Security
Headlines
HeadlinesLatestCVEs

Headline

Ubuntu Security Notice USN-6744-1

Ubuntu Security Notice 6744-1 - Hugo van Kemenade discovered that Pillow was not properly performing bounds checks when processing an ICC file, which could lead to a buffer overflow. If a user or automated system were tricked into processing a specially crafted ICC file, an attacker could possibly use this issue to cause a denial of service or execute arbitrary code.

Packet Storm
#vulnerability#ubuntu#dos#perl#buffer_overflow

==========================================================================
Ubuntu Security Notice USN-6744-1
April 22, 2024

pillow vulnerability

A security issue affects these releases of Ubuntu and its derivatives:

  • Ubuntu 23.10
  • Ubuntu 22.04 LTS
  • Ubuntu 20.04 LTS
  • Ubuntu 18.04 LTS (Available with Ubuntu Pro)
  • Ubuntu 16.04 LTS (Available with Ubuntu Pro)
  • Ubuntu 14.04 LTS (Available with Ubuntu Pro)

Summary:

Pillow could be made to crash or run programs as an administrator
if it opened a specially crafted file.

Software Description:

  • pillow: Python Imaging Library

Details:

Hugo van Kemenade discovered that Pillow was not properly performing
bounds checks when processing an ICC file, which could lead to a buffer
overflow. If a user or automated system were tricked into processing a
specially crafted ICC file, an attacker could possibly use this issue
to cause a denial of service or execute arbitrary code.

Update instructions:

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 23.10:
python3-pil 10.0.0-1ubuntu0.2

Ubuntu 22.04 LTS:
python3-pil 9.0.1-1ubuntu0.3

Ubuntu 20.04 LTS:
python3-pil 7.0.0-4ubuntu0.9

Ubuntu 18.04 LTS (Available with Ubuntu Pro):
python-pil 5.1.0-1ubuntu0.8+esm1
python3-pil 5.1.0-1ubuntu0.8+esm1

Ubuntu 16.04 LTS (Available with Ubuntu Pro):
python-pil 3.1.2-0ubuntu1.6+esm2
python3-pil 3.1.2-0ubuntu1.6+esm2

Ubuntu 14.04 LTS (Available with Ubuntu Pro):
python-pil 2.3.0-1ubuntu3.4+esm4
python3-pil 2.3.0-1ubuntu3.4+esm4

In general, a standard system update will make all the necessary changes.

References:
https://ubuntu.com/security/notices/USN-6744-1
CVE-2024-28219

Package Information:
https://launchpad.net/ubuntu/+source/pillow/10.0.0-1ubuntu0.2
https://launchpad.net/ubuntu/+source/pillow/9.0.1-1ubuntu0.3
https://launchpad.net/ubuntu/+source/pillow/7.0.0-4ubuntu0.9

Related news

Gentoo Linux Security Advisory 202411-07

Gentoo Linux Security Advisory 202411-7 - A vulnerability has been discovered in Pillow, which may lead to arbitrary code execution. Versions greater than or equal to 10.3.0 are affected.

Red Hat Security Advisory 2024-3781-03

Red Hat Security Advisory 2024-3781-03 - An update is now available for Red Hat Ansible Automation Platform 2.4. Issues addressed include HTTP request smuggling, buffer overflow, code execution, cross site scripting, denial of service, memory exhaustion, null pointer, and password leak vulnerabilities.

Debian Security Advisory 5704-1

Debian Linux Security Advisory 5704-1 - Multiple security issues were discovered in Pillow, a Python imaging library, which could result in denial of service or the execution of arbitrary code if malformed images are processed.

Ubuntu Security Notice USN-6744-3

Ubuntu Security Notice 6744-3 - USN-6744-1 fixed a vulnerability in Pillow. This update provides the corresponding updates for Ubuntu 24.04 LTS. Hugo van Kemenade discovered that Pillow was not properly performing bounds checks when processing an ICC file, which could lead to a buffer overflow. If a user or automated system were tricked into processing a specially crafted ICC file, an attacker could possibly use this issue to cause a denial of service or execute arbitrary code.

Ubuntu Security Notice USN-6744-2

Ubuntu Security Notice 6744-2 - USN-6744-1 fixed a vulnerability in Pillow. This update provides the corresponding updates for Pillow in Ubuntu 20.04 LTS. Hugo van Kemenade discovered that Pillow was not properly performing bounds checks when processing an ICC file, which could lead to a buffer overflow. If a user or automated system were tricked into processing a specially crafted ICC file, an attacker could possibly use this issue to cause a denial of service or execute arbitrary code.

GHSA-44wm-f244-xhp3: Pillow buffer overflow vulnerability

In _imagingcms.c in Pillow before 10.3.0, a buffer overflow exists because strcpy is used instead of strncpy.

Packet Storm: Latest News

Zeek 6.0.9