GHSA-7534-mm45-c74v

Buffer Overflow in Pillow

Source: GitHub Advisory Database (reviewed) Critical CVE-2021-34552

Packages

Ecosystem	Package	Affected	Fixed in
PyPI	pillow	< 8.3.0	8.3.0

Details

As written in the advisory (Markdown source, shown as plain text).

Pillow through 8.2.0 and PIL (aka Python Imaging Library) through 1.1.7 allow an attacker to pass controlled parameters directly into a convert function to trigger a buffer overflow in Convert.c.

References

External links from the advisory. They lead to third-party sites.

https://nvd.nist.gov/vuln/detail/CVE-2021-34552 advisory
https://github.com/python-pillow/Pillow/pull/5567 web
https://github.com/python-pillow/Pillow/commit/31c473898c29d1b7cb6555ce67d9503a4906b83f web
https://github.com/advisories/GHSA-7534-mm45-c74v advisory
https://github.com/pypa/advisory-database/tree/main/vulns/pillow/PYSEC-2021-331.yaml web
https://github.com/python-pillow/Pillow package
https://lists.debian.org/debian-lts-announce/2021/07/msg00018.html web
https://lists.fedoraproject.org/archives/list/[email protected]/message/7V6LCG525ARIX6LX5QRYNAWVDD2MD2SV web
https://lists.fedoraproject.org/archives/list/[email protected]/message/VUGBBT63VL7G4JNOEIPDJIOC34ZFBKNJ web
https://pillow.readthedocs.io/en/stable/releasenotes/8.3.0.html#buffer-overflow web
https://pillow.readthedocs.io/en/stable/releasenotes/index.html web
https://security.gentoo.org/glsa/202211-10 web