ALPINE-CVE-2020-35655

ALPINE-CVE-2020-35655 PUBLISHED CVSS 5.400000095367432 MEDIUM

In Pillow before 8.1.0, SGIRleDecode has a 4-byte buffer over-read when decoding crafted SGI RLE image files because offsets and length tables are mishandled.

Risk Scores

CVSS v3.1

5.400000095367432

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:L

Affected Products

Vendor	Product	Versions
Alpine:v3.13	py3-pillow	0, 7.1.1-r0, 7.1.2-r0
Alpine:v3.15	py3-pillow	7.1.1-r0, 7.1.2-r0, 7.2.0-r0
Alpine:v3.14	py3-pillow	7.2.0-r0, 0, 7.1.1-r0
Alpine:v3.12	py3-pillow	7.1.1-r0, 7.1.2-r0, 0

Timeline

Jan 12, 2021 CVE Published
Nov 19, 2025 CVE Updated
Apr 30, 2026 Distribution Patch

References

https://security.alpinelinux.org/vuln/CVE-2020-35655 advisory

Open in Interactive Console →