This page tracks the Debian fix status. The vulnerability itself is described on the main CVE page. View CVE-2021-28678 →

DEBIAN-CVE-2021-28678

An issue was discovered in Pillow before 8.2.0. For BLP data, BlpImagePlugin did not properly check that reads (after jumping to file offsets) returne...

Original description

The description as published by the source.

An issue was discovered in Pillow before 8.2.0. For BLP data, BlpImagePlugin did not properly check that reads (after jumping to file offsets) returned data. This could lead to a DoS where the decoder could be run a large number of times on empty data.

Source: OSV.dev (Open Source Vulnerabilities) OSV

Affected packages

Debian:12 pillow

[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.1.2+dfsg-0.2"}]}]

Debian:13 pillow

[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.1.2+dfsg-0.2"}]}]

Debian:14 pillow

[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.1.2+dfsg-0.2"}]}]

References

advisory security-tracker.debian.org