CVE-2021-28677

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

An issue was discovered in Pillow before 8.2.0. For EPS data, the readline implementation used in EPSImageFile has to deal with any combination of \r and \n as line endings. It used an accidentally quadratic method of accumulating lines while looking for a line ending. A malicious EPS file could use this to perform a DoS of Pillow in the open phase, before an image was accepted for opening.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

https://github.com/python-pillow/Pillow/pull/5377Patch, Third Party Advisory
https://lists.debian.org/debian-lts-announce/2021/07/msg00018.htmlThird Party Advisory
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/MQHA5HAIBOYI3R6HDWCLAGFTIQP767FL/
https://pillow.readthedocs.io/en/stable/releasenotes/8.2.0.html#cve-2021-28677-fix-eps-dos-on-openThird Party Advisory
https://security.gentoo.org/glsa/202107-33Third Party Advisory
https://github.com/python-pillow/Pillow/pull/5377Patch, Third Party Advisory
https://lists.debian.org/debian-lts-announce/2021/07/msg00018.htmlThird Party Advisory
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/MQHA5HAIBOYI3R6HDWCLAGFTIQP767FL/
https://pillow.readthedocs.io/en/stable/releasenotes/8.2.0.html#cve-2021-28677-fix-eps-dos-on-openThird Party Advisory
https://security.gentoo.org/glsa/202107-33Third Party Advisory

Timeline

Published: Jun 2, 2021
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2021

CVE-2021-286785.5An issue was discovered in Pillow before 8.2.0. For BLP data, BlpImagePlugin did not properly check that reads (after jumping to file offset CVE-2021-286808.1The devise_masquerade gem before 1.3 allows certain attacks when a password's salt is unknown. An application that uses this gem to let admi CVE-2021-286815.3Pion WebRTC before 3.0.15 didn't properly tear down the DTLS Connection when certificate verification failed. The PeerConnectionState was se CVE-2021-286827.5An issue was discovered in Envoy through 1.71.1. There is a remotely exploitable integer overflow in which a very large grpc-timeout value l CVE-2021-286837.5An issue was discovered in Envoy through 1.71.1. There is a remotely exploitable NULL pointer dereference and crash in TLS when an unknown T CVE-2021-286844.3The XML parser used in ConeXware PowerArchiver before 20.10.02 allows processing of external entities, which might lead to exfiltration of l CVE-2021-286857.8AsIO2_64.sys and AsIO2_32.sys in ASUS GPUTweak II before 2.3.0.3 allow low-privileged users to interact directly with physical memory (by ca CVE-2021-286865.5AsIO2_64.sys and AsIO2_32.sys in ASUS GPUTweak II before 2.3.0.3 allow low-privileged users to trigger a stack-based buffer overflow. This c CVE-2021-286875.5HVM soft-reset crashes toolstack libxl requires all data structures passed across its public interface to be initialized before use and disp CVE-2021-286886.5The fix for XSA-365 includes initialization of pointers such that subsequent cleanup code wouldn't use uninitialized or stale values. This i CVE-2021-286895.5x86: Speculative vulnerabilities with bare (non-shim) 32-bit PV guests 32-bit x86 PV guest kernels run in ring 1. At the time when Xen was d CVE-2021-286906.5x86: TSX Async Abort protections not restored after S3 This issue relates to the TSX Async Abort speculative security vulnerability. Please