Ubuntu alert USN-3090-2 (pillow)
| From: | Emily Ratliff <emily.ratliff@canonical.com> | |
| To: | ubuntu-security-announce@lists.ubuntu.com | |
| Subject: | [USN-3090-2] Pillow regresssion | |
| Date: | Fri, 30 Sep 2016 16:35:57 -0500 | |
| Message-ID: | <1475271357.30577.56.camel@canonical.com> |
========================================================================== Ubuntu Security Notice USN-3090-2 September 30, 2016 Pillow regression ========================================================================== A security issue affects these releases of Ubuntu and its derivatives: - Ubuntu 14.04 LTS Details: USN-3090-1 fixed vulnerabilities in Pillow. The patch to fix CVE-2014-9601 caused a regression which resulted in failures when processing certain png images. This update temporarily reverts the security fix for CVE-2014-9601 pending further investigation. We apologize for the inconvenience. Original advisory details: It was discovered that a flaw in processing a compressed text chunk in a PNG image could cause the image to have a large size when decompressed, potentially leading to a denial of service. (CVE-2014-9601) Andrew Drake discovered that Pillow incorrectly validated input. A remote attacker could use this to cause Pillow to crash, resulting in a denial of service. (CVE-2014-3589) Eric Soroos discovered that Pillow incorrectly handled certain malformed FLI, Tiff, and PhotoCD files. A remote attacker could use this issue to cause Pillow to crash, resulting in a denial of service. (CVE-2016-0740, CVE-2016-0775, CVE-2016-2533) Update instructions: The problem can be corrected by updating your system to the following package versions: Ubuntu 14.04 LTS: python-imaging 2.3.0-1ubuntu3.3 python-pil 2.3.0-1ubuntu3.3 python3-imaging 2.3.0-1ubuntu3.3 python3-pil 2.3.0-1ubuntu3.3 References: http://www.ubuntu.com/usn/usn-3090-2 http://www.ubuntu.com/usn/usn-3090-1 CVE-2014-9601, https://launchpad.net/bugs/1628351 Package Information: https://launchpad.net/ubuntu/+source/pillow/2.3.0-1ubuntu3.3-- ubuntu-security-announce mailing list ubuntu-security-announce@lists.ubuntu.com Modify settings or unsubscribe at: https://lists.ubuntu.com/mailman/listinfo/ubuntu-security...