CVE-2021-25289

March 22, 2021

An issue was discovered in Pillow before 8.1.1. TiffDecode has a heap-based buffer overflow when decoding crafted YCbCr files because of certain interpretation conflicts with LibTIFF in RGBA mode. NOTE: this issue exists because of an incomplete fix for CVE-2020-35654.

Summary:

An issue was discovered in Pillow before 8.1.1. TiffDecode has a heap-based buffer overflow when decoding crafted YCbCr files because of certain interpretation conflicts with LibTIFF in RGBA mode. NOTE: this issue exists because of an incomplete fix for CVE-2020-35654.

Reference Links(if available):

  • https://pillow.readthedocs.io/en/stable/releasenotes/8.1.1.html

  • CVSS Score (if available)

    v2: / MEDIUM

    v3: /

    Links to Exploits(if available)

  • Tags: , , , ,

    You may have missed

    image

    [QILIN] – Ransomware Victim: Compliance Solutions Inc

    December 20, 2024
    image

    [INTERLOCK] – Ransomware Victim: City of Noblesville

    December 20, 2024
    image

    [SPACEBEARS] – Ransomware Victim: JRT Automatisation

    December 20, 2024
    image

    [PLAY] – Ransomware Victim: Krispy Kreme

    December 20, 2024
    image

    [FOG] – Ransomware Victim: Jet Edge (jetedgewaterjets[.]com)

    December 20, 2024