Red Hat Security Advisory: python-pillow security update

Fixed packages 6

Vulnerabilities 3

• Critical 9.8
  CVE-2020-5311

  Buffer Copy without Checking Size of Input in Pillow

  libImaging/SgiRleDecode.c in Pillow before 6.2.2 has an SGI buffer overflow.

  pillow pillow pillow py3-pillow Debian Ubuntu Alpine PyPI
  Jan 3, 2020
• Critical 9.8
  CVE-2020-5312

  PCX P mode buffer overflow in Pillow

  libImaging/PcxDecode.c in Pillow before 6.2.2 has a PCX P mode buffer overflow.

  pillow pillow pillow py3-pillow Debian Ubuntu Alpine PyPI
  Jan 3, 2020
• High 7.5
  CVE-2019-16865

  DOS attack in Pillow when processing specially crafted image files

  An issue was discovered in Pillow before 6.2.0. When reading specially crafted invalid image files, the library can either allocate very large amounts of memory or take an extremely long period of time to process the image.

  pillow pillow pillow Debian Ubuntu PyPI
  Oct 4, 2019

References

• article
  https://access.redhat.com/security/updates/classification/#important
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1774066
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1789533
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1789535
• advisory
  https://security.access.redhat.com/data/csaf/v2/advisories/2020/rhsa-2020_0566.json
• report
  https://access.redhat.com/security/cve/CVE-2019-16865
• advisory
  https://www.cve.org/CVERecord?id=CVE-2019-16865
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2019-16865
• report
  https://access.redhat.com/security/cve/CVE-2020-5311
• advisory
  https://www.cve.org/CVERecord?id=CVE-2020-5311
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2020-5311
• report
  https://access.redhat.com/security/cve/CVE-2020-5312
• advisory
  https://www.cve.org/CVERecord?id=CVE-2020-5312
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2020-5312