Heap-based Buffer Overflow Affecting pillow package, versions [,13.0.0)

Affected versions of this package are vulnerable to Heap-based Buffer Overflow in the FlashPix JPEG tile decoding spanning src/PIL/FpxImagePlugin.py and src/libImaging/JpegDecode.c, where the tile buffer is sized from the rawmode that the MODES table selects from the FPX color IDs, while rawmodes such as LA and YCC;P are unrecognized in the colorspace mapping and fall through to setting jpeg_color_space and out_color_space to JCS_UNKNOWN, under which libjpeg applies no conversion and emits cinfo.num_components bytes per pixel taken from the embedded SOF marker. An attacker can write past the allocation with controlled length and contents, and reach code execution, by having an application open a single file with Image.open whose color IDs select a two byte per pixel rawmode while the embedded JPEG declares four components, so jpeg_read_scanlines writes 4 * width bytes per row into a buffer allocated for 2 * width. Reaching the decoder requires the optional olefile dependency to be installed, which is what enables FPX support, and files are identified by the OLE2 magic rather than by extension, so any service that opens or thumbnails untrusted uploads is exposed without user interaction, while turning the overflow into execution depends on heap layout and on interpreter specifics such as a non-PIE binary with known offsets.

• GitHub Advisory
• GitHub Commit
• GitHub Release