Alerts This Week
Warning Icon 1 758
Alerts This Week
Warning Icon 1 758

Mageia 9 MGASA-2024-0133: Python-Pillow DoS and Buffer Overflow Issues

mageia
Calendar Grey April 15, 2024
Dist Mageia Esm H88
MGASA-2024-0145 outlines various vulnerabilities in python-numpy, particularly concerning integer overflow and memory corruption risks.
CVE-2023-44271 Denial of Service that uncontrollably allocates memory to process a given task, potentially causing a service to crash by having it run out of memory

Summary

CVE-2023-44271 Denial of Service that uncontrollably allocates memory to process a given task, potentially causing a service to crash by having it run out of memory. This occurs for truetype in ImageFont when textlength in an ImageDraw instance operates on a long text argument. CVE-2024-28219 A buffer overflow exists because strcpy is used instead of strncpy.

References

- https://bugs.mageia.org/show_bug.cgi?id=32512

- https://www.cve.org/CVERecord?id=CVE-2023-44271

- https://www.cve.org/CVERecord?id=CVE-2024-28219

Topics%20covered

Topics Covered

security advisory denial of service security issue update buffer overflow mageia python-pillow

Resolution

SRPMS

- 9/core/python-pillow-9.2.0-3.2.mga9

Severity
important
Lowest
Low
Medium
High
Critical

Publication date: 15 Apr 2024
URL: https://advisories.mageia.org/MGASA-2024-0133.html
Type: security
CVE: CVE-2023-44271, CVE-2024-28219

Topics%20covered

Topics Covered

security advisory denial of service security issue update buffer overflow mageia python-pillow

Get the latest News and Insights

Get the latest Linux and open source security news straight to your inbox.

Your message here