CVE-2021-34552 log

Source	CVE Red Hat MITRE NVD Debian Ubuntu SUSE Alpine Mageia CVE Details CIRCL Bugs Arch Linux Red Hat Gentoo SUSE GitHub Lists oss-security full-disclosure bugtraq Misc GitHub code web search
Severity	Medium
Remote	Yes
Type	Arbitrary code execution
Description	Pillow through 8.2.0 allows an attacker to pass controlled parameters directly into a convert function to trigger a buffer overflow in Convert.c.

Group	Package	Affected	Fixed	Severity	Status	Ticket
AVG-2150	python-pillow	8.2.0-2	8.3.0-1	Medium	Fixed

Date	Advisory	Group	Package	Severity	Type
14 Jul 2021	ASA-202107-26	AVG-2150	python-pillow	Medium	arbitrary code execution

References
https://pillow.readthedocs.io/en/stable/releasenotes/8.3.0.html#buffer-overflow https://github.com/python-pillow/Pillow/pull/5567 https://github.com/python-pillow/Pillow/commit/518ee3722a99d7f7d890db82a20bd81c1c0327fb

References

https://pillow.readthedocs.io/en/stable/releasenotes/8.3.0.html#buffer-overflow
https://github.com/python-pillow/Pillow/pull/5567
https://github.com/python-pillow/Pillow/commit/518ee3722a99d7f7d890db82a20bd81c1c0327fb