MGASA-2023-0164 - Updated python-pillow packages fix security vulnerability

Publication date: 16 May 2023
URL: https://advisories.mageia.org/MGASA-2023-0164.html
Type: security
Affected Mageia releases: 8
CVE: CVE-2022-30595,
     CVE-2022-45198

libImaging/TgaRleDecode.c in Pillow 9.1.0 has a heap buffer overflow in
the processing of invalid TGA image files. (CVE-2022-30595)
Improper Handling of Highly Compressed GIF Data (Data Amplification).
(CVE-2022-45198)

References:
- https://bugs.mageia.org/show_bug.cgi?id=31019
- https://github.com/python-pillow/Pillow/releases/tag/9.1.1
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-30595
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-45198

SRPMS:
- 8/core/python-pillow-9.2.0-1.mga8