GHSA-7r7m-5h27-29hp

Potential infinite loop in Pillow

Source: GitHub Advisory Database (reviewed) High CVE-2021-28676

Packages

Ecosystem	Package	Affected	Fixed in
PyPI	pillow	< 8.2.0	8.2.0

Details

As written in the advisory (Markdown source, shown as plain text).

An issue was discovered in Pillow before 8.2.0. For FLI data, FliDecode did not properly check that the block advance was non-zero, potentially leading to an infinite loop on load.

References

External links from the advisory. They lead to third-party sites.

https://nvd.nist.gov/vuln/detail/CVE-2021-28676 advisory
https://github.com/python-pillow/Pillow/pull/5377 web
https://github.com/python-pillow/Pillow/commit/bb6c11fb889e6c11b0ee122b828132ee763b5856 web
https://github.com/advisories/GHSA-7r7m-5h27-29hp advisory
https://github.com/pypa/advisory-database/tree/main/vulns/pillow/PYSEC-2021-92.yaml web
https://github.com/python-pillow/Pillow package
https://lists.debian.org/debian-lts-announce/2021/07/msg00018.html web
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/MQHA5HAIBOYI3R6HDWCLAGFTIQP767FL web
https://lists.fedoraproject.org/archives/list/[email protected]/message/MQHA5HAIBOYI3R6HDWCLAGFTIQP767FL web
https://pillow.readthedocs.io/en/stable/releasenotes/8.2.0.html#cve-2021-28676-fix-fli-dos web
https://security.gentoo.org/glsa/202107-33 web