Package "python3-pil"
| Name: |
python3-pil
|
Description: |
Python Imaging Library (Python3)
|
| Latest version: |
5.1.0-1ubuntu0.8 |
| Release: |
bionic (18.04) |
| Level: |
security |
| Repository: |
main |
| Head package: |
pillow |
| Homepage: |
http://python-pillow.github.io/ |
Links
Download "python3-pil"
Other versions of "python3-pil" in Bionic
Changelog
|
pillow (5.1.0-1ubuntu0.8) bionic-security; urgency=medium
* SECURITY UPDATE: incomplete fix for CVE-2022-22817
- debian/patches/CVE-2022-22817-2.patch: restrict builtins within
lambdas for ImageMath.eval in Tests/test_imagemath.py,
src/PIL/ImageMath.py.
- CVE-2022-22817
-- Marc Deslauriers <email address hidden> Thu, 20 Oct 2022 11:32:25 -0400
|
| Source diff to previous version |
| CVE-2022-22817 |
PIL.ImageMath.eval in Pillow before 9.0.0 allows evaluation of arbitrary expressions, such as ones that use the Python exec method. |
|
|
pillow (5.1.0-1ubuntu0.7) bionic-security; urgency=medium
* SECURITY UPDATE: regular expression DoS
- debian/patches/CVE-2021-23437.patch: raise ValueError if color
specifier is too long in Tests/test_imagecolor.py,
src/PIL/ImageColor.py.
- CVE-2021-23437
* SECURITY UPDATE: Dos via buffer overflow
- debian/patches/CVE-2021-34552.patch: limit sprintf modes to 10
characters in src/libImaging/Convert.c.
- CVE-2021-34552
* SECURITY UPDATE: improper initialization
- debian/patches/CVE-2022-22815.patch: initialize coordinates to zero
in src/path.c.
- CVE-2022-22815
* SECURITY UPDATE: buffer over-read during initialization
- debian/patches/CVE-2022-22816.patch: handle case where path count is
zero in src/path.c.
- CVE-2022-22816
* SECURITY UPDATE: evaluation of arbitrary expressions
- debian/patches/CVE-2022-22817.patch: restrict builtins for
ImageMath.eval in Tests/test_imagemath.py, src/PIL/ImageMath.py.
- CVE-2022-22817
-- Marc Deslauriers <email address hidden> Wed, 12 Jan 2022 13:21:48 -0500
|
| Source diff to previous version |
| CVE-2021-23437 |
The package pillow 5.2.0 and before 8.3.2 are vulnerable to Regular Expression Denial of Service (ReDoS) via the getrgb function. |
| CVE-2021-34552 |
Pillow through 8.2.0 and PIL (aka Python Imaging Library) through 1.1.7 allow an attacker to pass controlled parameters directly into a convert funct |
| CVE-2022-22815 |
path_getbbox in path.c in Pillow before 9.0.0 improperly initializes ImagePath.Path. |
| CVE-2022-22816 |
path_getbbox in path.c in Pillow before 9.0.0 has a buffer over-read during initialization of ImagePath.Path. |
| CVE-2022-22817 |
PIL.ImageMath.eval in Pillow before 9.0.0 allows evaluation of arbitrary expressions, such as ones that use the Python exec method. |
|
|
pillow (5.1.0-1ubuntu0.6) bionic-security; urgency=medium
* SECURITY UPDATE: OOB read in Jpeg2KDecode
- debian/patches/CVE-2021-25287_8.patch: handle different widths for
each band in src/libImaging/Jpeg2KDecode.c.
- CVE-2021-25287
- CVE-2021-25288
* SECURITY UPDATE: DOS in PsdImagePlugin
- debian/patches/CVE-2021-28675.patch: sanity check the number of
input layers in Tests/test_decompression_bomb.py,
Tests/test_file_apng.py, Tests/test_file_blp.py,
Tests/test_file_tiff.py, src/PIL/ImageFile.py,
src/PIL/PsdImagePlugin.py.
- CVE-2021-28675
* SECURITY UPDATE: FLI DOS
- debian/patches/CVE-2021-28676.patch: check the block advance in
src/libImaging/FliDecode.c.
- CVE-2021-28676
* SECURITY UPDATE: EPS DOS on _open
- debian/patches/CVE-2021-28677.patch: properly handle line endings in
src/PIL/EpsImagePlugin.py.
- CVE-2021-28677
* SECURITY UPDATE: BLP DOS
- debian/patches/CVE-2021-28678.patch: check that reads return data in
src/PIL/BlpImagePlugin.py.
- CVE-2021-28678
-- Marc Deslauriers <email address hidden> Tue, 18 May 2021 07:33:36 -0400
|
| Source diff to previous version |
|
pillow (5.1.0-1ubuntu0.5) bionic-security; urgency=medium
* SECURITY UPDATE: negative-offset memcpy with an invalid size
- debian/patches/CVE-2021-25290.patch: add extra check to
src/libImaging/TiffDecode.c.
- CVE-2021-25290
* SECURITY UPDATE: DoS via backtrack regex
- debian/patches/CVE-2021-25292.patch: use more specific regex in
src/PIL/PdfParser.py.
- CVE-2021-25292
* SECURITY UPDATE: Out of Bounds Read
- debian/patches/CVE-2021-25293.patch: add more checks to
src/libImaging/SgiRleDecode.c.
- CVE-2021-25293
* SECURITY UPDATE: DoS via invalid reported size
- debian/patches/CVE-2021-2792x.patch: check reported sizes in
src/PIL/BlpImagePlugin.py, src/PIL/IcnsImagePlugin.py,
src/PIL/IcoImagePlugin.py.
- CVE-2021-27921
- CVE-2021-27922
- CVE-2021-27923
-- Marc Deslauriers <email address hidden> Wed, 10 Mar 2021 13:01:32 -0500
|
| Source diff to previous version |
| CVE-2021-27921 |
Pillow before 8.1.1 allows attackers to cause a denial of service (memory consumption) because the reported size of a contained image is not properly |
| CVE-2021-27922 |
Pillow before 8.1.1 allows attackers to cause a denial of service (memory consumption) because the reported size of a contained image is not properly |
| CVE-2021-27923 |
Pillow before 8.1.1 allows attackers to cause a denial of service (memory consumption) because the reported size of a contained image is not properly |
|
|
pillow (5.1.0-1ubuntu0.4) bionic-security; urgency=medium
* SECURITY UPDATE: buffer over-read via PCX file
- debian/patches/CVE-2020-35653.patch: don't trust the image to specify
a buffer size in src/PIL/PcxImagePlugin.py.
- CVE-2020-35653
* SECURITY UPDATE: buffer over-read via SGI RLE image file
- debian/patches/CVE-2020-35655-1.patch: add checks to
src/libImaging/SgiRleDecode.c.
- debian/patches/CVE-2020-35655-2.patch: rework error flags in
src/libImaging/SgiRleDecode.c.
- CVE-2020-35655
-- Marc Deslauriers <email address hidden> Wed, 13 Jan 2021 10:51:02 -0500
|
| CVE-2020-35653 |
In Pillow before 8.1.0, PcxDecode has a buffer over-read when decoding a crafted PCX file because the user-supplied stride value is trusted for buffe |
| CVE-2020-35655 |
In Pillow before 8.1.0, SGIRleDecode has a 4-byte buffer over-read when decoding crafted SGI RLE image files because offsets and length tables are mi |
|
About
-
Send Feedback to @ubuntu_updates
