UbuntuUpdates.org

Package "python-imaging"

Name: python-imaging

Description:

Python Imaging Library compatibility layer
Latest version: 3.1.2-0ubuntu1.6
Release: xenial (16.04)
Level: security
Repository: universe
Head package: pillow
Homepage: http://python-pillow.github.io/

Links

All versions of this package
Bug fixes

List of files in package
Repository home page

Download "python-imaging"

All arch deb package
APT INSTALL

Other versions of "python-imaging" in Xenial

Repository Area Version
base universe 3.1.2-0ubuntu1
updates universe 3.1.2-0ubuntu1.6

Changelog

Version: 3.1.2-0ubuntu1.6 2021-03-11 16:06:17 UTC

  pillow (3.1.2-0ubuntu1.6) xenial-security; urgency=medium

  * SECURITY UPDATE: negative-offset memcpy with an invalid size
    - debian/patches/CVE-2021-25290.patch: add extra check to
      libImaging/TiffDecode.c.
    - CVE-2021-25290
  * SECURITY UPDATE: DoS via invalid reported size
    - debian/patches/CVE-2021-2792x.patch: check reported sizes in
      PIL/IcnsImagePlugin.py, PIL/IcoImagePlugin.py.
    - CVE-2021-27922
    - CVE-2021-27923

 -- Marc Deslauriers <email address hidden> Thu, 11 Mar 2021 07:51:05 -0500
Source diff to previous version
CVE-2021-27922 Pillow before 8.1.1 allows attackers to cause a denial of service (memory consumption) because the reported size of a contained image is not properly
CVE-2021-27923 Pillow before 8.1.1 allows attackers to cause a denial of service (memory consumption) because the reported size of a contained image is not properly

Version: 3.1.2-0ubuntu1.5 2021-01-18 19:06:27 UTC

  pillow (3.1.2-0ubuntu1.5) xenial-security; urgency=medium

  * SECURITY UPDATE: buffer over-read via PCX file
    - debian/patches/CVE-2020-35653.patch: don't trust the image to specify
      a buffer size in PIL/PcxImagePlugin.py, removed failing test in
      Tests/test_image.py.
    - CVE-2020-35653

 -- Marc Deslauriers <email address hidden> Wed, 13 Jan 2021 10:51:58 -0500
Source diff to previous version
CVE-2020-35653 In Pillow before 8.1.0, PcxDecode has a buffer over-read when decoding a crafted PCX file because the user-supplied stride value is trusted for buffe

Version: 3.1.2-0ubuntu1.4 2020-07-22 15:06:18 UTC

  pillow (3.1.2-0ubuntu1.4) xenial-security; urgency=medium

  * SECURITY UPDATE: multiple out of bounds reads
    - debian/patches/CVE-2020-10177-1.patch: fix issue in
      src/libImaging/FliDecode.c.
    - debian/patches/CVE-2020-10177-2.patch: refactor to macro in
      src/libImaging/FliDecode.c.
    - debian/patches/CVE-2020-10177-3.patch: fix OOB Reads in SS2 Chunk in
      src/libImaging/FliDecode.c.
    - debian/patches/CVE-2020-10177-4.patch: fix OOB in LC packet in
      src/libImaging/FliDecode.c.
    - debian/patches/CVE-2020-10177-5.patch: fix OOB Advance Values in
      src/libImaging/FliDecode.c.
    - debian/patches/CVE-2020-10177-6.patch: fix OOB Read in FLI Copy Chunk
      in src/libImaging/FliDecode.c.
    - debian/patches/CVE-2020-10177-7.patch: fix comments in
      src/libImaging/FliDecode.c.
    - debian/patches/CVE-2020-10177-8.patch: additional FLI check in
      src/libImaging/FliDecode.c.
    - CVE-2020-10177
  * SECURITY UPDATE: out of bounds read with PCX files
    - debian/patches/CVE-2020-10378.patch: fix OOB Access in
      src/libImaging/PcxDecode.c.
    - CVE-2020-10378
  * SECURITY UPDATE: out-of-bounds read via JP2 file
    - debian/patches/CVE-2020-10994-1.patch: fix for OOB Read in
      src/libImaging/Jpeg2KDecode.c.
    - debian/patches/CVE-2020-10994-2.patch: fix typo in
      src/libImaging/Jpeg2KDecode.c.
    - CVE-2020-10994

 -- Marc Deslauriers <email address hidden> Tue, 07 Jul 2020 13:43:43 -0400
Source diff to previous version
CVE-2020-10177 Pillow before 7.1.0 has multiple out-of-bounds reads in libImaging/FliDecode.c.
CVE-2020-10378 In libImaging/PcxDecode.c in Pillow before 7.1.0, an out-of-bounds read can occur when reading PCX files where state->shuffle is instructed to read b
CVE-2020-10994 In libImaging/Jpeg2KDecode.c in Pillow before 7.1.0, there are multiple out-of-bounds reads via a crafted JP2 file.

Version: 3.1.2-0ubuntu1.3 2020-02-06 18:06:22 UTC

  pillow (3.1.2-0ubuntu1.3) xenial-security; urgency=medium

  * SECURITY UPDATE: Exceed memory amount and delay in process image
    - debian/patches/CVE-2019-16865-*.patch: Corrected negative seeks in
      PIL/PsdImagePlugin.py, Added decompression bomb checks in
      PIL/GifImagePlugin.py and PIL/IcoImagePlugin.py, Catch buffer overruns
      in libImaging/PcxDecode.c, libImaging/FliDecode.c and added some tests
      in Tests/images/*.
    - CVE-2019-16865
  * SECURITY UPDATE: Denial of service
    - debian/patches/CVE-2019-19911.patch: Raise an error for an invalid
      number of bands in FPX image in PIL/FpxImagePlugin.py.
    - CVE-2019-19911
  * SECURITY UPDATE: Buffer overflow
    - debian/patches/CVE-2020-5312.patch: Catch PCX P mode buffer overrun
      in libImaging/PcxDecode.c.
    - CVE-2020-5312
  * SECURITY UPDATE: Buffer overflow
    - debian/patches/CVE-2020-5313.patch: catch FLI buffer overrun in
      libImaging/FliDecode.c.
    - CVE-2020-5313
  * Fix decompression tests that failed
    - debian/patches/Fixing_decompression_test.patch: Tests/test_decompression.py.

 -- <email address hidden> (Leonidas S. Barbosa) Thu, 30 Jan 2020 17:15:56 -0300
Source diff to previous version
CVE-2019-16865 An issue was discovered in Pillow before 6.2.0. When reading specially crafted invalid image files, the library can either allocate very large amount
CVE-2019-19911 There is a DoS vulnerability in Pillow before 6.2.2 caused by FpxImagePlugin.py calling the range function on an unvalidated 32-bit integer if the nu
CVE-2020-5312 libImaging/PcxDecode.c in Pillow before 6.2.2 has a PCX P mode buffer overflow.
CVE-2020-5313 libImaging/FliDecode.c in Pillow before 6.2.2 has an FLI buffer overflow.

Version: 3.1.2-0ubuntu1.1 2017-03-13 18:07:04 UTC

  pillow (3.1.2-0ubuntu1.1) xenial-security; urgency=medium

  * SECURITY UPDATE: information disclosure via crafted image
    - debian/patches/CVE-2016-9189.patch: add overflow checks to map.c.
    - CVE-2016-9189
  * SECURITY UPDATE: code execution via crafted image
    - debian/patches/CVE-2016-9190.patch: add size check to
      libImaging/Storage.c, add test to Tests/images/negative_size.ppm,
      Tests/test_file_ppm.py.
    - CVE-2016-9190

 -- Marc Deslauriers <email address hidden> Fri, 10 Mar 2017 08:09:36 -0500
CVE-2016-9189 Pillow before 3.3.2 allows context-dependent attackers to obtain sensitive information by using the "crafted image file" approach, related to an "Int
CVE-2016-9190 Pillow before 3.3.2 allows context-dependent attackers to execute arbitrary code by using the "crafted image file" approach, related to an "Insecure


About   -   Send Feedback to @ubuntu_updates