Medium ALAS2-2023-2087 1 CVE

Moderate: python-pillow security update (Amazon Linux 2)

Published Jun 7, 2023 · Updated Jun 12, 2023

Ecosystem: Amazon Linux

Summary

Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2021-25290: An issue was discovered in Pillow before 8.1.1. In TiffDecode.c, there is a negative-offset memcpy with an invalid size.

Fixed packages 6

Release	Package	Fixed in
Amazon Linux · 2	python-pillow	0:2.0.0-23.gitd1c6db8.amzn2.0.5
Amazon Linux · 2	python-pillow-debuginfo	0:2.0.0-23.gitd1c6db8.amzn2.0.5
Amazon Linux · 2	python-pillow-devel	0:2.0.0-23.gitd1c6db8.amzn2.0.5
Amazon Linux · 2	python-pillow-doc	0:2.0.0-23.gitd1c6db8.amzn2.0.5
Amazon Linux · 2	python-pillow-sane	0:2.0.0-23.gitd1c6db8.amzn2.0.5
Amazon Linux · 2	python-pillow-tk	0:2.0.0-23.gitd1c6db8.amzn2.0.5

Vulnerabilities 1

High 7.5

CVE-2021-25290

Out-of-bounds Write in Pillow

An issue was discovered in Pillow before 8.1.1. In TiffDecode.c, there is a negative-offset memcpy with an invalid size.

pillow pillow pillow pillow-python2 Debian Ubuntu Alpine PyPI

Mar 19, 2021

References

web
https://alas.aws.amazon.com/cve/html/CVE-2021-25290.html