CVE-2021-25289: Buffer Overflow
A flaw was found in python-pillow. TiffDecode has a heap-based buffer overflow when decoding crafted YCbCr files because of certain interpretation conflicts with LibTIFF in RGBA mode. The previous fix for CVE-2020-35654 was insufficient due to incorrect error checking in TiffDecode.c. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.
Other sources
An issue was discovered in Pillow before 8.1.1. TiffDecode has a heap-based buffer overflow when decoding crafted YCbCr files because of certain interpretation conflicts with LibTIFF in RGBA mode. NOTE: this issue exists because of an incomplete fix for CVE-2020-35654.
The previous fix for CVE-2020-35654 was insufficient due to incorrect error checking in TiffDecode.c.
Reference: https://pillow.readthedocs.io/en/stable/releasenotes/8.1.1.html
— Red Hat
Affected Software
Remediation
Information
Event History
Frequently Asked Questions
What is CVE-2021-25289?
CVE-2021-25289 is a vulnerability in Pillow, a Python Imaging Library, that allows a heap-based buffer overflow when decoding crafted YCbCr files.
What is the severity of CVE-2021-25289?
The severity of CVE-2021-25289 is critical with a CVSS score of 9.8 out of 10.
How does CVE-2021-25289 affect Pillow?
CVE-2021-25289 affects Pillow by causing a heap-based buffer overflow when decoding certain YCbCr files.
How can I fix CVE-2021-25289?
To fix CVE-2021-25289, upgrade to version 8.1.1 of python-pillow.
Where can I find more information about CVE-2021-25289?
You can find more information about CVE-2021-25289 in the references provided: https://access.redhat.com/security/cve/CVE-2020-35654, https://pillow.readthedocs.io/en/stable/releasenotes/8.1.1.html, and https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=1934683.