Ubuntu 19.10: USN-4272-1 Moderate: Pillow Denial Of Service

ubuntu

February 6, 2020

Several security issues were fixed in Pillow.

Summary

Several security issues were fixed in Pillow.

Software Description:

- pillow: Python Imaging Library

Details:

It was discovered that Pillow incorrectly handled certain images.

An attacker could possibly use this issue to cause a denial of service.

(CVE-2019-16865, CVE-2019-19911)

It was discovered that Pillow incorrectly handled certain images.

An attacker could possibly use this issue to execute arbitrary code.

(CVE-2020-5312)

It was discovered that Pillow incorrectly handled certain TIFF images.

An attacker could possibly use this issue to cause a crash. This issue

only affected Ubuntu 19.10. (CVE-2020-5310)

It was discovered that Pillow incorrectly handled certain SGI images.

An attacker could possibly use this issue to execute arbitrary code or

cause a crash. This issue only affected Ubuntu 18.04 and Ubuntu 19.10.

(CVE-2020-5311)

It was discovered that Pillow incorrectly handled certain PCX images.

An attackter could possibly use this issue to execute arbitrary code or

c...

Read the Full Advisory

Topics Covered

security advisory denial of service critical arbitrary code execution Ubuntu image handling pillow

Update Instructions

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 19.10:
  python-pil                      6.1.0-1ubuntu0.2
  python3-pil                     6.1.0-1ubuntu0.2

Ubuntu 18.04 LTS:
  python-pil                      5.1.0-1ubuntu0.2
  python3-pil                     5.1.0-1ubuntu0.2

Ubuntu 16.04 LTS:
  python-imaging                  3.1.2-0ubuntu1.3
  python-pil                      3.1.2-0ubuntu1.3
  python3-pil                     3.1.2-0ubuntu1.3

Ubuntu 14.04 ESM:
  python-imaging                  2.3.0-1ubuntu3.4+esm1
  python-pil                      2.3.0-1ubuntu3.4+esm1
  python3-imaging                 2.3.0-1ubuntu3.4+esm1
  python3-pil                     2.3.0-1ubuntu3.4+esm1

In general, a standard system update will make all the necessary changes.