Out of bounds read in Pillow

🗓️ 29 Mar 2021 16:35:57Reported by GitHub Advisory DatabaseType

github

github🔗 github.com👁 59 Views

Out of bounds read in Pillow. Issue in TiffDecode.

Reporter	Title	Published	Views	Family All 58
Tenable Nessus	Amazon Linux 2023 : python3-pillow, python3-pillow-devel, python3-pillow-tk (ALAS2023-2023-146)	23 Mar 202300:00	–	nessus
Tenable Nessus	EulerOS 2.0 SP9 : python-pillow (EulerOS-SA-2021-2540)	27 Sep 202100:00	–	nessus
Tenable Nessus	EulerOS 2.0 SP9 : python-pillow (EulerOS-SA-2021-2564)	27 Sep 202100:00	–	nessus
Tenable Nessus	Fedora 32 : python-pillow / python2-pillow (2021-0ece308612)	15 Mar 202100:00	–	nessus
Tenable Nessus	Fedora 33 : mingw-python-pillow / python-pillow / python2-pillow (2021-15845d3abe)	15 Mar 202100:00	–	nessus
Tenable Nessus	GLSA-202107-33 : Pillow: Multiple vulnerabilities	24 Jan 202200:00	–	nessus
Tenable Nessus	openSUSE 15 Security Update : python-CairoSVG, python-Pillow (openSUSE-SU-2021:1134-1)	11 Aug 202100:00	–	nessus
Tenable Nessus	RHEL 7 : python-pillow (Unpatched Vulnerability)	11 May 202400:00	–	nessus
Tenable Nessus	Ubuntu 16.04 LTS / 18.04 LTS / 20.04 LTS : Pillow vulnerabilities (USN-4763-1)	23 Mar 202100:00	–	nessus
Tenable Nessus	Linux Distros Unpatched Vulnerability : CVE-2021-25291	4 Mar 202500:00	–	nessus

Vulners

Node

python pillowRange<8.2.0pip

Source	Link
nvd	www.nvd.nist.gov/vuln/detail/CVE-2021-25291
github	www.github.com/python-pillow/Pillow/commit/cbdce6c5d054fccaf4af34b47f212355c64ace7a
pillow	www.pillow.readthedocs.io/en/stable/releasenotes/8.1.1.html
security	www.security.gentoo.org/glsa/202107-33
github	www.github.com/python-pillow/Pillow/commit/8b8076bdcb3815be0ef0d279651d8d1342b8ea61
github	www.github.com/advisories/GHSA-mvg9-xffr-p774
github	www.github.com/pypa/advisory-database/tree/main/vulns/pillow/PYSEC-2021-37.yaml

09 Oct 2024 21:06Current

7.9High risk

Vulners AI Score7.9

CVSS 25

CVSS 3.17.5

EPSS0.00536

pillow tiffdecode.c out-of-bounds tiffreadrgbatile invalid tile boundaries software