Fluid Attacks Database

Description

Potential infinite loop in Pillow An issue was discovered in Pillow before 8.2.0. For FLI data, FliDecode did not properly check that the block advance was non-zero, potentially leading to an infinite loop on load.

Mitigation

Update Impact

Minimal update. May introduce new vulnerabilities or breaking changes.

Ecosystem	Package	Affected version	Patched versions
alpine v3.14	py3-pillow	=7.1.1-r0 \|\| =7.1.2-r0 \|\| =7.2.0-r0 \|\| =8.1.0-r0 \|\| =8.1.2-r0 \|\| =8.1.2-r1 \|\| >=0 <8.2.0-r0	8.2.0-r0
debian 12	pillow	>=0 <8.1.2+dfsg-0.2	8.1.2+dfsg-0.2
alpine v3.15	py3-pillow	=7.1.1-r0 \|\| =7.1.2-r0 \|\| =7.2.0-r0 \|\| =8.1.0-r0 \|\| =8.1.2-r0 \|\| =8.1.2-r1 \|\| >=0 <8.2.0-r0	8.2.0-r0
pypi	pillow	>=0 <8.2.0	8.2.0
debian 13	pillow	>=0 <8.1.2+dfsg-0.2	8.1.2+dfsg-0.2
debian 14	pillow	>=0 <8.1.2+dfsg-0.2	8.1.2+dfsg-0.2
debian 11	pillow	>=0 <8.1.2+dfsg-0.2	8.1.2+dfsg-0.2
rpm rhel8	python-pillow	<0:5.1.1-16.el8	0:5.1.1-16.el8
rpm rhel7	python-pillow	-	-

Aliases

1. CVE-2021-286762. NVD-2021-286763. OSV-ALPINE-2021-286764. OSV-2021-286765. OSV-DEBIAN-2021-286766. GHSA-7r7m-5h27-29hp7. GCVE-2021-286768. SECURITY-CVE-2021-286769. SECURITY-TRACKER-CVE-2021-2867610. lists.debian.org11. security.gentoo.org

References

1. https://github.com/python-pillow/Pillow/pull/53772. https://github.com/python-pillow/Pillow/commit/bb6c11fb889e6c11b0ee122b828132ee763b58563. https://github.com/pypa/advisory-database/tree/main/vulns/pillow/PYSEC-2021-92.yaml4. https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/MQHA5HAIBOYI3R6HDWCLAGFTIQP767FL5. https://lists.fedoraproject.org/archives/list/[email protected]/message/MQHA5HAIBOYI3R6HDWCLAGFTIQP767FL6. https://pillow.readthedocs.io/en/stable/releasenotes/8.2.0.html#cve-2021-28676-fix-fli-dos

Does your application use this vulnerable software?

During the free trial, our tools assess your application, identify vulnerabilities, and provide recommendations for their remediation.