This is an OpenPGP/MIME signed message (RFC 4880 and 3156)
--===============2251606720775500137==
Content-Type: multipart/signed; micalg=pgp-sha256;
protocol="application/pgp-signature";
boundary="U97B6ws9nIyfcshOqavIoGLBEF6JQS9av"
This is an OpenPGP/MIME signed message (RFC 4880 and 3156)
--U97B6ws9nIyfcshOqavIoGLBEF6JQS9av
Content-Type: multipart/mixed;
boundary="0GDuLUalVTs05Y8vLLvAd4BXlnz9joTeb";
protected-headers="v1"
From: Marc Deslauriers <marc.deslauriers@canonical.com>
Reply-To: Ubuntu Security <security@ubuntu.com>
To: "ubuntu-security-announce@lists.ubuntu.com"
<ubuntu-security-announce@lists.ubuntu.com>
Message-ID: <5b2a952c-9496-3bb2-b132-87e960677353@canonical.com>
Subject: [USN-4763-1] Pillow vulnerabilities
--0GDuLUalVTs05Y8vLLvAd4BXlnz9joTeb
Content-Type: text/plain; charset=utf-8
Content-Language: en-C
Content-Transfer-Encoding: quoted-printable
==========================================================================
Ubuntu Security Notice USN-4763-1
March 11, 2021
pillow vulnerabilities
==========================================================================
A security issue affects these releases of Ubuntu and its derivatives:
- Ubuntu 20.10
- Ubuntu 20.04 LTS
- Ubuntu 18.04 LTS
- Ubuntu 16.04 LTS
Summary:
Several security issues were fixed in Pillow.
Software Description:
- pillow: Python Imaging Library
Details:
It was discovered that Pillow incorrectly handled certain Tiff image files.
If a user or automated system were tricked into opening a specially-crafted
Tiff file, a remote attacker could cause Pillow to crash, resulting in a
denial of service, or possibly execute arbitrary code. This issue only
affected Ubuntu 20.04 LTS and Ubuntu 20.10. (CVE-2021-25289,
CVE-2021-25291)
It was discovered that Pillow incorrectly handled certain Tiff image files.
If a user or automated system were tricked into opening a specially-crafted
Tiff file, a remote attacker could cause Pillow to crash, resulting in a
denial of service, or possibly execute arbitrary code. (CVE-2021-25290)
It was discovered that Pillow incorrectly handled certain PDF files. If a
user or automated system were tricked into opening a specially-crafted
PDF file, a remote attacker could cause Pillow to hang, resulting in a
denial of service. This issue only affected Ubuntu 18.04 LTS, Ubuntu 20.04
LTS, and Ubuntu 20.10. (CVE-2021-25292)
It was discovered that Pillow incorrectly handled certain SGI image files.
If a user or automated system were tricked into opening a specially-crafted
SGI file, a remote attacker could possibly cause Pillow to crash,
resulting in a denial of service. This issue only affected Ubuntu 18.04
LTS, Ubuntu 20.04 LTS, and Ubuntu 20.10. (CVE-2021-25293)
Jiayi Lin, Luke Shaffer, Xinran Xie, and Akshay Ajayan discovered that
Pillow incorrectly handled certain BLP files. If a user or automated system
were tricked into opening a specially-crafted BLP file, a remote attacker
could possibly cause Pillow to consume resources, resulting in a denial of
service. This issue only affected Ubuntu 18.04 LTS, Ubuntu 20.04 LTS, and
Ubuntu 20.10. (CVE-2021-27921)
Jiayi Lin, Luke Shaffer, Xinran Xie, and Akshay Ajayan discovered that
Pillow incorrectly handled certain ICNS files. If a user or automated
system were tricked into opening a specially-crafted ICNS file, a remote
attacker could possibly cause Pillow to consume resources, resulting in a
denial of service. (CVE-2021-27922)
Jiayi Lin, Luke Shaffer, Xinran Xie, and Akshay Ajayan discovered that
Pillow incorrectly handled certain ICO files. If a user or automated
system were tricked into opening a specially-crafted ICO file, a remote
attacker could possibly cause Pillow to consume resources, resulting in a
denial of service. (CVE-2021-27922)
Update instructions:
The problem can be corrected by updating your system to the following
package versions:
Ubuntu 20.10:
python3-pil 7.2.0-1ubuntu0.2
Ubuntu 20.04 LTS:
python3-pil 7.0.0-4ubuntu0.3
Ubuntu 18.04 LTS:
python-pil 5.1.0-1ubuntu0.5
python3-pil 5.1.0-1ubuntu0.5
Ubuntu 16.04 LTS:
python-pil 3.1.2-0ubuntu1.6
python3-pil 3.1.2-0ubuntu1.6
In general, a standard system update will make all the necessary changes.
References:
https://ubuntu.com/security/notices/USN-4763-1
CVE-2021-25289, CVE-2021-25290, CVE-2021-25291, CVE-2021-25292,
CVE-2021-25293, CVE-2021-27921, CVE-2021-27922, CVE-2021-27923
Package Information:
https://launchpad.net/ubuntu/+source/pillow/7.2.0-1ubuntu0.2
https://launchpad.net/ubuntu/+source/pillow/7.0.0-4ubuntu0.3
https://launchpad.net/ubuntu/+source/pillow/5.1.0-1ubuntu0.5
https://launchpad.net/ubuntu/+source/pillow/3.1.2-0ubuntu1.6
--0GDuLUalVTs05Y8vLLvAd4BXlnz9joTeb--
--U97B6ws9nIyfcshOqavIoGLBEF6JQS9av
Content-Type: application/pgp-signature; name="OpenPGP_signature.asc"
Content-Description: OpenPGP digital signature
Content-Disposition: attachment; filename="OpenPGP_signature"
-----BEGIN PGP SIGNATURE-----
iQIzBAEBCgAdFiEEUMSg3c8x5FLOsZtRZWnYVadEvpMFAmBKOU8ACgkQZWnYVadE
vpO00xAAnRGDLePNgc0qglgRF1NTDm6VxpiYGfJ2qa2tgtTnPQ/V2UHsg/r2FxPy
AtFTb7s5+p9y1r0b5HeG+FJa/QAGzI0S+JSj6raetS8YdB7ZEURrykcK1n/T9kCj
Gdf4Y8srlNuVFtwH6yAeeu95lDbGlE214o0SlJtOjeitpaY6BYdg5QCl9KbpxAPU
U3mkhzjKxfJyKRhPeJTozC2eeClDDeRAVnSv6e4kpd7mplxMs9KSUVnEB/TyCDTK
ObwqidIgwdM972RsdnOiFAJ0b/Z1DUh0HC5yUjJjXYWF+BTLrqIK+xpqyjgABTwH
TD+gCJ3GMJ8VE7Zg1rNdwabLPRg7lyghiEQF+UbFedBeCwyM0iKleWUytQ78YNja
jw/S+DT7F/dHD4HOlccPyPxMwUqlywTZaF1qo9PB0ne4p3vMdjBZOoITYhZVEsbb
D0ZjoRsxWGxLGNKjSXGkQzCpuVhL6TJFTB3klQ5m91/hr3FqIrToa7MpnuNE5Heg
NhsjReszfJY53D+KfuEDlNJqor16G39EKqasQKbOlWtPRg1wAIABJXdvH4xzHGWt
442qrUnsdB/n5d4NUEMkqL3eYolpbn83HNQCwVVehB5Mk4XsohQk5wJ9vj2l3v5G
AC+muvbqTfOvV9j0OwSF+5gjyUqdzTLmlEpydBCQFfj3PFEvvpk=
=/56t
-----END PGP SIGNATURE-----
--U97B6ws9nIyfcshOqavIoGLBEF6JQS9av--
--===============2251606720775500137==
Content-Type: text/plain; charset="utf-8"
MIME-Version: 1.0
Content-Transfer-Encoding: base64
Content-Disposition: inline
LS0gCnVidW50dS1zZWN1cml0eS1hbm5vdW5jZSBtYWlsaW5nIGxpc3QKdWJ1bnR1LXNlY3VyaXR5
LWFubm91bmNlQGxpc3RzLnVidW50dS5jb20KTW9kaWZ5IHNldHRpbmdzIG9yIHVuc3Vic2NyaWJl
IGF0OiBodHRwczovL2xpc3RzLnVidW50dS5jb20vbWFpbG1hbi9saXN0aW5mby91YnVudHUtc2Vj
dXJpdHktYW5ub3VuY2UK
--===============2251606720775500137==--
|
