CVE-2021-25287

Advisory

Pillow 8.2.0 includes a fix for CVE-2021-25287: There is an out-of-bounds read in J2kDecode, in j2ku_graya_la.
https://pillow.readthedocs.io/en/stable/releasenotes/8.2.0.html#cve-2021-25287-cve-2021-25288-fix-oob-read-in-jpeg2kdecode

Affected package

Affected versions

Fixed versions

Vulnerability changelog

An issue was discovered in Pillow before 8.2.0. There is an out-of-bounds read in J2kDecode, in j2ku_graya_la. See CVE-2021-25287.


FEDORA:FEDORA-2021-77756994ba: https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/MQHA5HAIBOYI3R6HDWCLAGFTIQP767FL/
MISC:https://github.com/python-pillow/Pillow/pull/5377#issuecomment-833821470: https://github.com/python-pillow/Pillow/pull/5377#issuecomment-833821470
MISC:https://pillow.readthedocs.io/en/stable/releasenotes/8.2.0.html#cve-2021-25287-cve-2021-25288-fix-oob-read-in-jpeg2kdecode: https://pillow.readthedocs.io/en/stable/releasenotes/8.2.0.html#cve-2021-25287-cve-2021-25288-fix-oob-read-in-jpeg2kdecode

Resources

• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/MQHA5
• https://github.com/python-pillow/Pillow/pull/5377#issuecomment-833821470
• https://pillow.readthedocs.io/en/stable/releasenotes/8.2.0.html#cve-2021-25287-cve-2021-25288-fix-oo
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-25287
• https://pillow.readthedocs.io/en/stable/releasenotes/8.2.0.html#cve-2021-25287-cve-2021-25288-fix-oob-read-in-jpeg2kdecode
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/MQHA5HAIBOYI3R6HDWCLAGFTIQP767FL/
• https://security.gentoo.org/glsa/202107-33