OESA-2021-1146

Dashboard / Vulnerabilities / OESA-2021-1146

OESA-2021-1146

Summary: python-pillow security update

Details: Pillow is the friendly PIL fork by Alex Clark and Contributors. PIL is the Python Imaging Library by Fredrik Lundh and Contributors. As of 2019, Pillow development is supported by Tidelift. Security Fix(es): In Pillow before 8.1.0, SGIRleDecode has a 4-byte buffer over-read when decoding crafted SGI RLE image files because offsets and length tables are mishandled.(CVE-2020-35655) Pillow before 8.1.1 allows attackers to cause a denial of service (memory consumption) because the reported size of a contained image is not properly checked for a BLP container, and thus an attempted memory allocation can be very large.(CVE-2021-27921) Pillow before 8.1.1 allows attackers to cause a denial of service (memory consumption) because the reported size of a contained image is not properly checked for an ICNS container, and thus an attempted memory allocation can be very large.(CVE-2021-27922) Pillow before 8.1.1 allows attackers to cause a denial of service (memory consumption) because the reported size of a contained image is not properly checked for an ICO container, and thus an attempted memory allocation can be very large.(CVE-2021-27923)

References: https://openeuler.org/en/security/safety-bulletin/detail.html?id=openEuler-SA-2021-1146, https://nvd.nist.gov/vuln/detail/CVE-2020-35655, https://nvd.nist.gov/vuln/detail/CVE-2021-27921, https://nvd.nist.gov/vuln/detail/CVE-2021-27922, https://nvd.nist.gov/vuln/detail/CVE-2021-27923