CVE-2021-27923
Pillow before 8.1.2 allows attackers to cause a denial of service (memory consumption) because the reported size of a contained image is not properly checked for an ICO container, and thus an attempted memory allocation can be very large.
- Score
- CVSS 3.1 7.5 High
- Status
- Modified - cve@mitre.org
- Published
- 2021-03-03
- Last modified
- 2025-08-15
- Weaknesses
- CWE-20
Affected products
References
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/S7G44Z33J4BNI2DPDROHWGVG…
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/TQQY6472RX4J2SUJENWDZAWK…
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZTSY25UJU7NJUFHH3HWT575L…
- https://pillow.readthedocs.io/en/stable/releasenotes/8.1.2.html
- https://security.gentoo.org/glsa/202107-33
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/S7G44Z33J4BNI2DPDROHWG…
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/TQQY6472RX4J2SUJENWDZA…
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZTSY25UJU7NJUFHH3HWT57…
- https://pillow.readthedocs.io/en/stable/releasenotes/8.1.1.html
