Out of bounds read in Pillow · CVE-2021-25291 · GitHub Advisory Database · GitHub

Out of bounds read in Pillow

High severity GitHub Reviewed Published Mar 29, 2021 to the GitHub Advisory Database • Updated Mar 26, 2024

Package

Pillow (pip)

Affected versions

< 8.2.0

Patched versions

8.2.0

Description

An issue was discovered in Pillow before 8.2.0. In TiffDecode.c, there is an out-of-bounds read in TiffreadRGBATile via invalid tile boundaries.

References

Published by the National Vulnerability Database

Mar 19, 2021

Reviewed Mar 22, 2021

Published to the GitHub Advisory Database Mar 29, 2021

Last updated Mar 26, 2024

Severity

High

7.5

/ 10

CVSS base metrics

Attack vector

Network

Attack complexity

Low

Privileges required

None

User interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H