Description
libImaging/TiffDecode.c in Pillow before 6.2.2 has a TIFF decoding integer overflow, related to realloc.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | pillow | 7.0.0-1 | — |
| Debian 13 | pillow | 7.0.0-1 | — |
| Debian 12 | pillow | 7.0.0-1 | — |
Alpine
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Alpine v3.24 | py3-pillow | 6.2.2-r0 | — |
| Alpine v3.23 | py3-pillow | 6.2.2-r0 | — |
| Alpine v3.22 | py3-pillow | 6.2.2-r0 | — |
| Alpine v3.21 | py3-pillow | 6.2.2-r0 | — |
| Alpine v3.20 | py3-pillow | 6.2.2-r0 | — |
Show 8 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Alpine v3.19 | py3-pillow | 6.2.2-r0 | — |
| Alpine v3.18 | py3-pillow | 6.2.2-r0 | — |
| Alpine v3.17 | py3-pillow | 6.2.2-r0 | — |
| Alpine v3.16 | py3-pillow | 6.2.2-r0 | — |
| Alpine v3.15 | py3-pillow | 6.2.2-r0 | — |
| Alpine v3.14 | py3-pillow | 6.2.2-r0 | — |
| Alpine v3.13 | py3-pillow | 6.2.2-r0 | — |
| Alpine v3.12 | py3-pillow | 6.2.2-r0 | — |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| PyPI | pillow | < 6.2.2 | 6.2.2 | GHSA-vcqg-3p29-xw73 |
References
- https://pillow.readthedocs.io/en/stable/releasenotes/6.2.2.html
- https://github.com/python-pillow/Pillow/commit/4e2def2539ec13e53a82e06c4b3daf00454100c4
- FEDORA-2020-df444e464e vendor-advisory
- USN-4272-1 vendor-advisory
- FEDORA-2020-5cdbb19cca vendor-advisory