CVE-2020-35653: 
Python vulnerability analysis and mitigation

CVE-2020-35653 affects Pillow versions before 8.1.0, where a buffer over-read vulnerability exists in the PcxDecode functionality when decoding a crafted PCX file. The vulnerability occurs because the user-supplied stride value is trusted for buffer calculations (NVD).

The vulnerability has been assigned a CVSS v3.1 base score of 7.1 (High), with the vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H. The vulnerability is classified as CWE-125 (Out-of-bounds Read) and affects the buffer calculations in the PcxDecode functionality (NVD).

When exploited, this vulnerability could allow an attacker to cause a buffer over-read condition when processing crafted PCX files. This could potentially lead to information disclosure and system availability impacts (NVD).

The vulnerability requires user interaction to process a maliciously crafted PCX file. The attack vector is network-based with low attack complexity and requires no privileges for exploitation (NVD).

The vulnerability has been fixed in Pillow version 8.1.0. Users are advised to upgrade to this version or later. Multiple distributions have released security updates including Debian (version 4.0.0-4+deb9u3), Fedora 32 (version 7.0.0-5.fc32), and Fedora 33 (version 7.2.0-3.fc33) (Debian LTS, Fedora Update).