CVE-2021-34552

Vulnerability

A buffer overflow vulnerability exists in the Convert.c file of Pillow (through 8.2.0) and PIL (through 1.1.7). The convert function uses sprintf without bounds checking, allowing an attacker to pass controlled parameters directly into the function and trigger a buffer overflow [1][4]. This affects all versions of Pillow up to and including 8.2.0 and PIL up to 1.1.7.

Exploitation

An attacker can exploit this vulnerability by providing crafted parameters to the convert function, typically through image processing operations that accept user-supplied arguments. No authentication is required if the application processes untrusted images. The attacker must be able to influence the parameters passed to the conversion routine, which is often possible when an application allows user-controlled image transformations [3].

Impact

Successful exploitation results in a buffer overflow, which can lead to memory corruption. This may allow an attacker to achieve arbitrary code execution or cause a denial of service, depending on the context of the application using the vulnerable library. The privilege level attained is that of the process running Pillow or PIL [2][3].

Mitigation

The vulnerability is fixed in Pillow version 8.3.0, released on 2021-07-01 [4]. Users should upgrade to Pillow 8.3.0 or later. For PIL (Python Imaging Library), no official fix exists; users are advised to migrate to Pillow. Debian LTS users can apply the patch referenced in the advisory [2]. No workaround is available for unpatched versions.