A python-pillow security update has been released for AlmaLinux.
ALSA-2021:4149 Moderate: python-pillow security update
Type:
security
Severity:
moderate
Release date:
2021-11-12
Description
Security Fix(es):
* python-pillow: Out-of-bounds read in J2K image reader (CVE-2021-25287)
* python-pillow: Out-of-bounds read in J2K image reader (CVE-2021-25288)
* python-pillow: Negative-offset memcpy in TIFF image reader (CVE-2021-25290)
* python-pillow: Regular expression DoS in PDF format parser (CVE-2021-25292)
* python-pillow: Out-of-bounds read in SGI RLE image reader (CVE-2021-25293)
* python-pillow: Excessive memory allocation in BLP image reader (CVE-2021-27921)
* python-pillow: Excessive memory allocation in ICNS image reader (CVE-2021-27922)
* python-pillow: Excessive memory allocation in ICO image reader (CVE-2021-27923)
* python-pillow: Excessive memory allocation in PSD image reader (CVE-2021-28675)
* python-pillow: Infinite loop in FLI image reader (CVE-2021-28676)
* python-pillow: Excessive CPU use in EPS image reader (CVE-2021-28677)
* python-pillow: Excessive looping in BLP image reader (CVE-2021-28678)
* python-pillow: Buffer overflow in image convert function (CVE-2021-34552)
* python-pillow: Buffer over-read in PCX image reader (CVE-2020-35653)
* python-pillow: Buffer over-read in SGI RLE image reader (CVE-2020-35655)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Additional Changes:
For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section.
References:
CVE-2020-35653
CVE-2020-35655
CVE-2021-25287
CVE-2021-25288
CVE-2021-25290
CVE-2021-25292
CVE-2021-25293
CVE-2021-27921
CVE-2021-27922
CVE-2021-27923
CVE-2021-28675
CVE-2021-28676
CVE-2021-28677
CVE-2021-28678
CVE-2021-34552
Updates packages:
python3-pillow-5.1.1-16.el8.x86_64.rpm
Notes:
This page is generated automatically and has not been checked for errors. For clarification or corrections please contact the AlmaLinux Packaging Team.
