CVE-2020-10177

Pillow before 7.1.0 has multiple out-of-bounds reads in libImaging/FliDecode.c.

• CWE-125

• https://github.com/python-pillow/Pillow/commits/master/src/libImagingBroken Link
• https://github.com/python-pillow/Pillow/pull/4503Issue Tracking, Patch
• https://github.com/python-pillow/Pillow/pull/4538Issue Tracking, Patch
• https://lists.debian.org/debian-lts-announce/2020/08/msg00012.htmlMailing List, Third Party Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/BEBCPE4F2VHTIT6EZA2YZQZLPVDEBJGD/
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HOKHNWV2VS5GESY7IBD237E7C6T3I427/
• https://pillow.readthedocs.io/en/stable/releasenotes/7.1.0.htmlProduct
• https://usn.ubuntu.com/4430-1/Third Party Advisory
• https://usn.ubuntu.com/4430-2/Third Party Advisory
• https://github.com/python-pillow/Pillow/commits/master/src/libImagingBroken Link
• https://github.com/python-pillow/Pillow/pull/4503Issue Tracking, Patch
• https://github.com/python-pillow/Pillow/pull/4538Issue Tracking, Patch
• https://lists.debian.org/debian-lts-announce/2020/08/msg00012.htmlMailing List, Third Party Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/BEBCPE4F2VHTIT6EZA2YZQZLPVDEBJGD/
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HOKHNWV2VS5GESY7IBD237E7C6T3I427/
• https://pillow.readthedocs.io/en/stable/releasenotes/7.1.0.htmlProduct
• https://usn.ubuntu.com/4430-1/Third Party Advisory
• https://usn.ubuntu.com/4430-2/Third Party Advisory

Published

Jun 25, 2020

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2020-1016An information disclosure vulnerability exists when the Wind…5.5
• CVE-2020-1017An elevation of privilege vulnerability exists in the way th…7.8
• CVE-2020-10173Comtrend VR-3033 DE11-416SSG-C01_R02.A2pvI042j1.d26m devices…8.8
• CVE-2020-10174init_tmp in TeeJee.FileSystem.vala in Timeshift before 20.03…7
• CVE-2020-10175Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…
• CVE-2020-10176ASSA ABLOY Yale WIPC-301W 2.x.2.29 through 2.x.2.43_p1 devic…9.8
• CVE-2020-10178Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…
• CVE-2020-1018An information disclosure vulnerability exists when Microsof…7.5
• CVE-2020-10180The ESET AV parsing engine allows virus-detection bypass via…9.8
• CVE-2020-10181goform/formEMR30 in Sumavision Enhanced Multimedia Router (E…9.8
• CVE-2020-10184The verify endpoint in YubiKey Validation Server before 2.40…7.5
• CVE-2020-10185The sync endpoint in YubiKey Validation Server before 2.40 a…8.6