Subject: bug#22858: closed (Re: bug#22858: Patch security vulnerability in python-pillow)

From: [email-masked] (GNU bug Tracking System)
Date: Mon, 29 Feb 2016 23:05:01 +0000

Your bug report

#22858: Patch security vulnerability in python-pillow

which was filed against the guix package, has been closed.

The explanation is attached below, along with your original report.
If you require more details, please reply to [email-masked].

-- 
22858: http://debbugs.gnu.org/cgi/bugreport.cgi?bug=22858
GNU Bug Tracking System
Contact [email-masked] with problems

Subject: Re: bug#22858: Patch security vulnerability in python-pillow
From: Christopher Allan Webber <[email-masked]>
To: Leo Famulari <[email-masked]>
Cc: [email-masked]
Date: Mon, 29 Feb 2016 15:04:04 -0800
List-Id: <debbugs-submit.debbugs.gnu.org>

Christopher Allan Webber writes:

> Leo Famulari writes:
>
>>> I'm trying to figure out where the patches for this are, but I can't
>>> find them.  I expected them to maybe be here, but I don't see them here:
>>
>> I updated python-pillow to 3.1.1 with 16095d2729, fixing these issues.
>>
>> When I did that, CVE-2016-2533 wasn't named yet, but my understanding is
>> that the update does address it:
>> https://github.com/python-pillow/Pillow/commits/e5324bd3b4195d68d4a066b16d912fca30d3c4be
>>
>> Python2-pil *is* vulnerable. However, it seems to have no users in our
>> source tree. Should we remove it?
>
> I think so.  Here's a patch to remove it.  Look good?  (Not sure if this
> needs a review or not :))
>
>  - Chris

Leo gave me some comments on the description on IRC, so I changed those
and pushed!

Subject: Patch security vulnerability in python-pillow
From: Christopher Allan Webber <[email-masked]>
To: [email-masked]
Date: Mon, 29 Feb 2016 12:10:33 -0800
List-Id: <debbugs-submit.debbugs.gnu.org>

See: https://lwn.net/Articles/677914/

> Package        : pillow
> CVE ID         : CVE-2016-0740 CVE-2016-0775 CVE-2016-2533 
> 
> Multiple security vulnerabilities have been found in Pillow, a Python
> imaging library, which may result in denial of service or the execution
> of arbitrary code if a malformed FLI, PCD or Tiff files is processed.
> 
> For the oldstable distribution (wheezy), this problem has been fixed
> in version 1.1.7-4+deb7u2 of the python-imaging source package.
> 
> For the stable distribution (jessie), this problem has been fixed in
> version 2.6.1-2+deb8u2.
> 
> For the testing distribution (stretch), this problem has been fixed
> in version 3.1.1-1.
> 
> For the unstable distribution (sid), this problem has been fixed in
> version 3.1.1-1.
> 
> We recommend that you upgrade your pillow packages.
> 
> Further information about Debian Security Advisories, how to apply
> these updates to your system and frequently asked questions can be
> found at: https://www.debian.org/security/

I'm trying to figure out where the patches for this are, but I can't
find them.  I expected them to maybe be here, but I don't see them here:

  http://sources.debian.net/patches/pillow/3.1.1-1/