Alerts This Week
Warning Icon 1 929
Alerts This Week
Warning Icon 1 929

Mageia: 2022-0166 Critical: Python Pillow File Deletion Threat

mageia
Calendar Grey May 12, 2022
Dist Mageia Esm H88
MGASA-2022-0166 addresses security risks in python-pillow, with important fixes released on May 12, 2022.
path_getbbox in path.c in Pillow before 9.0.0 improperly initializes ImagePath.Path

Summary

path_getbbox in path.c in Pillow before 9.0.0 improperly initializes ImagePath.Path. (CVE-2022-22815) path_getbbox in path.c in Pillow before 9.0.0 has a buffer over-read during initialization of ImagePath.Path. (CVE-2022-22816) PIL.ImageMath.eval in Pillow before 9.0.0 allows evaluation of arbitrary expressions (CVE-2022-22817) Pillow before 9.0.1 allows attackers to delete files because spaces in temporary pathnames are mishandled. (CVE-2022-24303)

References

- https://bugs.mageia.org/show_bug.cgi?id=29887

- https://ubuntu.com/security/notices/USN-5227-1

- https://lists.debian.org/debian-security-announce/2022/msg00019.html

- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/thread/CK3IGXU77EQTXZAYI2PTIAI4XLFS7AFP/

- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/thread/JR2LTB6KTUEU7YVPJ5MHA2GHOIL2JQQE/

- https://www.cve.org/CVERecord?id=CVE-2022-22815

- https://www.cve.org/CVERecord?id=CVE-2022-22816

- https://www.cve.org/CVERecord?id=CVE-2022-22817

- https://www.cve.org/CVERecord?id=CVE-2022-24303

Topics%20covered

Topics Covered

security advisory critical DoS file deletion buffer over-read Mageia Python Pillow

Resolution

SRPMS

- 8/core/python-pillow-9.1.0-1.mga8

Severity
critical
Lowest
Low
Medium
High
Critical

Publication date: 12 May 2022
URL: https://advisories.mageia.org/MGASA-2022-0166.html
Type: security
CVE: CVE-2022-22815, CVE-2022-22816, CVE-2022-22817, CVE-2022-24303

Topics%20covered

Topics Covered

security advisory critical DoS file deletion buffer over-read Mageia Python Pillow

Get the latest News and Insights

Get the latest Linux and open source security news straight to your inbox.

Your message here