An issue was discovered in Pillow before 8.1.1. TiffDecode has a heap-based buffer overflow when decoding crafted YCbCr files because of certain interpretation conflicts with LibTIFF in RGBA mode. NOTE: this issue exists because of an incomplete fix for CVE-2020-35654.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - An issue was discovered in Pillow before 8.1.1. TiffDecode has a heap-based buffer overflow when decoding     crafted YCbCr files because of certain interpretation conflicts with LibTIFF in RGBA mode. NOTE: this     issue exists because of an incomplete fix for CVE-2020-35654. (CVE-2021-25289)

Note that Nessus relies on the presence of the package as reported by the vendor.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - An issue was discovered in Pillow before 8.1.1. TiffDecode has a heap-based buffer overflow when decoding
    crafted YCbCr files because of certain interpretation conflicts with LibTIFF in RGBA mode. NOTE: this
    issue exists because of an incomplete fix for CVE-2020-35654. (CVE-2021-25289)

The remote SUSE Linux SLES15 host has a package installed that is affected by multiple vulnerabilities as referenced in the SUSE-SU-2024:1673-2 advisory.

    - Fixed ImagePath.Path array handling (bsc#1194552, CVE-2022-22815, bsc#1194551, CVE-2022-22816)
    - Use snprintf instead of sprintf (bsc#1188574, CVE-2021-34552)
    - Fix Memory DOS in Icns, Ico and Blp Image Plugins. (bsc#1183110, CVE-2021-27921, bsc#1183108,     CVE-2021-27922, bsc#1183107, CVE-2021-27923)
    - Fix OOB read in SgiRleDecode.c (bsc#1183102, CVE-2021-25293)
    - Use more specific regex chars to prevent ReDoS (bsc#1183101, CVE-2021-25292)
    - Fix negative size read in TiffDecode.c (bsc#1183105, CVE-2021-25290)
    - Raise ValueError if color specifier is too long (bsc#1190229, CVE-2021-23437)
    - Incorrect error code checking in TiffDecode.c (bsc#1183103, CVE-2021-25289)
    - OOB Write in TiffDecode.c (bsc#1180833, CVE-2020-35654)

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote openSUSE 15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2024:1673-1 advisory.

    - Fixed ImagePath.Path array handling (bsc#1194552, CVE-2022-22815, bsc#1194551, CVE-2022-22816)
    - Use snprintf instead of sprintf (bsc#1188574, CVE-2021-34552)
    - Fix Memory DOS in Icns, Ico and Blp Image Plugins. (bsc#1183110, CVE-2021-27921, bsc#1183108,     CVE-2021-27922, bsc#1183107, CVE-2021-27923)
    - Fix OOB read in SgiRleDecode.c (bsc#1183102, CVE-2021-25293)
    - Use more specific regex chars to prevent ReDoS (bsc#1183101, CVE-2021-25292)
    - Fix negative size read in TiffDecode.c (bsc#1183105, CVE-2021-25290)
    - Raise ValueError if color specifier is too long (bsc#1190229, CVE-2021-23437)
    - Incorrect error code checking in TiffDecode.c (bsc#1183103, CVE-2021-25289)
    - OOB Write in TiffDecode.c (bsc#1180833, CVE-2020-35654)

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

There are packages installed that are affected by multiple vulnerabilities referenced in the following CVEs:

  - An issue was discovered in Pillow before 8.1.1. TiffDecode has a heap-based buffer overflow when decoding
    crafted YCbCr files because of certain interpretation conflicts with LibTIFF in RGBA mode. NOTE: this
    issue exists because of an incomplete fix for CVE-2020-35654. (CVE-2021-25289)

  - An issue was discovered in Pillow before 8.1.1. In TiffDecode.c, there is a negative-offset memcpy with an
    invalid size. (CVE-2021-25290)

  - An issue was discovered in Pillow before 8.1.1. In TiffDecode.c, there is an out-of-bounds read in
    TiffreadRGBATile via invalid tile boundaries. (CVE-2021-25291)

  - An issue was discovered in Pillow before 8.1.1. The PDF parser allows a regular expression DoS (ReDoS)
    attack via a crafted PDF file because of a catastrophic backtracking regex. (CVE-2021-25292)

The remote host is affected by the vulnerability described in GLSA-202107-33 (Pillow: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in Pillow. Please review       the CVE identifiers referenced below for details.
  Impact :

    Please review the referenced CVE identifiers for details.
  Workaround :

    There is no known workaround at this time.

According to the versions of the python-pillow package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - An issue was discovered in Pillow before 8.1.1. TiffDecode has a heap-based buffer overflow when decoding     crafted YCbCr files because of certain interpretation conflicts with LibTIFF in RGBA mode. NOTE: this     issue exists because of an incomplete fix for CVE-2020-35654. (CVE-2021-25289)

  - An issue was discovered in Pillow before 8.1.1. In TiffDecode.c, there is an out-of-bounds read in     TiffreadRGBATile via invalid tile boundaries. (CVE-2021-25291)

  - An issue was discovered in Pillow before 8.1.1. The PDF parser allows a regular expression DoS (ReDoS)     attack via a crafted PDF file because of a catastrophic backtracking regex. (CVE-2021-25292)

  - An issue was discovered in Pillow before 8.1.1. There is an out-of-bounds read in SGIRleDecode.c.
    (CVE-2021-25293)

  - Pillow through 8.2.0 and PIL (aka Python Imaging Library) through 1.1.7 allow an attacker to pass     controlled parameters directly into a convert function to trigger a buffer overflow in Convert.c.
    (CVE-2021-34552)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote SUSE Linux SUSE15 host has packages installed that are affected by multiple vulnerabilities as referenced in the openSUSE-SU-2021:1134-1 advisory.

  - Heap buffer overflow in Freetype in Google Chrome prior to 86.0.4240.111 allowed a remote attacker to     potentially exploit heap corruption via a crafted HTML page. (CVE-2020-15999)

  - In Pillow before 8.1.0, PcxDecode has a buffer over-read when decoding a crafted PCX file because the     user-supplied stride value is trusted for buffer calculations. (CVE-2020-35653)

  - In Pillow before 8.1.0, TiffDecode has a heap-based buffer overflow when decoding crafted YCbCr files     because of certain interpretation conflicts with LibTIFF in RGBA mode. (CVE-2020-35654)

  - In Pillow before 8.1.0, SGIRleDecode has a 4-byte buffer over-read when decoding crafted SGI RLE image     files because offsets and length tables are mishandled. (CVE-2020-35655)

  - An issue was discovered in Pillow before 8.1.1. TiffDecode has a heap-based buffer overflow when decoding     crafted YCbCr files because of certain interpretation conflicts with LibTIFF in RGBA mode. NOTE: this     issue exists because of an incomplete fix for CVE-2020-35654. (CVE-2021-25289)

  - An issue was discovered in Pillow before 8.1.1. In TiffDecode.c, there is a negative-offset memcpy with an     invalid size. (CVE-2021-25290)

  - An issue was discovered in Pillow before 8.1.1. In TiffDecode.c, there is an out-of-bounds read in     TiffreadRGBATile via invalid tile boundaries. (CVE-2021-25291)

  - An issue was discovered in Pillow before 8.1.1. The PDF parser allows a regular expression DoS (ReDoS)     attack via a crafted PDF file because of a catastrophic backtracking regex. (CVE-2021-25292)

  - An issue was discovered in Pillow before 8.1.1. There is an out-of-bounds read in SGIRleDecode.c.
    (CVE-2021-25293)

  - Pillow before 8.1.1 allows attackers to cause a denial of service (memory consumption) because the     reported size of a contained image is not properly checked for a BLP container, and thus an attempted     memory allocation can be very large. (CVE-2021-27921)

  - Pillow before 8.1.1 allows attackers to cause a denial of service (memory consumption) because the     reported size of a contained image is not properly checked for an ICNS container, and thus an attempted     memory allocation can be very large. (CVE-2021-27922)

  - Pillow before 8.1.1 allows attackers to cause a denial of service (memory consumption) because the     reported size of a contained image is not properly checked for an ICO container, and thus an attempted     memory allocation can be very large. (CVE-2021-27923)

  - Pillow through 8.2.0 and PIL (aka Python Imaging Library) through 1.1.7 allow an attacker to pass     controlled parameters directly into a convert function to trigger a buffer overflow in Convert.c.
    (CVE-2021-34552)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Ubuntu 16.04 LTS / 18.04 LTS / 20.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-4763-1 advisory.

    It was discovered that Pillow incorrectly handled certain Tiff image files. If a user or automated system     were tricked into opening a specially-crafted Tiff file, a remote attacker could cause Pillow to crash,     resulting in a denial of service, or possibly execute arbitrary code. This issue only affected Ubuntu     20.04 LTS and Ubuntu 20.10. (CVE-2021-25289, CVE-2021-25291)

    It was discovered that Pillow incorrectly handled certain Tiff image files. If a user or automated system     were tricked into opening a specially-crafted Tiff file, a remote attacker could cause Pillow to crash,     resulting in a denial of service, or possibly execute arbitrary code. (CVE-2021-25290)

    It was discovered that Pillow incorrectly handled certain PDF files. If a user or automated system were     tricked into opening a specially-crafted PDF file, a remote attacker could cause Pillow to hang, resulting     in a denial of service. This issue only affected Ubuntu 18.04 LTS, Ubuntu 20.04 LTS, and Ubuntu 20.10.
    (CVE-2021-25292)

    It was discovered that Pillow incorrectly handled certain SGI image files. If a user or automated system     were tricked into opening a specially-crafted SGI file, a remote attacker could possibly cause Pillow to     crash, resulting in a denial of service. This issue only affected Ubuntu 18.04 LTS, Ubuntu 20.04 LTS, and     Ubuntu 20.10. (CVE-2021-25293)

    Jiayi Lin, Luke Shaffer, Xinran Xie, and Akshay Ajayan discovered that Pillow incorrectly handled certain     BLP files. If a user or automated system were tricked into opening a specially-crafted BLP file, a remote     attacker could possibly cause Pillow to consume resources, resulting in a denial of service. This issue     only affected Ubuntu 18.04 LTS, Ubuntu 20.04 LTS, and Ubuntu 20.10. (CVE-2021-27921)

    Jiayi Lin, Luke Shaffer, Xinran Xie, and Akshay Ajayan discovered that Pillow incorrectly handled certain     ICNS files. If a user or automated system were tricked into opening a specially-crafted ICNS file, a     remote attacker could possibly cause Pillow to consume resources, resulting in a denial of service.
    (CVE-2021-27922)

    Jiayi Lin, Luke Shaffer, Xinran Xie, and Akshay Ajayan discovered that Pillow incorrectly handled certain     ICO files. If a user or automated system were tricked into opening a specially-crafted ICO file, a remote     attacker could possibly cause Pillow to consume resources, resulting in a denial of service.
    (CVE-2021-27922)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 32 host has packages installed that are affected by multiple vulnerabilities as referenced in the FEDORA-2021-0ece308612 advisory.

  - In Pillow before 8.1.0, TiffDecode has a heap-based buffer overflow when decoding crafted YCbCr files     because of certain interpretation conflicts with LibTIFF in RGBA mode. (CVE-2020-35654)

  - An issue was discovered in Pillow before 8.1.1. TiffDecode has a heap-based buffer overflow when decoding     crafted YCbCr files because of certain interpretation conflicts with LibTIFF in RGBA mode. NOTE: this     issue exists because of an incomplete fix for CVE-2020-35654. (CVE-2021-25289)

  - An issue was discovered in Pillow before 8.1.1. In TiffDecode.c, there is a negative-offset memcpy with an     invalid size. (CVE-2021-25290)

  - An issue was discovered in Pillow before 8.1.1. In TiffDecode.c, there is an out-of-bounds read in     TiffreadRGBATile via invalid tile boundaries. (CVE-2021-25291)

  - An issue was discovered in Pillow before 8.1.1. The PDF parser allows a regular expression DoS (ReDoS)     attack via a crafted PDF file because of a catastrophic backtracking regex. (CVE-2021-25292)

  - An issue was discovered in Pillow before 8.1.1. There is an out-of-bounds read in SGIRleDecode.c.
    (CVE-2021-25293)

  - Pillow before 8.1.1 allows attackers to cause a denial of service (memory consumption) because the     reported size of a contained image is not properly checked for a BLP container, and thus an attempted     memory allocation can be very large. (CVE-2021-27921)

  - Pillow before 8.1.1 allows attackers to cause a denial of service (memory consumption) because the     reported size of a contained image is not properly checked for an ICNS container, and thus an attempted     memory allocation can be very large. (CVE-2021-27922)

  - Pillow before 8.1.1 allows attackers to cause a denial of service (memory consumption) because the     reported size of a contained image is not properly checked for an ICO container, and thus an attempted     memory allocation can be very large. (CVE-2021-27923)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Fedora 33 host has packages installed that are affected by multiple vulnerabilities as referenced in the FEDORA-2021-15845d3abe advisory.

  - In Pillow before 8.1.0, TiffDecode has a heap-based buffer overflow when decoding crafted YCbCr files     because of certain interpretation conflicts with LibTIFF in RGBA mode. (CVE-2020-35654)

  - An issue was discovered in Pillow before 8.1.1. TiffDecode has a heap-based buffer overflow when decoding     crafted YCbCr files because of certain interpretation conflicts with LibTIFF in RGBA mode. NOTE: this     issue exists because of an incomplete fix for CVE-2020-35654. (CVE-2021-25289)

  - An issue was discovered in Pillow before 8.1.1. In TiffDecode.c, there is a negative-offset memcpy with an     invalid size. (CVE-2021-25290)

  - An issue was discovered in Pillow before 8.1.1. In TiffDecode.c, there is an out-of-bounds read in     TiffreadRGBATile via invalid tile boundaries. (CVE-2021-25291)

  - An issue was discovered in Pillow before 8.1.1. The PDF parser allows a regular expression DoS (ReDoS)     attack via a crafted PDF file because of a catastrophic backtracking regex. (CVE-2021-25292)

  - An issue was discovered in Pillow before 8.1.1. There is an out-of-bounds read in SGIRleDecode.c.
    (CVE-2021-25293)

  - Pillow before 8.1.1 allows attackers to cause a denial of service (memory consumption) because the     reported size of a contained image is not properly checked for a BLP container, and thus an attempted     memory allocation can be very large. (CVE-2021-27921)

  - Pillow before 8.1.1 allows attackers to cause a denial of service (memory consumption) because the     reported size of a contained image is not properly checked for an ICNS container, and thus an attempted     memory allocation can be very large. (CVE-2021-27922)

  - Pillow before 8.1.1 allows attackers to cause a denial of service (memory consumption) because the     reported size of a contained image is not properly checked for an ICO container, and thus an attempted     memory allocation can be very large. (CVE-2021-27923)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
250972	Linux Distros Unpatched Vulnerability : CVE-2021-25289	Nessus	Misc.	critical
410658	SCA: security update for pillow (GHSA-57h3-9rgr-c24m)	Tenable Cloud Security	SCA Checks	critical
410658	SCA: security update for pillow (GHSA-57h3-9rgr-c24m)	Tenable Self-Hosted Container Security	SCA Checks	critical
200510	SUSE SLES15 Security Update : python-Pillow (SUSE-SU-2024:1673-2)	Nessus	SuSE Local Security Checks	critical
197551	openSUSE 15 Security Update : python-Pillow (SUSE-SU-2024:1673-1)	Nessus	SuSE Local Security Checks	critical
406690	Alpine: multiple py3-pillow packages: security update to 8.1.2-r0	Tenable Cloud Security	Alpine Linux Local Security Checks	critical
406690	Alpine: multiple py3-pillow packages: security update to 8.1.2-r0	Tenable Self-Hosted Container Security	Alpine Linux Local Security Checks	critical
156973	GLSA-202107-33 : Pillow: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	critical
153724	EulerOS 2.0 SP9 : python-pillow (EulerOS-SA-2021-2564)	Nessus	Huawei Local Security Checks	critical
153695	EulerOS 2.0 SP9 : python-pillow (EulerOS-SA-2021-2540)	Nessus	Huawei Local Security Checks	critical
152473	openSUSE 15 Security Update : python-CairoSVG, python-Pillow (openSUSE-SU-2021:1134-1)	Nessus	SuSE Local Security Checks	critical
147998	Ubuntu 16.04 LTS / 18.04 LTS / 20.04 LTS : Pillow vulnerabilities (USN-4763-1)	Nessus	Ubuntu Local Security Checks	critical
147777	Fedora 32 : python-pillow / python2-pillow (2021-0ece308612)	Nessus	Fedora Local Security Checks	critical
147773	Fedora 33 : mingw-python-pillow / python-pillow / python2-pillow (2021-15845d3abe)	Nessus	Fedora Local Security Checks	critical

Detections

Analytics

CVE-2021-25289

critical

Tenable Plugins

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical