CVE-2021-28676
published 2021-06-02CVE-2021-28676: An issue was discovered in Pillow before 8.2.0. For FLI data, FliDecode did not properly check that the block advance was non-zero, potentially leading to an…
PriorityP337high7.5CVSS 3.1
AVNACLPRNUINSUCNINAH
EPSS
2.45%
82.7th percentile
An issue was discovered in Pillow before 8.2.0. For FLI data, FliDecode did not properly check that the block advance was non-zero, potentially leading to an infinite loop on load.
Affected
12 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | pillow | < pillow 8.1.2+dfsg-0.2 (bookworm) | pillow 8.1.2+dfsg-0.2 (bookworm) |
| fedoraproject | fedora | — | — |
| paloalto | pan-os | — | — |
| python | pillow | < 8.2.0 | 8.2.0 |
| python | pillow | >= 0 < 8.1.2+dfsg-0.2 | 8.1.2+dfsg-0.2 |
| python | pillow | >= 0 < 8.1.2+dfsg-0.2 | 8.1.2+dfsg-0.2 |
| python | pillow | >= 0 < 8.1.2+dfsg-0.2 | 8.1.2+dfsg-0.2 |
| python | pillow | >= 0 < 8.1.2+dfsg-0.2 | 8.1.2+dfsg-0.2 |
| python | pillow | >= 0 < 8.2.0 | 8.2.0 |
| python | pillow | >= 0 < 2.3.0-1ubuntu3.4+esm5 | 2.3.0-1ubuntu3.4+esm5 |
| python | pillow | >= 0 < 3.1.2-0ubuntu1.6+esm3 | 3.1.2-0ubuntu1.6+esm3 |
| python | pillow | >= 0 < 5.1.0-1ubuntu0.8+esm2 | 5.1.0-1ubuntu0.8+esm2 |
CVSS provenance
nvdv3.17.5HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
nvdv2.05.0MEDIUMAV:N/AC:L/Au:N/C:N/I:N/A:P
osv9.1CRITICAL
vendor_ubuntu9.1CRITICAL
vendor_debian7.5HIGH
vendor_redhat7.5HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
OSV
pillow vulnerabilities
osv·2026-03-31·CVSS 9.1
CVE-2021-25287 [CRITICAL] pillow vulnerabilities
pillow vulnerabilities
It was discovered that Pillow did not correctly handle reading J2K files,
which could lead to an out-of-bounds read vulnerability. If a user or
automated system were tricked into opening a specially crafted file, an
attacker could possibly use this issue to cause a denial of service. This
issue only affected Ubuntu 16.04 LTS. (CVE-2021-25287, CVE-2021-25288)
It was discovered that Pillow did not correctly handle certain integer
arithmetic, which could lead to a buffer overflow. An attacker could
possibly use this issue to cause a denial of service or execute arbitrary
code. This issue only affected Ubuntu 14.04 LTS. (CVE-2021-25290)
It was discovered that Pillow did not correctly perform bounds checking
for certain operations. An attacker could possibly use this i
OSV
Potential infinite loop in Pillow
osv·2021-06-08
CVE-2021-28676 [HIGH] Potential infinite loop in Pillow
Potential infinite loop in Pillow
An issue was discovered in Pillow before 8.2.0. For FLI data, FliDecode did not properly check that the block advance was non-zero, potentially leading to an infinite loop on load.
GHSA
Potential infinite loop in Pillow
ghsa·2021-06-08
CVE-2021-28676 [HIGH] CWE-835 Potential infinite loop in Pillow
Potential infinite loop in Pillow
An issue was discovered in Pillow before 8.2.0. For FLI data, FliDecode did not properly check that the block advance was non-zero, potentially leading to an infinite loop on load.
OSV
CVE-2021-28676: An issue was discovered in Pillow before 8
osv·2021-06-02·CVSS 7.5
CVE-2021-28676 [HIGH] CVE-2021-28676: An issue was discovered in Pillow before 8
An issue was discovered in Pillow before 8.2.0. For FLI data, FliDecode did not properly check that the block advance was non-zero, potentially leading to an infinite loop on load.
Ubuntu
Pillow vulnerabilities
vendor_ubuntu·2026-03-31·CVSS 9.1
CVE-2023-50447 [CRITICAL] Pillow vulnerabilities
Title: Pillow vulnerabilities
Summary: Several security issues were fixed in Pillow.
It was discovered that Pillow did not correctly handle reading J2K files,
which could lead to an out-of-bounds read vulnerability. If a user or
automated system were tricked into opening a specially crafted file, an
attacker could possibly use this issue to cause a denial of service. This
issue only affected Ubuntu 16.04 LTS. (CVE-2021-25287, CVE-2021-25288)
It was discovered that Pillow did not correctly handle certain integer
arithmetic, which could lead to a buffer overflow. An attacker could
possibly use this issue to cause a denial of service or execute arbitrary
code. This issue only affected Ubuntu 14.04 LTS. (CVE-2021-25290)
It was discovered that Pillow did not correctly perform bounds checkin
Palo Alto
PAN-SA-2024-0001 Informational Bulletin: Impact of OSS CVEs in PAN-OS
vendor_paloalto·2024-02-14·CVSS 9.8
CVE-2017-18342 [CRITICAL] PAN-SA-2024-0001 Informational Bulletin: Impact of OSS CVEs in PAN-OS
PAN-SA-2024-0001 Informational Bulletin: Impact of OSS CVEs in PAN-OS
The Palo Alto Networks Product Security Assurance team has evaluated the following open source software (OSS) CVEs as they relate to PAN-OS software. While PAN-OS software may include the
CVEs: CVE-2017-18342, CVE-2017-8923, CVE-2017-9120, CVE-2019-1551, CVE-2019-16865, CVE-2019-16905, CVE-2019-19523, CVE-2019-19528, CVE-2019-19911, CVE-2020-0404, CVE-2020-0431, CVE-2020-0466, CVE-2020-10379, CVE-2020-11538, CVE-2020-11608, CVE-2020-12114, CVE-2020-12321, CVE-2020-12362, CVE-2020-12363, CVE-2020-12364, CVE-2020-13757, CVE-2020-14314, CVE-2020-14351, CVE-2020-15778, CVE-2020-1967, CVE-2020-24394, CVE-2020-24504, CVE-2020-25211, CVE-2020-25212, CVE-2020-25284, CVE-2020-25285, CVE-2020-25717, CVE-2020-26541, CVE-2020-2715
Ubuntu
Pillow vulnerabilities
vendor_ubuntu·2021-05-19
CVE-2021-28677 Pillow vulnerabilities
Title: Pillow vulnerabilities
Summary: Pillow could be made to crash or hang if it opened a specially crafted
file.
It was discovered that Pillow incorrectly handled certain image files. If a
user or automated system were tricked into opening a specially-crafted
file, a remote attacker could cause Pillow to crash or hand, resulting in a
denial of service.
Instructions: In general, a standard system update will make all the necessary changes.
Red Hat
python-pillow: Infinite loop in FLI image reader
vendor_redhat·2021-04-01·CVSS 7.5
CVE-2021-28676 [HIGH] CWE-835 python-pillow: Infinite loop in FLI image reader
python-pillow: Infinite loop in FLI image reader
An issue was discovered in Pillow before 8.2.0. For FLI data, FliDecode did not properly check that the block advance was non-zero, potentially leading to an infinite loop on load.
A flaw was found in python-pillow. FliDecode.c did not properly check that the block advance was non-zero, potentially leading to an infinite loop on load. This issue dates to the PIL fork. The highest threat from this vulnerability is to system availability.
Mitigation: To mitigate this feature on Red Hat Quay, keep the invoice generation feature disabled, as it is by default.
Package: python-pillow (Red Hat Enterprise Linux 7) - Out of support scope
Package: quay/quay-rhel8 (Red Hat Quay 3) - Affected
Debian
CVE-2021-28676: pillow - An issue was discovered in Pillow before 8.2.0. For FLI data, FliDecode did not ...
vendor_debian·2021·CVSS 7.5
CVE-2021-28676 [HIGH] CVE-2021-28676: pillow - An issue was discovered in Pillow before 8.2.0. For FLI data, FliDecode did not ...
An issue was discovered in Pillow before 8.2.0. For FLI data, FliDecode did not properly check that the block advance was non-zero, potentially leading to an infinite loop on load.
Scope: local
bookworm: resolved (fixed in 8.1.2+dfsg-0.2)
bullseye: resolved (fixed in 8.1.2+dfsg-0.2)
forky: resolved (fixed in 8.1.2+dfsg-0.2)
sid: resolved (fixed in 8.1.2+dfsg-0.2)
trixie: resolved (fixed in 8.1.2+dfsg-0.2)
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
https://github.com/python-pillow/Pillow/commit/bb6c11fb889e6c11b0ee122b828132ee763b5856https://github.com/python-pillow/Pillow/pull/5377https://lists.debian.org/debian-lts-announce/2021/07/msg00018.htmlhttps://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/MQHA5HAIBOYI3R6HDWCLAGFTIQP767FL/https://pillow.readthedocs.io/en/stable/releasenotes/8.2.0.html#cve-2021-28676-fix-fli-doshttps://security.gentoo.org/glsa/202107-33https://github.com/python-pillow/Pillow/commit/bb6c11fb889e6c11b0ee122b828132ee763b5856https://github.com/python-pillow/Pillow/pull/5377https://lists.debian.org/debian-lts-announce/2021/07/msg00018.htmlhttps://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/MQHA5HAIBOYI3R6HDWCLAGFTIQP767FL/https://pillow.readthedocs.io/en/stable/releasenotes/8.2.0.html#cve-2021-28676-fix-fli-doshttps://security.gentoo.org/glsa/202107-33
2021-06-02
Published