High ELSA-2020-0580 3 CVEs

Important: python-pillow security update (Oracle Linux 8)

Published Feb 25, 2020 · Updated Feb 25, 2020

Ecosystem: Oracle Linux

Summary

[5.1.1-10]
- Bump and rebuild for gating to deliver CVE fixes
Resolves: rhbz#1789535

[5.1.1-9]
- Fix for CVE-2020-5311 - out-of-bounds write in expandrow
Resolves: rhbz#1789535

[5.1.1-8]
- Combined fixes for CVE-2020-5312 and CVE-2019-16865
Resolves: rhbz#1789533
Resolves: rhbz#1774066

Fixed packages 1

Release	Package	Fixed in
Oracle Linux · 8	python3-pillow	0:5.1.1-10.el8_1

Vulnerabilities 3

Critical 9.8

CVE-2020-5311

Buffer Copy without Checking Size of Input in Pillow

libImaging/SgiRleDecode.c in Pillow before 6.2.2 has an SGI buffer overflow.

pillow pillow pillow py3-pillow Debian Ubuntu Alpine PyPI

Jan 3, 2020
Critical 9.8

CVE-2020-5312

PCX P mode buffer overflow in Pillow

libImaging/PcxDecode.c in Pillow before 6.2.2 has a PCX P mode buffer overflow.

pillow pillow pillow py3-pillow Debian Ubuntu Alpine PyPI

Jan 3, 2020
High 7.5

CVE-2019-16865

DOS attack in Pillow when processing specially crafted image files

An issue was discovered in Pillow before 6.2.0. When reading specially crafted invalid image files, the library can either allocate very large amounts of memory or take an extremely long period of time to process the image.

pillow pillow pillow Debian Ubuntu PyPI

Oct 4, 2019