?cve=CVE-2020-5312
epss 0.01002 https://api.first.org/data/v1/epss?cve=CVE-2020-5312
epss 0.01002 https://api.first.org/data/v1/epss?cve=CVE-2020-5312
epss 0.01002 https://api.first.org/data/v1/epss?cve=CVE-2020-5312
epss 0.01002 https://api.first.org/data/v1/epss?cve=CVE-2020-5312
epss 0.01002 https://api.first.org/data/v1/epss?cve=CVE-2020-5312
epss 0.01002 https://api.first.org/data/v1/epss?cve=CVE-2020-5312
epss 0.01002 https://api.first.org/data/v1/epss?cve=CVE-2020-5312
epss 0.01002 https://api.first.org/data/v1/epss?cve=CVE-2020-5312
epss 0.01002 https://api.first.org/data/v1/epss?cve=CVE-2020-5312
epss 0.01002 https://api.first.org/data/v1/epss?cve=CVE-2020-5312
epss 0.01002 https://api.first.org/data/v1/epss?cve=CVE-2020-5312
epss 0.01002 https://api.first.org/data/v1/epss?cve=CVE-2020-5312
epss 0.01002 https://api.first.org/data/v1/epss?cve=CVE-2020-5312
epss 0.01002 https://api.first.org/data/v1/epss?cve=CVE-2020-5312
epss 0.01002 https://api.first.org/data/v1/epss?cve=CVE-2020-5312
epss 0.01002 https://api.first.org/data/v1/epss?cve=CVE-2020-5312
epss 0.0229 https://api.first.org/data/v1/epss?cve=CVE-2020-5312
epss 0.0229 https://api.first.org/data/v1/epss?cve=CVE-2020-5312
epss 0.0229 https://api.first.org/data/v1/epss?cve=CVE-2020-5312
epss 0.0229 https://api.first.org/data/v1/epss?cve=CVE-2020-5312
epss 0.0229 https://api.first.org/data/v1/epss?cve=CVE-2020-5312
epss 0.0229 https://api.first.org/data/v1/epss?cve=CVE-2020-5312
epss 0.0229 https://api.first.org/data/v1/epss?cve=CVE-2020-5312
epss 0.0229 https://api.first.org/data/v1/epss?cve=CVE-2020-5312
epss 0.0229 https://api.first.org/data/v1/epss?cve=CVE-2020-5312
epss 0.0229 https://api.first.org/data/v1/epss?cve=CVE-2020-5312
cvssv3.1 8.8 https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml
cvssv3.1 9.8 https://github.com/advisories/GHSA-p49h-hjvm-jg3h
cvssv3.1_qr CRITICAL https://github.com/advisories/GHSA-p49h-hjvm-jg3h
generic_textual CRITICAL https://github.com/advisories/GHSA-p49h-hjvm-jg3h
cvssv3.1 9.8 https://github.com/pypa/advisory-database/tree/main/vulns/pillow/PYSEC-2020-83.yaml
generic_textual CRITICAL https://github.com/pypa/advisory-database/tree/main/vulns/pillow/PYSEC-2020-83.yaml
cvssv3.1 9.8 https://github.com/pypa/advisory-db/blob/7872b0a91b4d980f749e6d75a81f8cc1af32829f/vulns/pillow/PYSEC-2020-83.yaml
generic_textual CRITICAL https://github.com/pypa/advisory-db/blob/7872b0a91b4d980f749e6d75a81f8cc1af32829f/vulns/pillow/PYSEC-2020-83.yaml
cvssv3.1 9.8 https://github.com/python-pillow/Pillow
generic_textual CRITICAL https://github.com/python-pillow/Pillow
cvssv3.1 9.8 https://github.com/python-pillow/Pillow/commit/93b22b846e0269ee9594ff71a72bec02d2bea8fd
generic_textual CRITICAL https://github.com/python-pillow/Pillow/commit/93b22b846e0269ee9594ff71a72bec02d2bea8fd
cvssv3.1 9.8 https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/2MMU3WT2X64GS5WHDPKKC2WZA7UIIQ3A
generic_textual CRITICAL https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/2MMU3WT2X64GS5WHDPKKC2WZA7UIIQ3A
cvssv3.1 9.8 https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/3DUMIBUYGJRAVJCTFUWBRLVQKOUTVX5P
generic_textual CRITICAL https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/3DUMIBUYGJRAVJCTFUWBRLVQKOUTVX5P
cvssv2 7.5 https://nvd.nist.gov/vuln/detail/CVE-2020-5312
cvssv3.1 9.8 https://nvd.nist.gov/vuln/detail/CVE-2020-5312
generic_textual CRITICAL https://nvd.nist.gov/vuln/detail/CVE-2020-5312
cvssv3.1 9.8 https://pillow.readthedocs.io/en/stable/releasenotes/6.2.2.html
generic_textual CRITICAL https://pillow.readthedocs.io/en/stable/releasenotes/6.2.2.html
cvssv3.1 9.8 https://usn.ubuntu.com/4272-1
generic_textual CRITICAL https://usn.ubuntu.com/4272-1
cvssv3.1 9.8 https://www.debian.org/security/2020/dsa-4631
generic_textual CRITICAL https://www.debian.org/security/2020/dsa-4631
Reference id Reference type URL
https://access.redhat.com/errata/RHSA-2020:0566
https://access.redhat.com/errata/RHSA-2020:0578
https://access.redhat.com/errata/RHSA-2020:0580
https://access.redhat.com/errata/RHSA-2020:0681
https://access.redhat.com/errata/RHSA-2020:0683
https://access.redhat.com/errata/RHSA-2020:0694
https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2020-5312.json
https://api.first.org/data/v1/epss?cve=CVE-2020-5312
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-19911
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-5312
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-5313
https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml
https://github.com/advisories/GHSA-p49h-hjvm-jg3h
https://github.com/pypa/advisory-database/tree/main/vulns/pillow/PYSEC-2020-83.yaml
https://github.com/pypa/advisory-db/blob/7872b0a91b4d980f749e6d75a81f8cc1af32829f/vulns/pillow/PYSEC-2020-83.yaml
https://github.com/python-pillow/Pillow
https://github.com/python-pillow/Pillow/commit/93b22b846e0269ee9594ff71a72bec02d2bea8fd
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/2MMU3WT2X64GS5WHDPKKC2WZA7UIIQ3A/
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/3DUMIBUYGJRAVJCTFUWBRLVQKOUTVX5P/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/2MMU3WT2X64GS5WHDPKKC2WZA7UIIQ3A
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/2MMU3WT2X64GS5WHDPKKC2WZA7UIIQ3A/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/3DUMIBUYGJRAVJCTFUWBRLVQKOUTVX5P
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/3DUMIBUYGJRAVJCTFUWBRLVQKOUTVX5P/
https://nvd.nist.gov/vuln/detail/CVE-2020-5312
https://pillow.readthedocs.io/en/stable/releasenotes/6.2.2.html
https://usn.ubuntu.com/4272-1
https://usn.ubuntu.com/4272-1/
https://www.debian.org/security/2020/dsa-4631
1789533 https://bugzilla.redhat.com/show_bug.cgi?id=1789533
948224 https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=948224
cpe:2.3:a:python:pillow:*:*:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:python:pillow:*:*:*:*:*:*:*:*
cpe:2.3:o:canonical:ubuntu_linux:14.04:*:*:*:esm:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:o:canonical:ubuntu_linux:14.04:*:*:*:esm:*:*:*
cpe:2.3:o:canonical:ubuntu_linux:16.04:*:*:*:lts:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:o:canonical:ubuntu_linux:16.04:*:*:*:lts:*:*:*
cpe:2.3:o:canonical:ubuntu_linux:18.04:*:*:*:lts:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:o:canonical:ubuntu_linux:18.04:*:*:*:lts:*:*:*
cpe:2.3:o:canonical:ubuntu_linux:19.10:*:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:o:canonical:ubuntu_linux:19.10:*:*:*:*:*:*:*
cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*
cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*
cpe:2.3:o:fedoraproject:fedora:30:*:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:o:fedoraproject:fedora:30:*:*:*:*:*:*:*
cpe:2.3:o:fedoraproject:fedora:31:*:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:o:fedoraproject:fedora:31:*:*:*:*:*:*:*
RHSA-2020:0898 https://access.redhat.com/errata/RHSA-2020:0898
RHSA-2021:0420 https://access.redhat.com/errata/RHSA-2021:0420
No exploits are available.
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H Found at https://access.redhat.com/errata/RHSA-2020:0566
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H Found at https://access.redhat.com/errata/RHSA-2020:0578
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H Found at https://access.redhat.com/errata/RHSA-2020:0580
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H Found at https://access.redhat.com/errata/RHSA-2020:0681
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H Found at https://access.redhat.com/errata/RHSA-2020:0683
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H Found at https://access.redhat.com/errata/RHSA-2020:0694
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H Found at https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2020-5312.json
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H Found at https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H Found at https://github.com/advisories/GHSA-p49h-hjvm-jg3h
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H Found at https://github.com/pypa/advisory-database/tree/main/vulns/pillow/PYSEC-2020-83.yaml
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H Found at https://github.com/pypa/advisory-db/blob/7872b0a91b4d980f749e6d75a81f8cc1af32829f/vulns/pillow/PYSEC-2020-83.yaml
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H Found at https://github.com/python-pillow/Pillow
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H Found at https://github.com/python-pillow/Pillow/commit/93b22b846e0269ee9594ff71a72bec02d2bea8fd
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H Found at https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/2MMU3WT2X64GS5WHDPKKC2WZA7UIIQ3A
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H Found at https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/3DUMIBUYGJRAVJCTFUWBRLVQKOUTVX5P
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P Found at https://nvd.nist.gov/vuln/detail/CVE-2020-5312
Exploitability (E) Access Vector (AV) Access Complexity (AC) Authentication (Au) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

high

functional

unproven

proof_of_concept

not_defined

local

adjacent_network

network

high

medium

low

multiple

single

none

none

partial

complete

none

partial

complete

none

partial

complete
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H Found at https://nvd.nist.gov/vuln/detail/CVE-2020-5312
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H Found at https://pillow.readthedocs.io/en/stable/releasenotes/6.2.2.html
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H Found at https://usn.ubuntu.com/4272-1
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H Found at https://www.debian.org/security/2020/dsa-4631
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Exploit Prediction Scoring System (EPSS)
Percentile 0.76075
EPSS Score 0.01002
Published At July 30, 2025, 12:55 p.m.
Date Actor Action Source VulnerableCode Version
2025-07-31T08:08:06.872956+00:00 Pypa Importer Import https://github.com/pypa/advisory-database/blob/main/vulns/pillow/PYSEC-2020-83.yaml 37.0.0