RHSA-2021:4149
Vulnerability from csaf_opensuse - Published: 2021-11-09 00:00 - Updated: 2026-09-20 11:17Summary
security update for python-pillow
Severity
Moderate
Notes
Title of the patch: security update for python-pillow
Description of the patch: This security update provides a functional equivalent of RHSA-2021:4149.
The original Red Hat(R) advisory is available from the Red Hat web site at
https://access.redhat.com/errata/RHSA-2021:4149.
Patchnames: RHSA-2021:4149
Terms of use: CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).
8.1 (High)
Affected products
Recommended
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: SUSE Liberty Linux 8:python3-pillow-0:5.1.1-16.el8.x86_64 | — |
Vendor Fix
|
Threats
Impact
important
8.1 (High)
Affected products
Recommended
1 product, the same list as for
CVE-2020-35653
Threats
Impact
important
8.2 (High)
Affected products
Recommended
1 product, the same list as for
CVE-2020-35653
Threats
Impact
important
7.5 (High)
Affected products
Recommended
1 product, the same list as for
CVE-2020-35653
Threats
Impact
important
7.5 (High)
Affected products
Recommended
1 product, the same list as for
CVE-2020-35653
Threats
Impact
important
7.5 (High)
Affected products
Recommended
1 product, the same list as for
CVE-2020-35653
Threats
Impact
important
7.5 (High)
Affected products
Recommended
1 product, the same list as for
CVE-2020-35653
Threats
Impact
important
7.5 (High)
Affected products
Recommended
1 product, the same list as for
CVE-2020-35653
Threats
Impact
important
7.5 (High)
Affected products
Recommended
1 product, the same list as for
CVE-2020-35653
Threats
Impact
important
7.5 (High)
Affected products
Recommended
1 product, the same list as for
CVE-2020-35653
Threats
Impact
important
7.5 (High)
Affected products
Recommended
1 product, the same list as for
CVE-2020-35653
Threats
Impact
important
7.5 (High)
Affected products
Recommended
1 product, the same list as for
CVE-2020-35653
Threats
Impact
important
7.5 (High)
Affected products
Recommended
1 product, the same list as for
CVE-2020-35653
Threats
Impact
important
7.5 (High)
Affected products
Recommended
1 product, the same list as for
CVE-2020-35653
Threats
Impact
important
7.5 (High)
Affected products
Recommended
1 product, the same list as for
CVE-2020-35653
Threats
Impact
important
References
47 references
{
"document": {
"aggregate_severity": {
"namespace": "https://www.suse.com/support/security/rating/",
"text": "Moderate"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright 2024 SUSE LLC. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "security update for python-pillow",
"title": "Title of the patch"
},
{
"category": "description",
"text": "This security update provides a functional equivalent of RHSA-2021:4149.\nThe original Red Hat(R) advisory is available from the Red Hat web site at\nhttps://access.redhat.com/errata/RHSA-2021:4149.\n",
"title": "Description of the patch"
},
{
"category": "details",
"text": "RHSA-2021:4149",
"title": "Patchnames"
},
{
"category": "legal_disclaimer",
"text": "CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).",
"title": "Terms of use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://www.suse.com/support/security/contact/",
"name": "SUSE Product Security Team",
"namespace": "https://www.suse.com/"
},
"references": [
{
"category": "external",
"summary": "SUSE ratings",
"url": "https://www.suse.com/support/security/rating/"
},
{
"category": "self",
"summary": "URL of this CSAF notice",
"url": "https://ftp.suse.com/pub/projects/security/csaf/rhsa-2021_4149.json"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2020-35653 page",
"url": "https://www.suse.com/security/cve/CVE-2020-35653/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2020-35655 page",
"url": "https://www.suse.com/security/cve/CVE-2020-35655/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2021-25287 page",
"url": "https://www.suse.com/security/cve/CVE-2021-25287/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2021-25288 page",
"url": "https://www.suse.com/security/cve/CVE-2021-25288/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2021-25290 page",
"url": "https://www.suse.com/security/cve/CVE-2021-25290/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2021-25292 page",
"url": "https://www.suse.com/security/cve/CVE-2021-25292/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2021-25293 page",
"url": "https://www.suse.com/security/cve/CVE-2021-25293/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2021-27921 page",
"url": "https://www.suse.com/security/cve/CVE-2021-27921/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2021-27922 page",
"url": "https://www.suse.com/security/cve/CVE-2021-27922/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2021-27923 page",
"url": "https://www.suse.com/security/cve/CVE-2021-27923/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2021-28675 page",
"url": "https://www.suse.com/security/cve/CVE-2021-28675/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2021-28676 page",
"url": "https://www.suse.com/security/cve/CVE-2021-28676/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2021-28677 page",
"url": "https://www.suse.com/security/cve/CVE-2021-28677/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2021-28678 page",
"url": "https://www.suse.com/security/cve/CVE-2021-28678/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2021-34552 page",
"url": "https://www.suse.com/security/cve/CVE-2021-34552/"
}
],
"title": "security update for python-pillow",
"tracking": {
"current_release_date": "2026-09-20T11:17:06Z",
"generator": {
"date": "2021-11-09T00:00:00Z",
"engine": {
"name": "cve-database.git:bin/generate-csaf.pl",
"version": "1"
}
},
"id": "RHSA-2021:4149",
"initial_release_date": "2021-11-09T00:00:00Z",
"revision_history": [
{
"date": "2021-11-09T00:00:00Z",
"number": "1",
"summary": "Current version"
},
{
"date": "2026-09-20T11:17:06Z",
"number": "2",
"summary": "unknown changes"
}
],
"status": "final",
"version": "2"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_version",
"name": "python3-pillow-0:5.1.1-16.el8.x86_64",
"product": {
"name": "python3-pillow-0:5.1.1-16.el8.x86_64",
"product_id": "python3-pillow-0:5.1.1-16.el8.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/suse/python3-pillow@5.1.1-16.el8?arch=x86_64"
}
}
}
],
"category": "architecture",
"name": "x86_64"
},
{
"branches": [
{
"category": "product_name",
"name": "SUSE Liberty Linux 8",
"product": {
"name": "SUSE Liberty Linux 8",
"product_id": "SUSE Liberty Linux 8",
"product_identification_helper": {
"cpe": "cpe:/o:suse:sll:8"
}
}
}
],
"category": "product_family",
"name": "SUSE Linux Enterprise"
}
],
"category": "vendor",
"name": "SUSE"
}
],
"relationships": [
{
"category": "default_component_of",
"full_product_name": {
"name": "python3-pillow-0:5.1.1-16.el8.x86_64 as component of SUSE Liberty Linux 8",
"product_id": "SUSE Liberty Linux 8:python3-pillow-0:5.1.1-16.el8.x86_64"
},
"product_reference": "python3-pillow-0:5.1.1-16.el8.x86_64",
"relates_to_product_reference": "SUSE Liberty Linux 8"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2020-35653",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2020-35653"
}
],
"notes": [
{
"category": "general",
"text": "In Pillow before 8.1.0, PcxDecode has a buffer over-read when decoding a crafted PCX file because the user-supplied stride value is trusted for buffer calculations.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Liberty Linux 8:python3-pillow-0:5.1.1-16.el8.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2020-35653",
"url": "https://www.suse.com/security/cve/CVE-2020-35653"
},
{
"category": "external",
"summary": "SUSE Bug 1180834 for CVE-2020-35653",
"url": "https://bugzilla.suse.com/1180834"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Liberty Linux 8:python3-pillow-0:5.1.1-16.el8.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 8.1,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H",
"version": "3.1"
},
"products": [
"SUSE Liberty Linux 8:python3-pillow-0:5.1.1-16.el8.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2021-11-09T00:00:00Z",
"details": "important"
}
],
"title": "CVE-2020-35653"
},
{
"cve": "CVE-2020-35655",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2020-35655"
}
],
"notes": [
{
"category": "general",
"text": "In Pillow before 8.1.0, SGIRleDecode has a 4-byte buffer over-read when decoding crafted SGI RLE image files because offsets and length tables are mishandled.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Liberty Linux 8:python3-pillow-0:5.1.1-16.el8.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2020-35655",
"url": "https://www.suse.com/security/cve/CVE-2020-35655"
},
{
"category": "external",
"summary": "SUSE Bug 1180832 for CVE-2020-35655",
"url": "https://bugzilla.suse.com/1180832"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Liberty Linux 8:python3-pillow-0:5.1.1-16.el8.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 8.1,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H",
"version": "3.1"
},
"products": [
"SUSE Liberty Linux 8:python3-pillow-0:5.1.1-16.el8.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2021-11-09T00:00:00Z",
"details": "important"
}
],
"title": "CVE-2020-35655"
},
{
"cve": "CVE-2021-25287",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2021-25287"
}
],
"notes": [
{
"category": "general",
"text": "An issue was discovered in Pillow before 8.2.0. There is an out-of-bounds read in J2kDecode, in j2ku_graya_la.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Liberty Linux 8:python3-pillow-0:5.1.1-16.el8.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2021-25287",
"url": "https://www.suse.com/security/cve/CVE-2021-25287"
},
{
"category": "external",
"summary": "SUSE Bug 1185805 for CVE-2021-25287",
"url": "https://bugzilla.suse.com/1185805"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Liberty Linux 8:python3-pillow-0:5.1.1-16.el8.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 8.2,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H",
"version": "3.1"
},
"products": [
"SUSE Liberty Linux 8:python3-pillow-0:5.1.1-16.el8.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2021-11-09T00:00:00Z",
"details": "important"
}
],
"title": "CVE-2021-25287"
},
{
"cve": "CVE-2021-25288",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2021-25288"
}
],
"notes": [
{
"category": "general",
"text": "An issue was discovered in Pillow before 8.2.0. There is an out-of-bounds read in J2kDecode, in j2ku_gray_i.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Liberty Linux 8:python3-pillow-0:5.1.1-16.el8.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2021-25288",
"url": "https://www.suse.com/security/cve/CVE-2021-25288"
},
{
"category": "external",
"summary": "SUSE Bug 1185803 for CVE-2021-25288",
"url": "https://bugzilla.suse.com/1185803"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Liberty Linux 8:python3-pillow-0:5.1.1-16.el8.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"SUSE Liberty Linux 8:python3-pillow-0:5.1.1-16.el8.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2021-11-09T00:00:00Z",
"details": "important"
}
],
"title": "CVE-2021-25288"
},
{
"cve": "CVE-2021-25290",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2021-25290"
}
],
"notes": [
{
"category": "general",
"text": "An issue was discovered in Pillow before 8.1.1. In TiffDecode.c, there is a negative-offset memcpy with an invalid size.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Liberty Linux 8:python3-pillow-0:5.1.1-16.el8.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2021-25290",
"url": "https://www.suse.com/security/cve/CVE-2021-25290"
},
{
"category": "external",
"summary": "SUSE Bug 1183105 for CVE-2021-25290",
"url": "https://bugzilla.suse.com/1183105"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Liberty Linux 8:python3-pillow-0:5.1.1-16.el8.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"SUSE Liberty Linux 8:python3-pillow-0:5.1.1-16.el8.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2021-11-09T00:00:00Z",
"details": "important"
}
],
"title": "CVE-2021-25290"
},
{
"cve": "CVE-2021-25292",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2021-25292"
}
],
"notes": [
{
"category": "general",
"text": "An issue was discovered in Pillow before 8.1.1. The PDF parser allows a regular expression DoS (ReDoS) attack via a crafted PDF file because of a catastrophic backtracking regex.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Liberty Linux 8:python3-pillow-0:5.1.1-16.el8.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2021-25292",
"url": "https://www.suse.com/security/cve/CVE-2021-25292"
},
{
"category": "external",
"summary": "SUSE Bug 1183101 for CVE-2021-25292",
"url": "https://bugzilla.suse.com/1183101"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Liberty Linux 8:python3-pillow-0:5.1.1-16.el8.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"SUSE Liberty Linux 8:python3-pillow-0:5.1.1-16.el8.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2021-11-09T00:00:00Z",
"details": "important"
}
],
"title": "CVE-2021-25292"
},
{
"cve": "CVE-2021-25293",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2021-25293"
}
],
"notes": [
{
"category": "general",
"text": "An issue was discovered in Pillow before 8.1.1. There is an out-of-bounds read in SGIRleDecode.c.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Liberty Linux 8:python3-pillow-0:5.1.1-16.el8.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2021-25293",
"url": "https://www.suse.com/security/cve/CVE-2021-25293"
},
{
"category": "external",
"summary": "SUSE Bug 1183102 for CVE-2021-25293",
"url": "https://bugzilla.suse.com/1183102"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Liberty Linux 8:python3-pillow-0:5.1.1-16.el8.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"SUSE Liberty Linux 8:python3-pillow-0:5.1.1-16.el8.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2021-11-09T00:00:00Z",
"details": "important"
}
],
"title": "CVE-2021-25293"
},
{
"cve": "CVE-2021-27921",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2021-27921"
}
],
"notes": [
{
"category": "general",
"text": "Pillow before 8.1.2 allows attackers to cause a denial of service (memory consumption) because the reported size of a contained image is not properly checked for a BLP container, and thus an attempted memory allocation can be very large.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Liberty Linux 8:python3-pillow-0:5.1.1-16.el8.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2021-27921",
"url": "https://www.suse.com/security/cve/CVE-2021-27921"
},
{
"category": "external",
"summary": "SUSE Bug 1183110 for CVE-2021-27921",
"url": "https://bugzilla.suse.com/1183110"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Liberty Linux 8:python3-pillow-0:5.1.1-16.el8.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"SUSE Liberty Linux 8:python3-pillow-0:5.1.1-16.el8.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2021-11-09T00:00:00Z",
"details": "important"
}
],
"title": "CVE-2021-27921"
},
{
"cve": "CVE-2021-27922",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2021-27922"
}
],
"notes": [
{
"category": "general",
"text": "Pillow before 8.1.2 allows attackers to cause a denial of service (memory consumption) because the reported size of a contained image is not properly checked for an ICNS container, and thus an attempted memory allocation can be very large.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Liberty Linux 8:python3-pillow-0:5.1.1-16.el8.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2021-27922",
"url": "https://www.suse.com/security/cve/CVE-2021-27922"
},
{
"category": "external",
"summary": "SUSE Bug 1183108 for CVE-2021-27922",
"url": "https://bugzilla.suse.com/1183108"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Liberty Linux 8:python3-pillow-0:5.1.1-16.el8.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"SUSE Liberty Linux 8:python3-pillow-0:5.1.1-16.el8.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2021-11-09T00:00:00Z",
"details": "important"
}
],
"title": "CVE-2021-27922"
},
{
"cve": "CVE-2021-27923",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2021-27923"
}
],
"notes": [
{
"category": "general",
"text": "Pillow before 8.1.2 allows attackers to cause a denial of service (memory consumption) because the reported size of a contained image is not properly checked for an ICO container, and thus an attempted memory allocation can be very large.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Liberty Linux 8:python3-pillow-0:5.1.1-16.el8.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2021-27923",
"url": "https://www.suse.com/security/cve/CVE-2021-27923"
},
{
"category": "external",
"summary": "SUSE Bug 1183107 for CVE-2021-27923",
"url": "https://bugzilla.suse.com/1183107"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Liberty Linux 8:python3-pillow-0:5.1.1-16.el8.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"SUSE Liberty Linux 8:python3-pillow-0:5.1.1-16.el8.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2021-11-09T00:00:00Z",
"details": "important"
}
],
"title": "CVE-2021-27923"
},
{
"cve": "CVE-2021-28675",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2021-28675"
}
],
"notes": [
{
"category": "general",
"text": "An issue was discovered in Pillow before 8.2.0. PSDImagePlugin.PsdImageFile lacked a sanity check on the number of input layers relative to the size of the data block. This could lead to a DoS on Image.open prior to Image.load.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Liberty Linux 8:python3-pillow-0:5.1.1-16.el8.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2021-28675",
"url": "https://www.suse.com/security/cve/CVE-2021-28675"
},
{
"category": "external",
"summary": "SUSE Bug 1185804 for CVE-2021-28675",
"url": "https://bugzilla.suse.com/1185804"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Liberty Linux 8:python3-pillow-0:5.1.1-16.el8.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"SUSE Liberty Linux 8:python3-pillow-0:5.1.1-16.el8.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2021-11-09T00:00:00Z",
"details": "important"
}
],
"title": "CVE-2021-28675"
},
{
"cve": "CVE-2021-28676",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2021-28676"
}
],
"notes": [
{
"category": "general",
"text": "An issue was discovered in Pillow before 8.2.0. For FLI data, FliDecode did not properly check that the block advance was non-zero, potentially leading to an infinite loop on load.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Liberty Linux 8:python3-pillow-0:5.1.1-16.el8.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2021-28676",
"url": "https://www.suse.com/security/cve/CVE-2021-28676"
},
{
"category": "external",
"summary": "SUSE Bug 1185786 for CVE-2021-28676",
"url": "https://bugzilla.suse.com/1185786"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Liberty Linux 8:python3-pillow-0:5.1.1-16.el8.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"SUSE Liberty Linux 8:python3-pillow-0:5.1.1-16.el8.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2021-11-09T00:00:00Z",
"details": "important"
}
],
"title": "CVE-2021-28676"
},
{
"cve": "CVE-2021-28677",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2021-28677"
}
],
"notes": [
{
"category": "general",
"text": "An issue was discovered in Pillow before 8.2.0. For EPS data, the readline implementation used in EPSImageFile has to deal with any combination of \\r and \\n as line endings. It used an accidentally quadratic method of accumulating lines while looking for a line ending. A malicious EPS file could use this to perform a DoS of Pillow in the open phase, before an image was accepted for opening.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Liberty Linux 8:python3-pillow-0:5.1.1-16.el8.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2021-28677",
"url": "https://www.suse.com/security/cve/CVE-2021-28677"
},
{
"category": "external",
"summary": "SUSE Bug 1185785 for CVE-2021-28677",
"url": "https://bugzilla.suse.com/1185785"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Liberty Linux 8:python3-pillow-0:5.1.1-16.el8.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"SUSE Liberty Linux 8:python3-pillow-0:5.1.1-16.el8.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2021-11-09T00:00:00Z",
"details": "important"
}
],
"title": "CVE-2021-28677"
},
{
"cve": "CVE-2021-28678",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2021-28678"
}
],
"notes": [
{
"category": "general",
"text": "An issue was discovered in Pillow before 8.2.0. For BLP data, BlpImagePlugin did not properly check that reads (after jumping to file offsets) returned data. This could lead to a DoS where the decoder could be run a large number of times on empty data.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Liberty Linux 8:python3-pillow-0:5.1.1-16.el8.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2021-28678",
"url": "https://www.suse.com/security/cve/CVE-2021-28678"
},
{
"category": "external",
"summary": "SUSE Bug 1185784 for CVE-2021-28678",
"url": "https://bugzilla.suse.com/1185784"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Liberty Linux 8:python3-pillow-0:5.1.1-16.el8.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"SUSE Liberty Linux 8:python3-pillow-0:5.1.1-16.el8.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2021-11-09T00:00:00Z",
"details": "important"
}
],
"title": "CVE-2021-28678"
},
{
"cve": "CVE-2021-34552",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2021-34552"
}
],
"notes": [
{
"category": "general",
"text": "Pillow through 8.2.0 and PIL (aka Python Imaging Library) through 1.1.7 allow an attacker to pass controlled parameters directly into a convert function to trigger a buffer overflow in Convert.c.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Liberty Linux 8:python3-pillow-0:5.1.1-16.el8.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2021-34552",
"url": "https://www.suse.com/security/cve/CVE-2021-34552"
},
{
"category": "external",
"summary": "SUSE Bug 1188574 for CVE-2021-34552",
"url": "https://bugzilla.suse.com/1188574"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Liberty Linux 8:python3-pillow-0:5.1.1-16.el8.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"SUSE Liberty Linux 8:python3-pillow-0:5.1.1-16.el8.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2021-11-09T00:00:00Z",
"details": "important"
}
],
"title": "CVE-2021-34552"
}
]
}
Loading…
Loading…
Experimental. This forecast is provided for visualization only and may change without notice. Do not use it for operational decisions.
Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.
Sightings
| Author | Source | Type | Date | Other |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Loading…
Loading…
The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the
vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base
model, served locally by ML-Gateway.
They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.
Loading…
Related by attack behaviour
Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.
Loading…