Back Linuxsecurity

Ubuntu 18.04 LTS Pillow Critical DoS Buffer Overflow Bug USN-8135

Linuxsecurity •LinuxSecurity Advisories • March 31, 2026

A security issue affects these releases of Ubuntu and its derivatives: - Ubuntu 18.04 LTS - Ubuntu 16.04 LTS - Ubuntu 14.04 LTS Summary: Several security issues were fixed in Pillow. Software Description: - pillow: Python Imaging Library Details: It was discovered that Pillow did not correctly handle reading J2K files, which could lead to an out-of-bounds read vulnerability. If a user or automated system were tricked into opening a specially crafted file, an attacker could possibly use this issue to cause a denial of service. This issue only affected Ubuntu 16.04 LTS. (CVE-2021-25287, CVE-2021-25288) It was discovered that Pillow did not correctly handle certain integer arithmetic, which could lead to a buffer overflow. An attacker could possibly use this issue to cause a denial of service or execute arbitrary code. This issue only affected Ubuntu 14.04 LTS. (CVE-2021-25290) It was discovered that Pillow did not correctly perform bounds checking

The problem can be corrected by updating your system to the following package versions: Ubuntu 18.04 LTS python-pil 5.1.0-1ubuntu0.8+esm2 Available with Ubuntu Pro python3-pil 5.1.0-1ubuntu0.8+esm2 Available with Ubuntu Pro Ubuntu 16.04 LTS python-pil 3.1.2-0ubuntu1.6+esm3 Available with Ubuntu Pro python3-pil 3.1.2-0ubuntu1.6+esm3 Available with Ubuntu Pro Ubuntu 14.04 LTS python-pil 2.3.0-1ubuntu3.4+esm5 Available with Ubuntu Pro python3-pil 2.3.0-1ubuntu3.4+esm5 Available with Ubuntu Pro In general, a standard system update will make all the necessary changes.

CVE-2021-25287, CVE-2021-25288, CVE-2021-25290, CVE-2021-28675, CVE-2021-28676, CVE-2021-28677, CVE-2023-44271, CVE-2023-50447

CVE-2021-25287, CVE-2021-25288, CVE-2021-25290, CVE-2021-28675,

CVE-2021-28676, CVE-2021-28677, CVE-2023-44271, CVE-2023-50447

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Multiple Pillow Vulnerabilities Affect Ubuntu Releases Several vulnerabilities in the Pillow library have been identified, impacting Ubuntu 14.04, 16.04, and 18.04 LTS. These vulnerabilities include an out-of-bounds read issue when handling J2K files (CVE-2021-25287, CVE-2021-25288) and a buffer overflow due to improper integer arithmetic (CVE-2021-25290). An attacker could exploit these vulnerabilities to cause denial of service or potentially execute arbitrary code. The vulnerabilities affect various versions of the Pillow library, with specific patches available for each affected Ubuntu release. Users are advised to update their systems to mitigate these risks. The vulnerabilities were disclosed on March 19, 2021, and June 2, 2021, with additional vulnerabilities reported in 2023. The current status indicates that updates are available for all affected systems. 2 sources 58

Extracted Entities

Ubuntu 18.04 LTS Pillow Critical DoS Buffer Overflow Bug USN-8135

The full story

Extracted Entities

Attack Types (1)

Companies (1)

CVEs (8)