Published: 13/07/2021 Updated: 07/11/2023

CVSS v2 Base Score: 7.5 | Impact Score: 6.4 | Exploitability Score: 10

CVSS v3 Base Score: 9.8 | Impact Score: 5.9 | Exploitability Score: 3.9

VMScore: 668

Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P

Pillow up to and including 8.2.0 and PIL (aka Python Imaging Library) up to and including 1.1.7 allow an malicious user to pass controlled parameters directly into a convert function to trigger a buffer overflow in Convert.c.

Vulnerable Product	Search on Vulmon	Subscribe to Product
python pillow
debian debian linux 9.0
fedoraproject fedora 33
fedoraproject fedora 34

Debian Bug report logs - #991293 pillow: CVE-2021-34552 - buffer overflow in Convertc Package: src:pillow; Maintainer for src:pillow is Matthias Klose <doko@debianorg>; Reported by: Neil Williams <codehelp@debianorg> Date: Tue, 20 Jul 2021 05:39:01 UTC Severity: grave Tags: security Found in version pillow/812+ ...

An incomplete fix was discovered in Pillow ...

Pillow before 270 allows remote attackers to cause a denial of service via a compressed text chunk in a PNG image that has a large size when it is decompressed (CVE-2014-9601) Pillow before 332 allows context-dependent attackers to execute arbitrary code by using the "crafted image file" approach, related to an "Insecure Sign Extension" issue ...

Pillow through 820 allows an attacker to pass controlled parameters directly into a convert function to trigger a buffer overflow in Convertc ...

CWE-120 https://pillow.readthedocs.io/en/stable/releasenotes/index.html https://pillow.readthedocs.io/en/stable/releasenotes/8.3.0.html#buffer-overflow https://lists.debian.org/debian-lts-announce/2021/07/msg00018.html https://security.gentoo.org/glsa/202211-10 https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/7V6LCG525ARIX6LX5QRYNAWVDD2MD2SV/https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VUGBBT63VL7G4JNOEIPDJIOC34ZFBKNJ/https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=991293 https://nvd.nist.gov https://ubuntu.com/security/notices/USN-5227-3

CVE-2021-34552

Vulnerability Summary

Vulnerability Trend

Vendor Advisories

References

Vulmon Search

About

Products

Connect