CVE-2021-28677
published 2021-06-02CVE-2021-28677: An issue was discovered in Pillow before 8.2.0. For EPS data, the readline implementation used in EPSImageFile has to deal with any combination of \r and \n as…
PriorityP339high7.5CVSS 3.1
AVNACLPRNUINSUCNINAH
EPSS
2.29%
81.3th percentile
An issue was discovered in Pillow before 8.2.0. For EPS data, the readline implementation used in EPSImageFile has to deal with any combination of \r and \n as line endings. It used an accidentally quadratic method of accumulating lines while looking for a line ending. A malicious EPS file could use this to perform a DoS of Pillow in the open phase, before an image was accepted for opening.
Affected
12 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | pillow | < pillow 8.1.2+dfsg-0.2 (bookworm) | pillow 8.1.2+dfsg-0.2 (bookworm) |
| fedoraproject | fedora | — | — |
| paloalto | pan-os | — | — |
| python | pillow | < 8.2.0 | 8.2.0 |
| python | pillow | >= 0 < 8.1.2+dfsg-0.2 | 8.1.2+dfsg-0.2 |
| python | pillow | >= 0 < 8.1.2+dfsg-0.2 | 8.1.2+dfsg-0.2 |
| python | pillow | >= 0 < 8.1.2+dfsg-0.2 | 8.1.2+dfsg-0.2 |
| python | pillow | >= 0 < 8.1.2+dfsg-0.2 | 8.1.2+dfsg-0.2 |
| python | pillow | >= 0 < 8.2.0 | 8.2.0 |
| python | pillow | >= 0 < 2.3.0-1ubuntu3.4+esm5 | 2.3.0-1ubuntu3.4+esm5 |
| python | pillow | >= 0 < 3.1.2-0ubuntu1.6+esm3 | 3.1.2-0ubuntu1.6+esm3 |
| python | pillow | >= 0 < 5.1.0-1ubuntu0.8+esm2 | 5.1.0-1ubuntu0.8+esm2 |
CVSS provenance
nvdv3.17.5HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
nvdv2.05.0MEDIUMAV:N/AC:L/Au:N/C:N/I:N/A:P
osv9.1CRITICAL
vendor_ubuntu9.1CRITICAL
vendor_debian7.5HIGH
vendor_redhat7.5HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Ubuntu
Pillow vulnerabilities
vendor_ubuntu·2026-03-31·CVSS 9.1
CVE-2023-50447 [CRITICAL] Pillow vulnerabilities
Title: Pillow vulnerabilities
Summary: Several security issues were fixed in Pillow.
It was discovered that Pillow did not correctly handle reading J2K files,
which could lead to an out-of-bounds read vulnerability. If a user or
automated system were tricked into opening a specially crafted file, an
attacker could possibly use this issue to cause a denial of service. This
issue only affected Ubuntu 16.04 LTS. (CVE-2021-25287, CVE-2021-25288)
It was discovered that Pillow did not correctly handle certain integer
arithmetic, which could lead to a buffer overflow. An attacker could
possibly use this issue to cause a denial of service or execute arbitrary
code. This issue only affected Ubuntu 14.04 LTS. (CVE-2021-25290)
It was discovered that Pillow did not correctly perform bounds checkin
Palo Alto
PAN-SA-2024-0001 Informational Bulletin: Impact of OSS CVEs in PAN-OS
vendor_paloalto·2024-02-14·CVSS 9.8
CVE-2017-18342 [CRITICAL] PAN-SA-2024-0001 Informational Bulletin: Impact of OSS CVEs in PAN-OS
PAN-SA-2024-0001 Informational Bulletin: Impact of OSS CVEs in PAN-OS
The Palo Alto Networks Product Security Assurance team has evaluated the following open source software (OSS) CVEs as they relate to PAN-OS software. While PAN-OS software may include the
CVEs: CVE-2017-18342, CVE-2017-8923, CVE-2017-9120, CVE-2019-1551, CVE-2019-16865, CVE-2019-16905, CVE-2019-19523, CVE-2019-19528, CVE-2019-19911, CVE-2020-0404, CVE-2020-0431, CVE-2020-0466, CVE-2020-10379, CVE-2020-11538, CVE-2020-11608, CVE-2020-12114, CVE-2020-12321, CVE-2020-12362, CVE-2020-12363, CVE-2020-12364, CVE-2020-13757, CVE-2020-14314, CVE-2020-14351, CVE-2020-15778, CVE-2020-1967, CVE-2020-24394, CVE-2020-24504, CVE-2020-25211, CVE-2020-25212, CVE-2020-25284, CVE-2020-25285, CVE-2020-25717, CVE-2020-26541, CVE-2020-2715
Ubuntu
Pillow vulnerabilities
vendor_ubuntu·2021-05-19
CVE-2021-28677 Pillow vulnerabilities
Title: Pillow vulnerabilities
Summary: Pillow could be made to crash or hang if it opened a specially crafted
file.
It was discovered that Pillow incorrectly handled certain image files. If a
user or automated system were tricked into opening a specially-crafted
file, a remote attacker could cause Pillow to crash or hand, resulting in a
denial of service.
Instructions: In general, a standard system update will make all the necessary changes.
Red Hat
python-pillow: Excessive CPU use in EPS image reader
vendor_redhat·2021-04-01·CVSS 7.5
CVE-2021-28677 [HIGH] CWE-20 python-pillow: Excessive CPU use in EPS image reader
python-pillow: Excessive CPU use in EPS image reader
An issue was discovered in Pillow before 8.2.0. For EPS data, the readline implementation used in EPSImageFile has to deal with any combination of \r and \n as line endings. It used an accidentally quadratic method of accumulating lines while looking for a line ending. A malicious EPS file could use this to perform a DoS of Pillow in the open phase, before an image was accepted for opening.
A flaw was found in python-pillow. The readline used in EPS has to deal with any combination of \r and \n as line endings. It accidentally used a quadratic method of accumulating lines while looking for a line ending. A malicious EPS file could use this to perform a denial-of-service of Pillow in the open phase, before an image was accepted for open
Debian
CVE-2021-28677: pillow - An issue was discovered in Pillow before 8.2.0. For EPS data, the readline imple...
vendor_debian·2021·CVSS 7.5
CVE-2021-28677 [HIGH] CVE-2021-28677: pillow - An issue was discovered in Pillow before 8.2.0. For EPS data, the readline imple...
An issue was discovered in Pillow before 8.2.0. For EPS data, the readline implementation used in EPSImageFile has to deal with any combination of \r and \n as line endings. It used an accidentally quadratic method of accumulating lines while looking for a line ending. A malicious EPS file could use this to perform a DoS of Pillow in the open phase, before an image was accepted for opening.
Scope: local
bookworm: resolved (fixed in 8.1.2+dfsg-0.2)
bullseye: resolved (fixed in 8.1.2+dfsg-0.2)
forky: resolved (fixed in 8.1.2+dfsg-0.2)
sid: resolved (fixed in 8.1.2+dfsg-0.2)
trixie: resolved (fixed in 8.1.2+dfsg-0.2)
OSV
pillow vulnerabilities
osv·2026-03-31·CVSS 9.1
CVE-2021-25287 [CRITICAL] pillow vulnerabilities
pillow vulnerabilities
It was discovered that Pillow did not correctly handle reading J2K files,
which could lead to an out-of-bounds read vulnerability. If a user or
automated system were tricked into opening a specially crafted file, an
attacker could possibly use this issue to cause a denial of service. This
issue only affected Ubuntu 16.04 LTS. (CVE-2021-25287, CVE-2021-25288)
It was discovered that Pillow did not correctly handle certain integer
arithmetic, which could lead to a buffer overflow. An attacker could
possibly use this issue to cause a denial of service or execute arbitrary
code. This issue only affected Ubuntu 14.04 LTS. (CVE-2021-25290)
It was discovered that Pillow did not correctly perform bounds checking
for certain operations. An attacker could possibly use this i
GHSA
Uncontrolled Resource Consumption in Pillow
ghsa·2021-06-08
CVE-2021-28677 [HIGH] CWE-400 Uncontrolled Resource Consumption in Pillow
Uncontrolled Resource Consumption in Pillow
An issue was discovered in Pillow before 8.2.0. For EPS data, the readline implementation used in EPSImageFile has to deal with any combination of \r and \n as line endings. It used an accidentally quadratic method of accumulating lines while looking for a line ending. A malicious EPS file could use this to perform a DoS of Pillow in the open phase, before an image was accepted for opening.
OSV
Uncontrolled Resource Consumption in Pillow
osv·2021-06-08
CVE-2021-28677 [HIGH] Uncontrolled Resource Consumption in Pillow
Uncontrolled Resource Consumption in Pillow
An issue was discovered in Pillow before 8.2.0. For EPS data, the readline implementation used in EPSImageFile has to deal with any combination of \r and \n as line endings. It used an accidentally quadratic method of accumulating lines while looking for a line ending. A malicious EPS file could use this to perform a DoS of Pillow in the open phase, before an image was accepted for opening.
OSV
CVE-2021-28677: An issue was discovered in Pillow before 8
osv·2021-06-02·CVSS 7.5
CVE-2021-28677 [HIGH] CVE-2021-28677: An issue was discovered in Pillow before 8
An issue was discovered in Pillow before 8.2.0. For EPS data, the readline implementation used in EPSImageFile has to deal with any combination of \r and \n as line endings. It used an accidentally quadratic method of accumulating lines while looking for a line ending. A malicious EPS file could use this to perform a DoS of Pillow in the open phase, before an image was accepted for opening.
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
https://github.com/python-pillow/Pillow/pull/5377https://lists.debian.org/debian-lts-announce/2021/07/msg00018.htmlhttps://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/MQHA5HAIBOYI3R6HDWCLAGFTIQP767FL/https://pillow.readthedocs.io/en/stable/releasenotes/8.2.0.html#cve-2021-28677-fix-eps-dos-on-openhttps://security.gentoo.org/glsa/202107-33https://github.com/python-pillow/Pillow/pull/5377https://lists.debian.org/debian-lts-announce/2021/07/msg00018.htmlhttps://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/MQHA5HAIBOYI3R6HDWCLAGFTIQP767FL/https://pillow.readthedocs.io/en/stable/releasenotes/8.2.0.html#cve-2021-28677-fix-eps-dos-on-openhttps://security.gentoo.org/glsa/202107-33
2021-06-02
Published