Search for vulnerabilities
Vulnerability details: VCID-wwmf-jaer-aaaf
Vulnerability ID VCID-wwmf-jaer-aaaf
Aliases BIT-2020-11538
BIT-pillow-2020-11538
CVE-2020-11538
GHSA-43fq-w8qq-v88h
PYSEC-2020-80
Summary In libImaging/SgiRleDecode.c in Pillow through 7.0.0, a number of out-of-bounds reads exist in the parsing of SGI image files, a different issue than CVE-2020-5311.
Status Published
Exploitability 0.5
Weighted Severity 9.0
Risk 4.5
Affected and Fixed Packages Package Details
Weaknesses (4)
CWE-125 Out-of-bounds Read
CWE-1035 OWASP Top Ten 2017 Category A9 - Using Components with Known Vulnerabilities
CWE-937 OWASP Top Ten 2013 Category A9 - Using Components with Known Vulnerabilities
CWE-122 Heap-based Buffer Overflow
System Score Found at
generic_textual Low http://people.canonical.com/~ubuntu-security/cve/2020/CVE-2020-11538.html
rhas Important https://access.redhat.com/errata/RHSA-2020:3185
rhas Important https://access.redhat.com/errata/RHSA-2020:3299
rhas Important https://access.redhat.com/errata/RHSA-2020:3302
rhas Moderate https://access.redhat.com/errata/RHSA-2021:0420
cvssv3 8.1 https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2020-11538.json
epss 0.00506 https://api.first.org/data/v1/epss?cve=CVE-2020-11538
epss 0.00506 https://api.first.org/data/v1/epss?cve=CVE-2020-11538
epss 0.00506 https://api.first.org/data/v1/epss?cve=CVE-2020-11538
epss 0.00506 https://api.first.org/data/v1/epss?cve=CVE-2020-11538
epss 0.00506 https://api.first.org/data/v1/epss?cve=CVE-2020-11538
epss 0.00506 https://api.first.org/data/v1/epss?cve=CVE-2020-11538
epss 0.00506 https://api.first.org/data/v1/epss?cve=CVE-2020-11538
epss 0.00506 https://api.first.org/data/v1/epss?cve=CVE-2020-11538
epss 0.00506 https://api.first.org/data/v1/epss?cve=CVE-2020-11538
epss 0.00506 https://api.first.org/data/v1/epss?cve=CVE-2020-11538
epss 0.00506 https://api.first.org/data/v1/epss?cve=CVE-2020-11538
epss 0.00506 https://api.first.org/data/v1/epss?cve=CVE-2020-11538
epss 0.00506 https://api.first.org/data/v1/epss?cve=CVE-2020-11538
epss 0.00506 https://api.first.org/data/v1/epss?cve=CVE-2020-11538
epss 0.00506 https://api.first.org/data/v1/epss?cve=CVE-2020-11538
epss 0.00506 https://api.first.org/data/v1/epss?cve=CVE-2020-11538
epss 0.00506 https://api.first.org/data/v1/epss?cve=CVE-2020-11538
epss 0.00506 https://api.first.org/data/v1/epss?cve=CVE-2020-11538
epss 0.00506 https://api.first.org/data/v1/epss?cve=CVE-2020-11538
epss 0.00506 https://api.first.org/data/v1/epss?cve=CVE-2020-11538
epss 0.00506 https://api.first.org/data/v1/epss?cve=CVE-2020-11538
epss 0.00506 https://api.first.org/data/v1/epss?cve=CVE-2020-11538
epss 0.00506 https://api.first.org/data/v1/epss?cve=CVE-2020-11538
epss 0.00506 https://api.first.org/data/v1/epss?cve=CVE-2020-11538
epss 0.00506 https://api.first.org/data/v1/epss?cve=CVE-2020-11538
epss 0.00506 https://api.first.org/data/v1/epss?cve=CVE-2020-11538
epss 0.00506 https://api.first.org/data/v1/epss?cve=CVE-2020-11538
epss 0.00506 https://api.first.org/data/v1/epss?cve=CVE-2020-11538
epss 0.00506 https://api.first.org/data/v1/epss?cve=CVE-2020-11538
epss 0.00506 https://api.first.org/data/v1/epss?cve=CVE-2020-11538
epss 0.00506 https://api.first.org/data/v1/epss?cve=CVE-2020-11538
epss 0.00506 https://api.first.org/data/v1/epss?cve=CVE-2020-11538
epss 0.00506 https://api.first.org/data/v1/epss?cve=CVE-2020-11538
epss 0.00506 https://api.first.org/data/v1/epss?cve=CVE-2020-11538
epss 0.00506 https://api.first.org/data/v1/epss?cve=CVE-2020-11538
epss 0.00506 https://api.first.org/data/v1/epss?cve=CVE-2020-11538
epss 0.00506 https://api.first.org/data/v1/epss?cve=CVE-2020-11538
epss 0.00506 https://api.first.org/data/v1/epss?cve=CVE-2020-11538
epss 0.00506 https://api.first.org/data/v1/epss?cve=CVE-2020-11538
epss 0.00506 https://api.first.org/data/v1/epss?cve=CVE-2020-11538
epss 0.00506 https://api.first.org/data/v1/epss?cve=CVE-2020-11538
epss 0.00506 https://api.first.org/data/v1/epss?cve=CVE-2020-11538
epss 0.00506 https://api.first.org/data/v1/epss?cve=CVE-2020-11538
epss 0.00506 https://api.first.org/data/v1/epss?cve=CVE-2020-11538
epss 0.00506 https://api.first.org/data/v1/epss?cve=CVE-2020-11538
epss 0.00506 https://api.first.org/data/v1/epss?cve=CVE-2020-11538
epss 0.00506 https://api.first.org/data/v1/epss?cve=CVE-2020-11538
epss 0.00506 https://api.first.org/data/v1/epss?cve=CVE-2020-11538
epss 0.00506 https://api.first.org/data/v1/epss?cve=CVE-2020-11538
epss 0.00506 https://api.first.org/data/v1/epss?cve=CVE-2020-11538
epss 0.00506 https://api.first.org/data/v1/epss?cve=CVE-2020-11538
epss 0.00506 https://api.first.org/data/v1/epss?cve=CVE-2020-11538
epss 0.00506 https://api.first.org/data/v1/epss?cve=CVE-2020-11538
epss 0.00506 https://api.first.org/data/v1/epss?cve=CVE-2020-11538
epss 0.00506 https://api.first.org/data/v1/epss?cve=CVE-2020-11538
epss 0.00506 https://api.first.org/data/v1/epss?cve=CVE-2020-11538
epss 0.00506 https://api.first.org/data/v1/epss?cve=CVE-2020-11538
epss 0.00506 https://api.first.org/data/v1/epss?cve=CVE-2020-11538
epss 0.00506 https://api.first.org/data/v1/epss?cve=CVE-2020-11538
epss 0.00506 https://api.first.org/data/v1/epss?cve=CVE-2020-11538
epss 0.00506 https://api.first.org/data/v1/epss?cve=CVE-2020-11538
epss 0.00506 https://api.first.org/data/v1/epss?cve=CVE-2020-11538
epss 0.00506 https://api.first.org/data/v1/epss?cve=CVE-2020-11538
epss 0.00506 https://api.first.org/data/v1/epss?cve=CVE-2020-11538
epss 0.00506 https://api.first.org/data/v1/epss?cve=CVE-2020-11538
epss 0.00506 https://api.first.org/data/v1/epss?cve=CVE-2020-11538
epss 0.00506 https://api.first.org/data/v1/epss?cve=CVE-2020-11538
epss 0.00506 https://api.first.org/data/v1/epss?cve=CVE-2020-11538
epss 0.00506 https://api.first.org/data/v1/epss?cve=CVE-2020-11538
epss 0.00506 https://api.first.org/data/v1/epss?cve=CVE-2020-11538
epss 0.00506 https://api.first.org/data/v1/epss?cve=CVE-2020-11538
epss 0.00506 https://api.first.org/data/v1/epss?cve=CVE-2020-11538
epss 0.01228 https://api.first.org/data/v1/epss?cve=CVE-2020-11538
epss 0.01228 https://api.first.org/data/v1/epss?cve=CVE-2020-11538
epss 0.01228 https://api.first.org/data/v1/epss?cve=CVE-2020-11538
epss 0.01228 https://api.first.org/data/v1/epss?cve=CVE-2020-11538
epss 0.01228 https://api.first.org/data/v1/epss?cve=CVE-2020-11538
epss 0.01228 https://api.first.org/data/v1/epss?cve=CVE-2020-11538
epss 0.01228 https://api.first.org/data/v1/epss?cve=CVE-2020-11538
epss 0.01228 https://api.first.org/data/v1/epss?cve=CVE-2020-11538
epss 0.01228 https://api.first.org/data/v1/epss?cve=CVE-2020-11538
epss 0.01228 https://api.first.org/data/v1/epss?cve=CVE-2020-11538
epss 0.01228 https://api.first.org/data/v1/epss?cve=CVE-2020-11538
epss 0.01450 https://api.first.org/data/v1/epss?cve=CVE-2020-11538
epss 0.01450 https://api.first.org/data/v1/epss?cve=CVE-2020-11538
epss 0.01450 https://api.first.org/data/v1/epss?cve=CVE-2020-11538
epss 0.01450 https://api.first.org/data/v1/epss?cve=CVE-2020-11538
epss 0.0161 https://api.first.org/data/v1/epss?cve=CVE-2020-11538
rhbs high https://bugzilla.redhat.com/show_bug.cgi?id=1852814
generic_textual Low https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-11538
cvssv3.1 8.1 https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml
cvssv3.1_qr CRITICAL https://github.com/advisories/GHSA-43fq-w8qq-v88h
cvssv3.1_qr HIGH https://github.com/advisories/GHSA-43fq-w8qq-v88h
cvssv3.1 8.1 https://github.com/pypa/advisory-database/tree/main/vulns/pillow/PYSEC-2020-80.yaml
generic_textual CRITICAL https://github.com/pypa/advisory-database/tree/main/vulns/pillow/PYSEC-2020-80.yaml
cvssv3.1 6.7 https://github.com/python-pillow/Pillow
generic_textual MODERATE https://github.com/python-pillow/Pillow
cvssv3.1 8.1 https://github.com/python-pillow/Pillow/blob/master/docs/releasenotes/7.1.0.rst#security
generic_textual HIGH https://github.com/python-pillow/Pillow/blob/master/docs/releasenotes/7.1.0.rst#security
cvssv3.1 8.1 https://github.com/python-pillow/Pillow/commit/2ef59fdbaeb756bc512ab3f2ad15ac45665b303d
generic_textual HIGH https://github.com/python-pillow/Pillow/commit/2ef59fdbaeb756bc512ab3f2ad15ac45665b303d
cvssv3.1 8.1 https://github.com/python-pillow/Pillow/pull/4504
generic_textual HIGH https://github.com/python-pillow/Pillow/pull/4504
cvssv3.1 8.1 https://github.com/python-pillow/Pillow/pull/4538
generic_textual HIGH https://github.com/python-pillow/Pillow/pull/4538
cvssv3.1 8.1 https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/BEBCPE4F2VHTIT6EZA2YZQZLPVDEBJGD
generic_textual HIGH https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/BEBCPE4F2VHTIT6EZA2YZQZLPVDEBJGD
cvssv3.1 8.1 https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/HOKHNWV2VS5GESY7IBD237E7C6T3I427
generic_textual HIGH https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/HOKHNWV2VS5GESY7IBD237E7C6T3I427
cvssv2 6.8 https://nvd.nist.gov/vuln/detail/CVE-2020-11538
cvssv3 8.1 https://nvd.nist.gov/vuln/detail/CVE-2020-11538
cvssv3.1 8.1 https://nvd.nist.gov/vuln/detail/CVE-2020-11538
cvssv3.1 8.1 https://pillow.readthedocs.io/en/stable/releasenotes/7.1.0.html
generic_textual HIGH https://pillow.readthedocs.io/en/stable/releasenotes/7.1.0.html
cvssv3.1 9.8 https://pillow.readthedocs.io/en/stable/releasenotes/index.html
generic_textual CRITICAL https://pillow.readthedocs.io/en/stable/releasenotes/index.html
cvssv3.1 8.1 https://snyk.io/vuln/SNYK-PYTHON-PILLOW-574574
generic_textual HIGH https://snyk.io/vuln/SNYK-PYTHON-PILLOW-574574
generic_textual Low https://ubuntu.com/security/notices/USN-4430-1
generic_textual Low https://ubuntu.com/security/notices/USN-4430-2
cvssv3.1 8.1 https://usn.ubuntu.com/4430-1
generic_textual HIGH https://usn.ubuntu.com/4430-1
cvssv3.1 8.1 https://usn.ubuntu.com/4430-2
generic_textual HIGH https://usn.ubuntu.com/4430-2
Reference id Reference type URL
http://people.canonical.com/~ubuntu-security/cve/2020/CVE-2020-11538.html
https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2020-11538.json
https://api.first.org/data/v1/epss?cve=CVE-2020-11538
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-11538
https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml
https://github.com/pypa/advisory-database/tree/main/vulns/pillow/PYSEC-2020-80.yaml
https://github.com/python-pillow/Pillow
https://github.com/python-pillow/Pillow/blob/master/docs/releasenotes/7.1.0.rst#security
https://github.com/python-pillow/Pillow/commit/2ef59fdbaeb756bc512ab3f2ad15ac45665b303d
https://github.com/python-pillow/Pillow/pull/4504
https://github.com/python-pillow/Pillow/pull/4538
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/BEBCPE4F2VHTIT6EZA2YZQZLPVDEBJGD/
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HOKHNWV2VS5GESY7IBD237E7C6T3I427/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/BEBCPE4F2VHTIT6EZA2YZQZLPVDEBJGD
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/BEBCPE4F2VHTIT6EZA2YZQZLPVDEBJGD/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/HOKHNWV2VS5GESY7IBD237E7C6T3I427
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/HOKHNWV2VS5GESY7IBD237E7C6T3I427/
https://pillow.readthedocs.io/en/stable/releasenotes/7.1.0.html
https://pillow.readthedocs.io/en/stable/releasenotes/index.html
https://snyk.io/vuln/SNYK-PYTHON-PILLOW-574574
https://ubuntu.com/security/notices/USN-4430-1
https://ubuntu.com/security/notices/USN-4430-2
https://usn.ubuntu.com/4430-1
https://usn.ubuntu.com/4430-1/
https://usn.ubuntu.com/4430-2
https://usn.ubuntu.com/4430-2/
1852814 https://bugzilla.redhat.com/show_bug.cgi?id=1852814
cpe:2.3:a:python:pillow:*:*:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:python:pillow:*:*:*:*:*:*:*:*
cpe:2.3:o:canonical:ubuntu_linux:16.04:*:*:*:esm:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:o:canonical:ubuntu_linux:16.04:*:*:*:esm:*:*:*
cpe:2.3:o:canonical:ubuntu_linux:18.04:*:*:*:lts:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:o:canonical:ubuntu_linux:18.04:*:*:*:lts:*:*:*
cpe:2.3:o:canonical:ubuntu_linux:20.04:*:*:*:lts:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:o:canonical:ubuntu_linux:20.04:*:*:*:lts:*:*:*
cpe:2.3:o:fedoraproject:fedora:31:*:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:o:fedoraproject:fedora:31:*:*:*:*:*:*:*
cpe:2.3:o:fedoraproject:fedora:32:*:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:o:fedoraproject:fedora:32:*:*:*:*:*:*:*
CVE-2020-11538 https://nvd.nist.gov/vuln/detail/CVE-2020-11538
GHSA-43fq-w8qq-v88h https://github.com/advisories/GHSA-43fq-w8qq-v88h
RHSA-2020:3185 https://access.redhat.com/errata/RHSA-2020:3185
RHSA-2020:3299 https://access.redhat.com/errata/RHSA-2020:3299
RHSA-2020:3302 https://access.redhat.com/errata/RHSA-2020:3302
RHSA-2021:0420 https://access.redhat.com/errata/RHSA-2021:0420
No exploits are available.
Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H Found at https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2020-11538.json
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H Found at https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H Found at https://github.com/pypa/advisory-database/tree/main/vulns/pillow/PYSEC-2020-80.yaml
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H Found at https://github.com/python-pillow/Pillow
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H Found at https://github.com/python-pillow/Pillow/blob/master/docs/releasenotes/7.1.0.rst#security
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H Found at https://github.com/python-pillow/Pillow/commit/2ef59fdbaeb756bc512ab3f2ad15ac45665b303d
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H Found at https://github.com/python-pillow/Pillow/pull/4504
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H Found at https://github.com/python-pillow/Pillow/pull/4538
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H Found at https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/BEBCPE4F2VHTIT6EZA2YZQZLPVDEBJGD
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H Found at https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/HOKHNWV2VS5GESY7IBD237E7C6T3I427
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: AV:N/AC:M/Au:N/C:P/I:P/A:P Found at https://nvd.nist.gov/vuln/detail/CVE-2020-11538
Exploitability (E) Access Vector (AV) Access Complexity (AC) Authentication (Au) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

high

functional

unproven

proof_of_concept

not_defined

local

adjacent_network

network

high

medium

low

multiple

single

none

none

partial

complete

none

partial

complete

none

partial

complete
Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H Found at https://nvd.nist.gov/vuln/detail/CVE-2020-11538
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H Found at https://nvd.nist.gov/vuln/detail/CVE-2020-11538
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H Found at https://pillow.readthedocs.io/en/stable/releasenotes/7.1.0.html
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H Found at https://pillow.readthedocs.io/en/stable/releasenotes/index.html
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H Found at https://snyk.io/vuln/SNYK-PYTHON-PILLOW-574574
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H Found at https://usn.ubuntu.com/4430-1
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H Found at https://usn.ubuntu.com/4430-2
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Exploit Prediction Scoring System (EPSS)
Percentile 0.6352
EPSS Score 0.00506
Published At March 28, 2025, 12:55 p.m.
Date Actor Action Source VulnerableCode Version
There are no relevant records.