CVE-2021-28676

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

An issue was discovered in Pillow before 8.2.0. For FLI data, FliDecode did not properly check that the block advance was non-zero, potentially leading to an infinite loop on load.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-835

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

https://github.com/python-pillow/Pillow/commit/bb6c11fb889e6c11b0ee122b828132ee763b5856Patch
https://github.com/python-pillow/Pillow/pull/5377Third Party Advisory
https://lists.debian.org/debian-lts-announce/2021/07/msg00018.htmlThird Party Advisory
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/MQHA5HAIBOYI3R6HDWCLAGFTIQP767FL/Mailing List
https://pillow.readthedocs.io/en/stable/releasenotes/8.2.0.html#cve-2021-28676-fix-fli-dosRelease Notes, Third Party Advisory
https://security.gentoo.org/glsa/202107-33Third Party Advisory
https://github.com/python-pillow/Pillow/commit/bb6c11fb889e6c11b0ee122b828132ee763b5856Patch
https://github.com/python-pillow/Pillow/pull/5377Third Party Advisory
https://lists.debian.org/debian-lts-announce/2021/07/msg00018.htmlThird Party Advisory
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/MQHA5HAIBOYI3R6HDWCLAGFTIQP767FL/Mailing List
https://pillow.readthedocs.io/en/stable/releasenotes/8.2.0.html#cve-2021-28676-fix-fli-dosRelease Notes, Third Party Advisory
https://security.gentoo.org/glsa/202107-33Third Party Advisory

Timeline

Published: Jun 2, 2021
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2021

CVE-2021-286777.5An issue was discovered in Pillow before 8.2.0. For EPS data, the readline implementation used in EPSImageFile has to deal with any combinat CVE-2021-286785.5An issue was discovered in Pillow before 8.2.0. For BLP data, BlpImagePlugin did not properly check that reads (after jumping to file offset CVE-2021-286808.1The devise_masquerade gem before 1.3 allows certain attacks when a password's salt is unknown. An application that uses this gem to let admi CVE-2021-286815.3Pion WebRTC before 3.0.15 didn't properly tear down the DTLS Connection when certificate verification failed. The PeerConnectionState was se CVE-2021-286827.5An issue was discovered in Envoy through 1.71.1. There is a remotely exploitable integer overflow in which a very large grpc-timeout value l CVE-2021-286837.5An issue was discovered in Envoy through 1.71.1. There is a remotely exploitable NULL pointer dereference and crash in TLS when an unknown T CVE-2021-286844.3The XML parser used in ConeXware PowerArchiver before 20.10.02 allows processing of external entities, which might lead to exfiltration of l CVE-2021-286857.8AsIO2_64.sys and AsIO2_32.sys in ASUS GPUTweak II before 2.3.0.3 allow low-privileged users to interact directly with physical memory (by ca CVE-2021-286865.5AsIO2_64.sys and AsIO2_32.sys in ASUS GPUTweak II before 2.3.0.3 allow low-privileged users to trigger a stack-based buffer overflow. This c CVE-2021-286875.5HVM soft-reset crashes toolstack libxl requires all data structures passed across its public interface to be initialized before use and disp CVE-2021-286886.5The fix for XSA-365 includes initialization of pointers such that subsequent cleanup code wouldn't use uninitialized or stale values. This i CVE-2021-286895.5x86: Speculative vulnerabilities with bare (non-shim) 32-bit PV guests 32-bit x86 PV guest kernels run in ring 1. At the time when Xen was d