Pillow through 8.2.0 and PIL (aka Python Imaging Library) through 1.1.7 allow an attacker to pass controlled parameters directly into a convert function to trigger a buffer overflow in Convert.c.
CVSS Details
- CVSS 3.1 Base Score: 9.8
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade python3-pillow | May 4, 2022 | Jul 13, 2021 |
| Alpine Linux | — | Upgrade py3-pillow | Aug 22, 2024 | Jul 13, 2021 |
| Amazon Linux Ami 2 | — | Upgrade python-pillow-tkUpgrade python-pillow-saneUpgrade python-pillowUpgrade python-pillow-debuginfoUpgrade python-pillow-docUpgrade python-pillow-devel | Jun 8, 2023 | Jul 13, 2021 |
| Amazon_linux_2023 | — | Upgrade python3-pillow-tkUpgrade python3-pillowUpgrade python-pillow-debugsourceUpgrade python3-pillow-tk-debuginfoUpgrade python-pillow-debuginfoUpgrade python3-pillow-develUpgrade python3-pillow-debuginfo | Feb 17, 2025 | Jul 13, 2021 |
| Arch Linux | — | Upgrade to the latest version of Arch Linux | Jul 11, 2025 | Jul 13, 2021 |
| Centos_linux | — | Upgrade python3-pillow-tk-debuginfoUpgrade python-pillow-debuginfoUpgrade python3-pillowUpgrade python3-pillow-debuginfoUpgrade python-pillow-debugsource | Nov 10, 2021 | Jul 13, 2021 |
| Debian | — | Upgrade pillow | Jul 23, 2021 | Jul 13, 2021 |
| Gentoo Linux | — | Upgrade dev-python/pillow. | Nov 23, 2022 | Jul 13, 2021 |
| Huawei Euleros 2_0_sp3 | — | Upgrade python-pillow | Oct 26, 2021 | Jul 13, 2021 |
| Huawei Euleros 2_0_sp5 | — | Upgrade python-pillow | Sep 29, 2021 | Jul 13, 2021 |
| Huawei Euleros 2_0_sp8 | — | Upgrade python3-pillowUpgrade python2-pillow | Sep 24, 2021 | Jul 13, 2021 |
| Huawei Euleros 2_0_sp9 | — | Upgrade python3-pillow | Sep 29, 2021 | Jul 13, 2021 |
| Oracle Solaris | — | Upgrade library/python/pillow to version 8.2.0-11.4.37.0.1.101.1 on Solaris 11.4Upgrade library/python/pillow-27 to version 5.1.0-11.4.37.0.1.101.1 on Solaris 11.4Upgrade library/python/pillow-39 to version 8.2.0-11.4.37.0.1.101.1 on Solaris 11.4Upgrade library/python/pillow-37 to version 8.2.0-11.4.37.0.1.101.1 on Solaris 11.4 | Oct 12, 2021 | Jul 13, 2021 |
| Redhat_linux | — | Upgrade python-pillow-debugsourceNo solution existsUpgrade python-pillow-debuginfoUpgrade python3-pillowUpgrade python3-pillow-tk-debuginfoUpgrade python3-pillow-debuginfo | Nov 10, 2021 | Jul 13, 2021 |
| Rocky_linux | — | Upgrade python3-pillowUpgrade python-pillow-debuginfoUpgrade python3-pillow-debuginfoUpgrade python3-pillow-tk-debuginfo | May 5, 2022 | Jul 13, 2021 |
| Suse | — | Upgrade python3-pillowUpgrade python3-pillow-tkUpgrade python3-cairosvg | Aug 11, 2021 | Jul 13, 2021 |
| Ubuntu | — | Upgrade python-pil (Ubuntu Pro)Upgrade python3-pilUpgrade python3-pil (Ubuntu Pro)Upgrade python-pil | Jan 14, 2022 | Jul 13, 2021 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub