GNU bug report logs - #22858
Patch security vulnerability in python-pillow

Previous Next

Full log

Message #8 received at 22858 <at> debbugs.gnu.org (full text, mbox):

From: Leo Famulari <leo <at> famulari.name>
To: Christopher Allan Webber <cwebber <at> dustycloud.org>
Cc: 22858 <at> debbugs.gnu.org
Subject: Re: bug#22858: Patch security vulnerability in python-pillow
Date: Mon, 29 Feb 2016 16:47:24 -0500

On Mon, Feb 29, 2016 at 12:10:33PM -0800, Christopher Allan Webber wrote:
> See: https://lwn.net/Articles/677914/
> 
> > Package        : pillow
> > CVE ID         : CVE-2016-0740 CVE-2016-0775 CVE-2016-2533 
> > 
> > Multiple security vulnerabilities have been found in Pillow, a Python
> > imaging library, which may result in denial of service or the execution
> > of arbitrary code if a malformed FLI, PCD or Tiff files is processed.
> > 
> > For the oldstable distribution (wheezy), this problem has been fixed
> > in version 1.1.7-4+deb7u2 of the python-imaging source package.
> > 
> > For the stable distribution (jessie), this problem has been fixed in
> > version 2.6.1-2+deb8u2.
> > 
> > For the testing distribution (stretch), this problem has been fixed
> > in version 3.1.1-1.
> > 
> > For the unstable distribution (sid), this problem has been fixed in
> > version 3.1.1-1.
> > 
> > We recommend that you upgrade your pillow packages.
> > 
> > Further information about Debian Security Advisories, how to apply
> > these updates to your system and frequently asked questions can be
> > found at: https://www.debian.org/security/
> 
> I'm trying to figure out where the patches for this are, but I can't
> find them.  I expected them to maybe be here, but I don't see them here:

I updated python-pillow to 3.1.1 with 16095d2729, fixing these issues.

When I did that, CVE-2016-2533 wasn't named yet, but my understanding is
that the update does address it:
https://github.com/python-pillow/Pillow/commits/e5324bd3b4195d68d4a066b16d912fca30d3c4be

Python2-pil *is* vulnerable. However, it seems to have no users in our
source tree. Should we remove it?

Previous Next

GNU bug tracking system
Copyright (C) 1999 Darren O. Benham, 1997,2003 nCipher Corporation Ltd, 1994-97 Ian Jackson.