The vulnerability of the Convert.c component in the Pillow image processing library, related to buffer overflow in memory, allows an attacker to access confidential data, compromise its integrity, and cause service interruptions.

🗓️ 27 Oct 2021 00:00:00Reported by FSTEC of Russia — Information Security Threat DatabaseType

bdu_fstec

bdu_fstec🔗 bdu.fstec.ru👁 4 Views

Pillow Convert.c buffer overflow allows attackers to pass parameters, access data, and cause outages.

Reporter	Title	Published	Views	Family All 124
Tenable Nessus	Amazon Linux 2023 : python3-pillow, python3-pillow-devel, python3-pillow-tk (ALAS2023-2023-146)	23 Mar 202300:00	–	nessus
Tenable Nessus	Amazon Linux 2 : python-pillow (ALAS-2023-2083)	8 Jun 202300:00	–	nessus
Tenable Nessus	Alibaba Cloud Linux 3 : 0012: python-pillow (ALINUX3-SA-2022:0012)	14 May 202500:00	–	nessus
Tenable Nessus	AlmaLinux 8 : python-pillow (ALSA-2021:4149)	9 Feb 202200:00	–	nessus
Tenable Nessus	CentOS 8 : python-pillow (CESA-2021:4149)	11 Nov 202100:00	–	nessus
Tenable Nessus	Debian DLA-2716-1 : pillow - LTS security update	23 Jul 202100:00	–	nessus
Tenable Nessus	EulerOS 2.0 SP8 : python-pillow (EulerOS-SA-2021-2481)	24 Sep 202100:00	–	nessus
Tenable Nessus	EulerOS 2.0 SP5 : python-pillow (EulerOS-SA-2021-2518)	27 Sep 202100:00	–	nessus
Tenable Nessus	EulerOS 2.0 SP9 : python-pillow (EulerOS-SA-2021-2540)	27 Sep 202100:00	–	nessus
Tenable Nessus	EulerOS 2.0 SP9 : python-pillow (EulerOS-SA-2021-2564)	27 Sep 202100:00	–	nessus

Vulners

Node

uploadcare,_llc pillowRange1.0–1.1.7

OR

uploadcare,_llc pillowRange1.2–8.2.0

Source	Link
github	www.github.com/python-pillow/Pillow/commit/c546c5a4c01b0c6f1443e525d23a9266b02bb731
github	www.github.com/python-pillow/Pillow/pull/5567
nvd	www.nvd.nist.gov/vuln/detail/CVE-2021-34552
pillow	www.pillow.readthedocs.io/en/stable/releasenotes/8.3.0.html
security-tracker	www.security-tracker.debian.org/tracker/CVE-2021-34552
wiki	www.wiki.astralinux.ru/astra-linux-se16-bulletin-20211008SE16
xn--80ahaefyxhn	www.xn--80ahaefyxhn.xn--j1afgaq.xn--p1ai/bin/view/%D0%9E%D0%A1%D0%BD%D0%BE%D0%B2%D0%B0/%D0%9E%D0%B1%D0%BD%D0%BE%D0%B2%D0%BB%D0%B5%D0%BD%D0%B8%D1%8F/2.4.3/
wiki	www.wiki.astralinux.ru/astra-linux-se81-bulletin-20230315SE81
strelets	www.strelets.net/patchi-i-obnovleniya-bezopasnosti
altsp	www.altsp.su/obnovleniya-bezopasnosti/

30 Sep 2024 00:00Current

6.9Medium risk

Vulners AI Score6.9

CVSS 39.8

CVSS 210

EPSS0.03162

pillow image library convert c buffer overflow remote attacker confidential data data integrity service outages