CVE:CVE-2021-34552
CNNVD:CNNVD-202107-960
Pillow是一款基于Python的图像处理库。
Pillow 中存在缓冲区错误漏洞，该漏洞源于产品的convert .c未能验证参数的安全性，攻击者可通过该漏洞引发缓冲区溢出。以下产品及版本受到影响：Pillow 8.2.0 之前版本、PIL 1.1.7 之前版本。
solution:Upgrade python pillow to a higher version than 1.1.7,8.2.0,and avoid the version [1.0,1.1.7],[1.2,8.2.0]; Upgrade debian debian_linux to a higher version than 9.0,and avoid the version 9.0; Upgrade fedoraproject fedora to a higher version than 33,34,and avoid the version 33,34