This page tracks the Debian fix status. The vulnerability itself is described on the main CVE page. View CVE-2021-25289 →

DEBIAN-CVE-2021-25289

An issue was discovered in Pillow before 8.1.1. TiffDecode has a heap-based buffer overflow when decoding crafted YCbCr files because of certain inter...

Original description

The description as published by the source.

An issue was discovered in Pillow before 8.1.1. TiffDecode has a heap-based buffer overflow when decoding crafted YCbCr files because of certain interpretation conflicts with LibTIFF in RGBA mode. NOTE: this issue exists because of an incomplete fix for CVE-2020-35654.

Source: OSV.dev (Open Source Vulnerabilities) OSV

Affected packages

Debian:12 pillow

[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.1.1-1"}]}]

Debian:13 pillow

[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.1.1-1"}]}]

Debian:14 pillow

[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.1.1-1"}]}]

References

advisory security-tracker.debian.org