Buffer Overflow Vulnerability in Pillow Affecting TiffDecode Component
CVE-2021-25289

9.8CRITICAL

Key Information:

Vendor

Python

Status
Pillow
Vendor
CVE Published:
19 March 2021

What is CVE-2021-25289?

An issue was found in the Pillow library prior to version 8.1.1, where a heap-based buffer overflow occurs in the TiffDecode function when processing specially crafted YCbCr files. This vulnerability arises due to interpretation conflicts with LibTIFF while operating in RGBA mode. It's important to note that this flaw is an outcome of an incomplete fix for a prior vulnerability, indicating potential risks for users operating on outdated versions.

References

https://pillow.readthedocs.io/en/stable/releasenotes/8.1....
x_refsource_MISC
https://security.gentoo.org/glsa/202107-33
vendor-advisoryx_refsource_GENTOO

CVSS V3.1

Score:
9.8
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.