Description
In Pillow before 7.1.0, there are two Buffer Overflows in libImaging/TiffDecode.c.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | pillow | 7.2.0-1 | — |
| Debian 13 | pillow | 7.2.0-1 | — |
| Debian 12 | pillow | 7.2.0-1 | — |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 20.04 LTS | pillow | 7.0.0-4ubuntu0.1 | USN-4430-2 |
Show 1 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu Pro 20.04 LTS | pillow-python2 | No fix yet | — |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| PyPI | pillow | < 7.1.0 | 7.1.0 | GHSA-8843-m7mw-mxqm |
Advisories 1
- USN-4430-2 pillow vulnerabilities Ubuntu Security Notices (USN) · Apr 27, 2026
References
- https://github.com/python-pillow/Pillow/commits/master/src/libImaging
- https://github.com/python-pillow/Pillow/pull/4538
- https://github.com/python-pillow/Pillow/commit/46f4a349b88915787fea3fb91348bb1665831bbb#diff-9478f2787e3ae9668a15123b165c23ac
- FEDORA-2020-c52106e48a vendor-advisory
- https://pillow.readthedocs.io/en/stable/releasenotes/7.1.0.html
- FEDORA-2020-d0737711b6 vendor-advisory
- USN-4430-2 vendor-advisory