CVE-2021-34552

Pillow through 8.2.0 and PIL (aka Python Imaging Library) through 1.1.7 allow an attacker to pass controlled parameters directly into a convert function to trigger a buffer overflow in Convert.c.

Pillow through 8.2.0 and PIL (aka Python Imaging Library) through 1.1.7 allow an attacker to pass controlled parameters directly into a convert function to trigger a buffer overflow in Convert.c.

The python-pillow packages contain a Python image processing library that provides extensive file format support, an efficient internal representation, and powerful image-processing capabilities.

Security Fix(es):

• python-pillow: Out-of-bounds read in J2K image reader (CVE-2021-25287)

• python-pillow: Out-of-bounds read in J2K image reader (CVE-2021-25288)

• python-pillow: Negative-offset memcpy in TIFF image reader (CVE-2021-25290)

• python-pillow: Regular expression DoS in PDF format parser (CVE-2021-25292)

• python-pillow: Out-of-bounds read in SGI RLE image reader (CVE-2021-25293)

• python-pillow: Excessive memory allocation in BLP image reader (CVE-2021-27921)

• python-pillow: Excessive memory allocation in ICNS image reader (CVE-2021-27922)

• python-pillow: Excessive memory allocation in ICO image reader (CVE-2021-27923)

• python-pillow: Excessive memory allocation in PSD image reader (CVE-2021-28675)

• python-pillow: Infinite loop in FLI image reader (CVE-2021-28676)

• python-pillow: Excessive CPU use in EPS image reader (CVE-2021-28677)

• python-pillow: Excessive looping in BLP image reader (CVE-2021-28678)

• python-pillow: Buffer overflow in image convert function (CVE-2021-34552)

• python-pillow: Buffer over-read in PCX image reader (CVE-2020-35653)

• python-pillow: Buffer over-read in SGI RLE image reader (CVE-2020-35655)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the Rocky Linux 8.5 Release Notes linked from the References section.

Pillow through 8.2.0 and PIL (aka Python Imaging Library) through 1.1.7 allow an attacker to pass controlled parameters directly into a convert function to trigger a buffer overflow in Convert.c.

The python-pillow packages contain a Python image processing library that provides extensive file format support, an efficient internal representation, and powerful image-processing capabilities.

Security Fix(es):

• python-pillow: Out-of-bounds read in J2K image reader (CVE-2021-25287)

• python-pillow: Out-of-bounds read in J2K image reader (CVE-2021-25288)

• python-pillow: Negative-offset memcpy in TIFF image reader (CVE-2021-25290)

• python-pillow: Regular expression DoS in PDF format parser (CVE-2021-25292)

• python-pillow: Out-of-bounds read in SGI RLE image reader (CVE-2021-25293)

• python-pillow: Excessive memory allocation in BLP image reader (CVE-2021-27921)

• python-pillow: Excessive memory allocation in ICNS image reader (CVE-2021-27922)

• python-pillow: Excessive memory allocation in ICO image reader (CVE-2021-27923)

• python-pillow: Excessive memory allocation in PSD image reader (CVE-2021-28675)

• python-pillow: Infinite loop in FLI image reader (CVE-2021-28676)

• python-pillow: Excessive CPU use in EPS image reader (CVE-2021-28677)

• python-pillow: Excessive looping in BLP image reader (CVE-2021-28678)

• python-pillow: Buffer overflow in image convert function (CVE-2021-34552)

• python-pillow: Buffer over-read in PCX image reader (CVE-2020-35653)

• python-pillow: Buffer over-read in SGI RLE image reader (CVE-2020-35655)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section.

Pillow through 8.2.0 and PIL (aka Python Imaging Library) through 1.1.7 allow an attacker to pass controlled parameters directly into a convert function to trigger a buffer overflow in Convert.c.

Updated python-pillow packages fix security vulnerabilities:

An issue was discovered in Pillow before 8.2.0. There is an out-of-bounds read in J2kDecode, in j2ku_graya_la (CVE-2021-25287).

An issue was discovered in Pillow before 8.2.0. There is an out-of-bounds read in J2kDecode, in j2ku_gray_i (CVE-2021-25288).

An issue was discovered in Pillow before 8.2.0. PSDImagePlugin.PsdImageFile lacked a sanity check on the number of input layers relative to the size of the data block. This could lead to a DoS on Image.open prior to Image.load (CVE-2021-28675).

An issue was discovered in Pillow before 8.2.0. For FLI data, FliDecode did not properly check that the block advance was non-zero, potentially leading to an infinite loop on load (CVE-2021-28676).

An issue was discovered in Pillow before 8.2.0. For EPS data, the readline implementation used in EPSImageFile has to deal with any combination of \r and \n as line endings. It used an accidentally quadratic method of accumulating lines while looking for a line ending. A malicious EPS file could use this to perform a DoS of Pillow in the open phase, before an image was accepted for opening (CVE-2021-28677).

An issue was discovered in Pillow before 8.2.0. For BLP data, BlpImagePlugin did not properly check that reads (after jumping to file offsets) returned data. This could lead to a DoS where the decoder could be run a large number of times on empty data (CVE-2021-28678).

Pillow through 8.2.0 and PIL (aka Python Imaging Library) through 1.1.7 allow an attacker to pass controlled parameters directly into a convert function to trigger a buffer overflow in Convert.c (CVE-2021-34552).

This update for python-CairoSVG, python-Pillow fixes the following issues:

Update to version 2.5.1.

• Security fix: When processing SVG files, CairoSVG was using two regular expressions which are vulnerable to Regular Expression Denial of Service (REDoS). If an attacker provided a malicious SVG, it could make CairoSVG get stuck processing the file for a very long time.
• Fix marker positions for unclosed paths
• Follow hint when only output_width or output_height is set
• Handle opacity on raster images
• Don’t crash when use tags reference unknown tags
• Take care of the next letter when A/a is replaced by l
• Fix misalignment in node.vertices

Updates for version 2.5.0.

• Drop support of Python 3.5, add support of Python 3.9.
• Add EPS export
• Add background-color, negate-colors, and invert-images options
• Improve support for font weights
• Fix opacity of patterns and gradients
• Support auto-start-reverse value for orient
• Draw images contained in defs
• Add Exif transposition support
• Handle dominant-baseline
• Support transform-origin

python-Pillow update to version 8.3.1:

• Catch OSError when checking if fp is sys.stdout #5585 [radarhere]

• Handle removing orientation from alternate types of EXIF data #5584 [radarhere]

• Make Image.array take optional dtype argument #5572 [t-vi, radarhere]

• Use snprintf instead of sprintf. CVE-2021-34552 #5567 [radarhere]

• Limit TIFF strip size when saving with LibTIFF #5514 [kmilos]

• Allow ICNS save on all operating systems #4526 [baletu, radarhere, newpanjing, hugovk]

• De-zigzag JPEG's DQT when loading; deprecate convert_dict_qtables #4989 [gofr, radarhere]

• Replaced xml.etree.ElementTree #5565 [radarhere]

• Moved CVE image to pillow-depends #5561 [radarhere]

• Added tag data for IFD groups #5554 [radarhere]

• Improved ImagePalette #5552 [radarhere]

• Add DDS saving #5402 [radarhere]

• Improved getxmp() #5455 [radarhere]

• Convert to float for comparison with float in IFDRational eq #5412 [radarhere]

• Allow getexif() to access TIFF tag_v2 data #5416 [radarhere]

• Read FITS image mode and size #5405 [radarhere]

• Merge parallel horizontal edges in ImagingDrawPolygon #5347 [radarhere, hrdrq]

• Use transparency behind first GIF frame and when disposing to background #5557 [radarhere, zewt]

• Avoid unstable nature of qsort in Quant.c #5367 [radarhere]

• Copy palette to new images in ImageOps expand #5551 [radarhere]

• Ensure palette string matches RGB mode #5549 [radarhere]

• Do not modify EXIF of original image instance in exif_transpose() #5547 [radarhere]

• Fixed default numresolution for small JPEG2000 images #5540 [radarhere]

• Added DDS BC5 reading #5501 [radarhere]

• Raise an error if ImageDraw.textbbox is used without a TrueType font #5510 [radarhere]

• Added ICO saving in BMP format #5513 [radarhere]

• Ensure PNG seeks to end of previous chunk at start of load_end #5493 [radarhere]

• Do not allow TIFF to seek to a past frame #5473 [radarhere]

• Avoid race condition when displaying images with eog #5507 [mconst]

• Added specific error messages when ink has incorrect number of bands #5504 [radarhere]

• Allow converting an image to a numpy array to raise errors #5379 [radarhere]

• Removed DPI rounding from BMP, JPEG, PNG and WMF loading #5476, #5470 [radarhere]

• Remove spikes when drawing thin pieslices #5460 [xtsm]

• Updated default value for SAMPLESPERPIXEL TIFF tag #5452 [radarhere]

• Removed TIFF DPI rounding #5446 [radarhere, hugovk]

• Include code in WebP error #5471 [radarhere]

• Do not alter pixels outside mask when drawing text on an image with transparency #5434 [radarhere]

• Reset handle when seeking backwards in TIFF #5443 [radarhere]

• Replace sys.stdout with sys.stdout.buffer when saving #5437 [radarhere]

• Fixed UNDEFINED TIFF tag of length 0 being changed in roundtrip #5426 [radarhere]

• Fixed bug when checking FreeType2 version if it is not installed #5445 [radarhere]

• Do not round dimensions…

These are all security issues fixed in the python36-Pillow-8.3.2-1.2 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the python310-Pillow-10.3.0-1.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the python313-Pillow-12.3.0-1.1 package on the GA media of openSUSE Tumbleweed.

Pillow through 8.2.0 and PIL (aka Python Imaging Library) through 1.1.7 allow an attacker to pass controlled parameters directly into a convert function to trigger a buffer overflow in Convert.c.

Root has patched CVE-2021-34552 in the pillow package for Root:PyPI. Multiple fixed versions available.

This update for python-Pillow fixes the following issues:

• CVE-2021-34552: Fixed a buffer overflow in Convert.c (bsc#1188574)

This update for python-Pillow fixes the following issues:

• CVE-2021-34552: Fixed a buffer overflow in Convert.c (bsc#1188574)

This update for python-Pillow fixes the following issues:

• CVE-2021-34552: Fixed a buffer overflow in Convert.c (bsc#1188574)

This update for python-Pillow fixes the following issues:

• Fixed ImagePath.Path array handling (bsc#1194552, CVE-2022-22815, bsc#1194551, CVE-2022-22816)
• Use snprintf instead of sprintf (bsc#1188574, CVE-2021-34552)
• Fix Memory DOS in Icns, Ico and Blp Image Plugins. (bsc#1183110, CVE-2021-27921, bsc#1183108, CVE-2021-27922, bsc#1183107, CVE-2021-27923)
• Fix OOB read in SgiRleDecode.c (bsc#1183102, CVE-2021-25293)
• Use more specific regex chars to prevent ReDoS (bsc#1183101, CVE-2021-25292)
• Fix negative size read in TiffDecode.c (bsc#1183105, CVE-2021-25290)
• Raise ValueError if color specifier is too long (bsc#1190229, CVE-2021-23437)
• Incorrect error code checking in TiffDecode.c (bsc#1183103, CVE-2021-25289)
• OOB Write in TiffDecode.c (bsc#1180833, CVE-2020-35654)

This update for python-Pillow fixes the following issues:

• Fixed ImagePath.Path array handling (bsc#1194552, CVE-2022-22815, bsc#1194551, CVE-2022-22816)
• Use snprintf instead of sprintf (bsc#1188574, CVE-2021-34552)
• Fix Memory DOS in Icns, Ico and Blp Image Plugins. (bsc#1183110, CVE-2021-27921, bsc#1183108, CVE-2021-27922, bsc#1183107, CVE-2021-27923)
• Fix OOB read in SgiRleDecode.c (bsc#1183102, CVE-2021-25293)
• Use more specific regex chars to prevent ReDoS (bsc#1183101, CVE-2021-25292)
• Fix negative size read in TiffDecode.c (bsc#1183105, CVE-2021-25290)
• Raise ValueError if color specifier is too long (bsc#1190229, CVE-2021-23437)
• Incorrect error code checking in TiffDecode.c (bsc#1183103, CVE-2021-25289)
• OOB Write in TiffDecode.c (bsc#1180833, CVE-2020-35654)

It was discovered that Pillow incorrectly handled certain image files. If a user or automated system were tricked into opening a specially-crafted file, a remote attacker could cause Pillow to hang, resulting in a denial of service. (CVE-2021-23437)

It was discovered that Pillow incorrectly handled certain image files. If a user or automated system were tricked into opening a specially-crafted file, a remote attacker could cause Pillow to crash, resulting in a denial of service. This issue ony affected Ubuntu 18.04 LTS, Ubuntu 20.04 LTS, and Ubuntu 21.04. (CVE-2021-34552)

It was discovered that Pillow incorrectly handled certain image files. If a user or automated system were tricked into opening a specially-crafted file, a remote attacker could cause Pillow to crash, resulting in a denial of service, or possibly execute arbitrary code. (CVE-2022-22815)

It was discovered that Pillow incorrectly handled certain image files. If a user or automated system were tricked into opening a specially-crafted file, a remote attacker could cause Pillow to crash, resulting in a denial of service. (CVE-2022-22816)

It was discovered that Pillow incorrectly handled certain image files. If a user or automated system were tricked into opening a specially-crafted file, a remote attacker could cause Pillow to crash, resulting in a denial of service, or possibly execute arbitrary code. (CVE-2022-22817)

USN-5227-1 fixed several vulnerabilities in Pillow. This update provides the corresponding update for Ubuntu 14.04 ESM and Ubuntu 16.04 ESM.

Original advisory details:

It was discovered that Pillow incorrectly handled certain image files. If a user or automated system were tricked into opening a specially-crafted file, a remote attacker could cause Pillow to hang, resulting in a denial of service. (CVE-2021-23437)

It was discovered that Pillow incorrectly handled certain image files. If a user or automated system were tricked into opening a specially-crafted file, a remote attacker could cause Pillow to crash, resulting in a denial of service. This issue ony affected Ubuntu 18.04 LTS, Ubuntu 20.04 LTS, and Ubuntu 21.04. (CVE-2021-34552)

It was discovered that Pillow incorrectly handled certain image files. If a user or automated system were tricked into opening a specially-crafted file, a remote attacker could cause Pillow to crash, resulting in a denial of service, or possibly execute arbitrary code. (CVE-2022-22815)

It was discovered that Pillow incorrectly handled certain image files. If a user or automated system were tricked into opening a specially-crafted file, a remote attacker could cause Pillow to crash, resulting in a denial of service. (CVE-2022-22816)

It was discovered that Pillow incorrectly handled certain image files. If a user or automated system were tricked into opening a specially-crafted file, a remote attacker could cause Pillow to crash, resulting in a denial of service, or possibly execute arbitrary code. (CVE-2022-22817)