--------------------------------------------------------------------------------
Fedora EPEL Update Notification
FEDORA-EPEL-2021-a3fe2b021b
2021-10-19 14:55:00.944000
--------------------------------------------------------------------------------
Name : python3-pillow
Product : Fedora EPEL 7
Version : 6.2.2
Release : 3.el7
URL :
http://python-pillow.github.io/
Summary : Python image processing library
Description :
Python image processing library, fork of the Python Imaging Library (PIL)
This library provides extensive file format support, an efficient
internal representation, and powerful image processing capabilities.
There are four subpackages: tk (tk interface), qt (PIL image wrapper for Qt),
devel (development) and doc (documentation).
--------------------------------------------------------------------------------
Update Information:
Backport CVE fixes for CVE-2021-23437 (bz#2001911), CVE-2021-28675 (bz#1958243),
CVE-2021-28676 (bz#1958255), CVE-2021-28677 (bz#1958260), CVE-2021-28678
(bz#1958266), CVE-2021-34552 (bz#1982382)
--------------------------------------------------------------------------------
ChangeLog:
* Sat Oct 9 2021 Orion Poplawski <orion(a)nwra.com> - 6.2.2-3
- Backport CVE fixes for CVE-2021-23437 (bz#2001911), CVE-2021-28675
(bz#1958243), CVE-2021-28676 (bz#1958255), CVE-2021-28677 (bz#1958260),
CVE-2021-28678 (bz#1958266), CVE-2021-34552 (bz#1982382)
--------------------------------------------------------------------------------
References:
[ 1 ] Bug #1958243 - CVE-2021-28675 python3-pillow: python-pillow: DoS in PsdImagePlugin
[epel-7]
https://bugzilla.redhat.com/show_bug.cgi?id=1958243
[ 2 ] Bug #1958255 - CVE-2021-28676 python3-pillow: python-pillow: infinite loop in
FliDecode.c can lead to DoS [epel-7]
https://bugzilla.redhat.com/show_bug.cgi?id=1958255
[ 3 ] Bug #1958260 - CVE-2021-28677 python3-pillow: python-pillow: DoS in the open phase
via a malicious EPS file [epel-7]
https://bugzilla.redhat.com/show_bug.cgi?id=1958260
[ 4 ] Bug #1958266 - CVE-2021-28678 python3-pillow: python-pillow: improper check in
BlpImagePlugin can lead to DoS [epel-7]
https://bugzilla.redhat.com/show_bug.cgi?id=1958266
[ 5 ] Bug #1982382 - CVE-2021-34552 python3-pillow: python-pillow: buffer overflow in
Convert.c because it allow an attacker to pass controlled parameters directly into a
convert function [epel-7]
https://bugzilla.redhat.com/show_bug.cgi?id=1982382
[ 6 ] Bug #2001911 - CVE-2021-23437 python3-pillow: python-pillow: possible ReDoS via
the getrgb function [epel-7]
https://bugzilla.redhat.com/show_bug.cgi?id=2001911
--------------------------------------------------------------------------------
This update can be installed with the "yum" update programs. Use
su -c 'yum update python3-pillow' at the command line.
For more information, refer to "YUM", available at
https://access.redhat.com/documentation/en-US/Red_Hat_Enterprise_Linux/7\
/html/System_Administrators_Guide/ch-yum.html
All packages are signed with the Fedora EPEL GPG key. More details on the
GPG keys used by the Fedora Project can be found at
https://fedoraproject.org/keys
--------------------------------------------------------------------------------