Skip to content
Heist/ feed
CriticalFix available

Potential buffer overflow in psd-tools

Type: advisorySource: OSV1 source record

### Impact An issue was discovered in psd-tools before 1.9.4. The Cython implementation of RLE decoding did not check for malformed PSD input data during decoding to the PIL.Image or NumPy format, leading to a Buffer Overflow. ### Patches Users of psd-tools version v1.8.37 to v1.9.3 should upgrade to v1.9.4. ### Workarounds Without Cython present on installation, buffer overflow does not occur but IndexError will be thrown. However, already installed psd-tools with Cython extention should be upgraded. ### References https://github.com/psd-tools/psd-tools/pull/198 ### For more information If you have any questions or comments about this advisory: * Open an issue in [psd-tools](https://github.com/psd-tools/psd-tools/issues)

Announced Source revision 1
Original source ↗

GHSA-22jr-vc7j-g762

Primary source · Revision 1

Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.

Security context

Source reference: osv:GHSA-22jr-vc7j-g762

psd-tools

Source reference: /affected/0/package/name

Affected versions
1.8.37

Source reference: /affected/0/versions

1.8.38

Source reference: /affected/0/versions

1.9.0

Source reference: /affected/0/versions

1.9.1

Source reference: /affected/0/versions

1.9.2

Source reference: /affected/0/versions

1.9.3

Source reference: /affected/0/versions

Fixed versions
1.9.4

Source reference: /affected/0/ranges

Prerequisites
Not stated in this record

Structured affected-version data

Original package identities and version rules from this source.

[
  {
    "ranges": [
      {
        "type": "ECOSYSTEM",
        "events": [
          {
            "introduced": "1.8.37"
          },
          {
            "fixed": "1.9.4"
          }
        ]
      }
    ],
    "package": {
      "name": "psd-tools",
      "purl": "pkg:pypi/psd-tools",
      "ecosystem": "PyPI"
    },
    "versions": [
      "1.8.37",
      "1.8.38",
      "1.9.0",
      "1.9.1",
      "1.9.2",
      "1.9.3"
    ],
    "database_specific": {
      "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2020/03/GHSA-22jr-vc7j-g762/GHSA-22jr-vc7j-g762.json",
      "last_known_affected_version_range": "<= 1.9.3"
    }
  }
]
Related CVEs
CVE-2020-10571

Source reference: /aliases

Publisher severity

critical

Source reference: /database_specific/severity

Event
#13824 · Revision 1
Added to Heist Feed
Publisher date
Read the original announcement