-------------------------------------------------------------------------------- Fedora EPEL Update Notification FEDORA-EPEL-2021-a3fe2b021b 2021-10-19 14:55:00.944000 --------------------------------------------------------------------------------

Name : python3-pillow Product : Fedora EPEL 7 Version : 6.2.2 Release : 3.el7 URL : http://python-pillow.github.io/ Summary : Python image processing library Description : Python image processing library, fork of the Python Imaging Library (PIL)

This library provides extensive file format support, an efficient internal representation, and powerful image processing capabilities.

There are four subpackages: tk (tk interface), qt (PIL image wrapper for Qt), devel (development) and doc (documentation).

-------------------------------------------------------------------------------- Update Information:

Backport CVE fixes for CVE-2021-23437 (bz#2001911), CVE-2021-28675 (bz#1958243), CVE-2021-28676 (bz#1958255), CVE-2021-28677 (bz#1958260), CVE-2021-28678 (bz#1958266), CVE-2021-34552 (bz#1982382) -------------------------------------------------------------------------------- ChangeLog:

* Sat Oct 9 2021 Orion Poplawski orion@nwra.com - 6.2.2-3 - Backport CVE fixes for CVE-2021-23437 (bz#2001911), CVE-2021-28675 (bz#1958243), CVE-2021-28676 (bz#1958255), CVE-2021-28677 (bz#1958260), CVE-2021-28678 (bz#1958266), CVE-2021-34552 (bz#1982382) -------------------------------------------------------------------------------- References:

[ 1 ] Bug #1958243 - CVE-2021-28675 python3-pillow: python-pillow: DoS in PsdImagePlugin [epel-7] https://bugzilla.redhat.com/show_bug.cgi?id=1958243 [ 2 ] Bug #1958255 - CVE-2021-28676 python3-pillow: python-pillow: infinite loop in FliDecode.c can lead to DoS [epel-7] https://bugzilla.redhat.com/show_bug.cgi?id=1958255 [ 3 ] Bug #1958260 - CVE-2021-28677 python3-pillow: python-pillow: DoS in the open phase via a malicious EPS file [epel-7] https://bugzilla.redhat.com/show_bug.cgi?id=1958260 [ 4 ] Bug #1958266 - CVE-2021-28678 python3-pillow: python-pillow: improper check in BlpImagePlugin can lead to DoS [epel-7] https://bugzilla.redhat.com/show_bug.cgi?id=1958266 [ 5 ] Bug #1982382 - CVE-2021-34552 python3-pillow: python-pillow: buffer overflow in Convert.c because it allow an attacker to pass controlled parameters directly into a convert function [epel-7] https://bugzilla.redhat.com/show_bug.cgi?id=1982382 [ 6 ] Bug #2001911 - CVE-2021-23437 python3-pillow: python-pillow: possible ReDoS via the getrgb function [epel-7] https://bugzilla.redhat.com/show_bug.cgi?id=2001911 --------------------------------------------------------------------------------

This update can be installed with the "yum" update programs. Use su -c 'yum update python3-pillow' at the command line. For more information, refer to "YUM", available at https://access.redhat.com/documentation/en-US/Red_Hat_Enterprise_Linux/7%5C /html/System_Administrators_Guide/ch-yum.html

All packages are signed with the Fedora EPEL GPG key. More details on the GPG keys used by the Fedora Project can be found at https://fedoraproject.org/keys --------------------------------------------------------------------------------