Fluid Attacks Database

Description

Potential infinite loop in Pillow An issue was discovered in Pillow before 8.2.0. For FLI data, FliDecode did not properly check that the block advance was non-zero, potentially leading to an infinite loop on load.

Mitigation

Update Impact

Minimal update. May introduce new vulnerabilities or breaking changes.

Ecosystem	Component	Affected version	Patched versions
alpine v3.14	py3-pillow	>=0 <8.2.0-r0	8.2.0-r0
debian 13	pillow	>=0 <8.1.2+dfsg-0.2	8.1.2+dfsg-0.2
alpine v3.15	py3-pillow	>=0 <8.2.0-r0	8.2.0-r0
debian 12	pillow	>=0 <8.1.2+dfsg-0.2	8.1.2+dfsg-0.2
pypi	pillow	>=0 <8.2.0	8.2.0
debian 14	pillow	>=0 <8.1.2+dfsg-0.2	8.1.2+dfsg-0.2
debian 11	pillow	>=0 <8.1.2+dfsg-0.2	8.1.2+dfsg-0.2
rpm rhel7	python-pillow	-	-
rpm rhel8	python-pillow	<0:5.1.1-16.el8	0:5.1.1-16.el8

Aliases

1. CVE-2021-286762. NVD-2021-286763. OSV-ALPINE-2021-286764. OSV-2021-286765. OSV-DEBIAN-2021-286766. GHSA-7r7m-5h27-29hp7. GCVE-2021-286768. SECURITY-CVE-2021-286769. SECURITY-TRACKER-CVE-2021-2867610. lists.debian.org11. security.gentoo.org

References

1. https://github.com/python-pillow/Pillow/pull/53772. https://github.com/python-pillow/Pillow/commit/bb6c11fb889e6c11b0ee122b828132ee763b58563. https://github.com/pypa/advisory-database/tree/main/vulns/pillow/PYSEC-2021-92.yaml4. https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/MQHA5HAIBOYI3R6HDWCLAGFTIQP767FL5. https://lists.fedoraproject.org/archives/list/[email protected]/message/MQHA5HAIBOYI3R6HDWCLAGFTIQP767FL6. https://pillow.readthedocs.io/en/stable/releasenotes/8.2.0.html#cve-2021-28676-fix-fli-dos

Does your application use this vulnerable software?

During the free trial, our tools assess your application, identify vulnerabilities, and provide recommendations for their remediation.